Report (1st Day) (Continued)
9: Clause 9, page 6, line 5, leave out paragraphs (a) and (b) and insert—
“(a) amend Schedule 1 —(i) by adding or varying conditions or safeguards, and(ii) by omitting conditions or safeguards added by regulations under this section, and(b) consequentially amend this section.”
My Lords, before I launch myself into the detail of these many amendments, I will express our thanks and gratitude for the detailed report of the Delegated Powers and Regulatory Reform Committee. We are also grateful for the extensive and informative discussions in Committee, and we have reflected on the views expressed by all noble Lords during the debates. We have carefully and comprehensively considered each of the committee’s recommendations, and none of our decisions have been reached lightly. A theme that noble Lords have heard me express previously is the extraordinary pace of change in the digital and data economy. I am very conscious that the Bill needs to provide a framework for the constant evolutions and developments in how we use and apply data. It must support rather than stifle innovation and growth and, primarily for this reason, in some areas we have deviated from the committee’s full recommendations.
I will speak to the key points. In its report, the committee raised concerns about the Henry VIII powers in Clauses 9(6), 33(6) and 84(3), which enable the Government to make regulations to “add to, vary or omit” the processing conditions and safeguards for sensitive data set out in Schedules 1, 8 and 10 respectively. Amendments 9, 90, and 99 respond to these concerns and narrow the regulation-making powers in these clauses. Amendment 9 removes the Government’s power to omit processing conditions and safeguards in Schedule 1. Amendments 90 and 99 remove the Government’s ability to vary or omit processing conditions in Schedules 8 and 10 respectively. We reflected at length as to whether we could go further than this but, on balance, considered it necessary to maintain the powers to add new processing conditions and to vary those in Schedule 1.
Many of these powers are not new. The 1998 Act already provides a power to add to the conditions for sensitive processing. In addition, many of the provisions in Schedule 1 in respect of which these powers will apply are currently set out in secondary legislation. This means that they can currently be added to, varied or omitted through other secondary legislation. Our experience under the 1998 Act and, indeed, in Committee, has highlighted the frequency with which scenarios can arise which require new processing conditions for sensitive data. Accepting the Committee’s recommendations in full would leave the Government unable to accommodate developments in data processing and the changing requirements of certain sectors. This in turn could render the UK at a disadvantage internationally if, for example, we were unable to make appropriate future provision for sectors, including those such as insurance, where the UK is a world leader, to reflect advances and changes in their approach to data processing.
The committee also raised concerns about Clause 15 of the Bill, which enables the Government by regulation to add to, vary or repeal the exemptions from certain specified data protection principles and data subject rights set out in Schedules 2, 3 and 4. Clause 111 contains a similar power to add, vary or repeal the list of exemptions in Schedule 11. The Government listened carefully to the debate in Committee, where the noble Lords, Lord Stevenson and Lord McNally, recognised the challenge of future-proofing the legislation to take account of changing technology. The noble Lord, Lord Stevenson, further suggested that,
“the most egregious issue here is when the Government seek to omit legislation which has been passed as primary legislation by secondary legislation”.—[Official Report, 6/11/17; col. 1639.]
I am hopeful that our amendments will set the noble Lord’s mind at rest.
Government Amendments 67 and 68 will remove the Government’s power in Clause 15 to omit provisions in Schedules 2, 3, and 4. It also removes Clause 15(1)(d) in its entirety. Amendment 103 removes the corresponding power in Clause 111(2) to vary or omit the existing provisions in Schedule 11. I am aware that there are some who would like us to go further than this, but it would not be a good idea for a number of reasons. First, a number of the provisions in Schedules 2 to 4 have been added to the Bill to address specific requirements arising from the new regime and have not yet been tested in operation. Others have been carried over from secondary legislation, where they can at present be added to, varied or removed. The Government therefore consider it prudent to retain the ability to amend Schedules 2 to 4 if it proves necessary. There is also a technical issue here. Schedules 3 and 4 contain a large number of references to subordinate legislation. The power to make and amend the instruments referred to does not always include the power to make consequential amendments to primary legislation. This provides a further, technical reason to retain the power in Clause 15 to vary these provisions.
Government Amendment 71 provides that any regulations made under Clause 17 will now be subject to the affirmative rather than negative resolution procedure. In cases of urgency, there is provision for the “made affirmative” procedure to be used if accompanied by an urgency statement. There is precedent for such an approach; for example, in the Legal Aid, Sentencing and Punishment of Offenders Act 2012. Amendments 168, 169, 170 and 184 make consequential provision later in the Bill.
I turn now turn to Amendments 130, 133, 134 and 136, which respond to the Committee’s concerns that the powers in Clauses 142 and 148 were too broad and gave the Government unlimited powers to determine types of additional failure that could attract the Information Commissioner’s enforcement powers, including unlimited penalties. Clearly, this was never the Government’s intention, and these amendments make it clear that any additional failures must be failures to comply with data protection legislation. They clarify also that the regulations making provision about the penalty for an additional failure will provide for the penalty to be either the standard maximum amount or the higher maximum amount referred to in Clause 150.
Amendment 144 provides that the Information Commissioner’s guidance about regulatory action will be subject to the negative resolution procedure when first produced. Generally, the Government believe that guidance of this kind should not be subject to parliamentary procedure. However, exceptionally in this instance, and in recognition of the large and ever-growing number of organisations for which this guidance will be relevant, on reflection the Government agree with the Committee that the negative resolution procedure would be appropriate. Amendments 139, 140, 141, 142 and 143 make consequential provision to ensure that the relevant clause functions as intended.
Amendment 166 reflects the concerns raised by noble Lords in Committee that regulations made under the Bill should be subject to consultation, not only with the Information Commissioner but also with consumer organisations and others who represent data subjects. Accordingly, we are including a requirement in Clause 169 that when the Secretary of State makes regulations under the Bill, she must consult “such other persons” as she considers appropriate. This will apply to all regulations save for those listed in new subsection (2A). We have also tabled consequential Amendments 126, 131, 135 and 138 to remove the equivalent requirement from Clauses 133(1), 142(9), 148(6) and 152(3) to avoid unnecessary duplication in the light of the new general requirement in Clause 169.
Finally, Amendment 171 narrows the regulation-making power in Clause 170 which provides for the Government to update the relevant parts of the Bill once the negotiations are completed on the revised convention 108 to only those parts of the Bill which the Government consider may require amendment. The Government always considered this part to be time limited and Amendment 172 introduces, in line with the committee’s recommendation, a sunset clause so that the regulation-making power in Clause 170 expires three years after Royal Assent.
I again express my gratitude to the committee for its detailed report and recommendations. They gave us much food for thought and I hope noble Lords will agree that we have adopted its recommendations where it was possible to do so. I thank all noble Lords for listening to me for what seems to have been forever.
On Amendment 10 in the name of the noble Lord, Lord Clement-Jones, I shall listen with interest to what he and other noble Lords have to say before responding. For now, noble Lords will be relieved to hear me say that I beg to move.
My Lords, the noble Baroness having sat through my last speech, I am in no position to judge. That was a skilful summary of the memorandum put to the Delegated Powers and Regulatory Reform Committee and it is useful to have it on the parliamentary record.
I remind the House that the amendments we have brought forward do not take the ultra position, if you like. They are about having an appropriate level of parliamentary control over delegated legislation in a field where these are important matters—rights which are inextricably linked to human rights. To boil down a long memorandum, the Minister’s arguments are about flexibility and future proofing. However, the horse has bolted. In previous legislation such regulations were permitted to be made by government and therefore we should roll over and put them into the next bit of legislation.
The one essence that I take away is that the consultation duty is enshrined. I accept that it is a considerable improvement that the Secretary of State must consult the commissioner and such other persons as the Secretary of State considers appropriate. It would be useful at this stage at least to have on the record the kinds of bodies the Minister thinks are appropriate in these circumstances.
The real issue and the reason why we have tabled our amendments—I am not saying they are perfect but they allow for a parliamentary process in which there is an ability to suggest amendments and to have a full consultation on regulation changes—is the controversy about “omission”, “addition” and “varying”. The Government have clearly come to the view that omitting provisions is permissible in certain circumstances but they are relying on adding or varying. They say that varying is a light-touch aspect but why, in certain circumstances, is it permissible to omit provisions added by regulations? Is this a kind of second thoughts aspect, whereby regulations are brought forward under this Bill and then the Government think they want to omit some of them? I do not quite understand the rationale behind that.
I accept that in some of the crucial cases they are limiting themselves to “adding” or “varying”. However, variation can be extremely broad and virtually equivalent to omitting. It seems that one can vary a right all the way down to a minuscule situation which can impinge on the human rights of an individual, even though it is not technically an omission where a safeguarded is provided. These are very broad rights. They are broad powers to create new exemptions to data protection rules as they affect a data subject and they can add exemptions to safeguards for processing sensitive personal data. These matters could have a powerful effect on individuals.
I should remind the Minister of a sad aspect, which is that in its procedures, the Delegated Powers and Regulatory Reform Committee does not seem to have a second bite of the cherry—something I am sure the Minister approves of entirely. But for those of us who relied on the very useful original DPRRC report, it is unfortunate that the committee has not come back and said what it thinks of the ministerial memorandum. In the original report the committee went as far as to say:
“We consider that clause 9(6) is inappropriately wide and recommend its removal from the Bill”.
That is pretty heavy stuff, even for this useful committee. It had even more to say about Clause 15:
“We regard this is an insufficient and unconvincing explanation for such an important power”.
I must put on the record that we on these Benches do not think that the Government have discharged the onus of proof, showing why they need these extraordinary powers under the Bill, and we hope that they will further reduce their regulation-making powers.
My Lords, this group of overwhelmingly government amendments seeks to address issues raised by the Delegated Powers and Regulatory Reform Committee in its sixth report, published on 24 October this year, the only addition being Amendments 10 and 69 in the names of the noble Lords, Lord Clement-Jones and Lord Paddick. As we have heard, the Delegated Powers and Regulatory Reform Committee is widely respected in the House and I am pleased that the government amendments address the concerns raised by the committee. But as we have heard from the noble Baroness, Lady Chisholm of Owlpen, those concerns have not been accepted in full, and she has given the reasons for that.
I was particularly pleased to see government Amendments 9, 67 and 68, among others, which would limit the powers to amend the processing conditions and exemptions found in various schedules to the Bill. I am equally pleased to see the Government act in respect of the powers to make regulations. This will be done using the affirmative rather the negative procedure, starting with government Amendment 71. It gives Parliament the right level of scrutiny and the ability to reject or express regret about a particular decision, and allows for a proper level of scrutiny, a debate having to take place in both Houses.
In respect of Clauses 9 and 15, Amendments 10 and 69 seek to change the scrutiny procedure from the affirmative, as presently in the Bill, to the super-affirmative. I am not convinced that this is necessary as we have the tools at our disposal to scrutinise the proposals using the affirmative procedure. Starting with government Amendment 130, we have a series of amendments relating to the enforcement powers of the ICO, and again these are to be welcomed.
As I say, in general I welcome the government amendments and the explanation given by the noble Baroness.
I thank the noble Lord for those kind words. The noble Lord, Lord Clement-Jones, asked who would be consulted. While it is clearly impossible to be specific, the Secretary of State might consider it appropriate to consult, for example, representatives of data subjects or trade bodies, depending on the circumstances and regulations in question. I hope that that answers his question.
On why it is permissible to admit provisions added by regulations, we believe it is qualitatively different from admitting those added during the extensive parliamentary debate and scrutiny afforded to primary legislation. As I said, many other powers are not new. The 1998 Act already provides a power to add to conditions for sensitive processing. We feel it is prudent to retain the ability to amend Schedules 2 to 4 if necessary. As I said, this is a fast-moving area. We want to make sure that the Bill provides a framework for the constant evolution and developments in how we use and apply data, but it must be supportive rather than stifle innovation and growth.
With the greatest respect, the point I was making was whether the right to vary was not omission by the backdoor. Perhaps I was not clear enough.
No, we do not believe it is omission by the backdoor.
Amendment 9 agreed.
Amendment 10 not moved.
Schedule 1: Special categories of personal data and criminal convictions etc data
11: Schedule 1, page 114, line 9, leave out from “rights” to “, and” in line 11 and insert “which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection”
My Lords, in Committee the noble Earl, Lord Kinnoull—I am very grateful to him for his help and that of the industry bodies that I have now met—told us that the language in the Bill enabling the processing of sensitive data relating to employment might be interpreted more narrowly than the similar wording in paragraph 2 of Schedule 3 to the Data Protection Act 1998. This was never the Government’s intention and I thank the noble Earl and the noble Lord, Lord Clement-Jones, for bringing the issue to the Government’s attention. Amendments 11 and 12 to address these concerns by reverting to the wording used in the 1998 Act, thereby removing any doubts as to their proper interpretation. I will sit down and wait for the noble Earl to propose his amendments and reply to them after. I beg to move.
My Lords, I am very grateful to the Minister for that news on those government amendments. It is very helpful and will prevent a lot of insurers having to redo their administrative systems. I shall speak to Amendments 25 and 26, which are another pair of insurance amendments. I declare my interests as set out in the register of the House, particular those in respect of the insurance industry.
I thank the noble Lord, Lord Clement-Jones, who has been very helpful. He brings great clarity at all times of day to our discussions. Although he is the chairman of the Artificial Intelligence Select Committee, his intelligence is far from artificial and is most helpful. Also, I see the Bill team over there. They have been excellent. Given the amount of fire coming in they are very calm, collected and user-friendly. I thank them for everything they have done so far on the Bill.
The Lloyd’s Market Association, the British Insurance Brokers’ Association and the Association of British Insurers, among other insurance associations, have helped in the preparations of some of these remarks. The insurance industry is trying to deliver products in the public interest. Indeed, some major classes of insurance, such as motor insurance and employers’ liability insurance, are compulsory. There is a long list of other insurances that are quasi-compulsory. For instance, one cannot get a mortgage without buying household insurance. It is greatly to society’s benefit that a wide choice of good products is available at a reasonable price.
The amendments seek broadly to achieve two things. The first is to amend the Bill so that the ordinary person and the ordinary small business can continue to have the best access to a choice of good insurance at a good price, while being consistent with the GDPR, and the second is to ask the Information Commissioner, who works for Parliament, to provide the insurance sector with the specific guidance necessary in this area and not guidance on a one-size-fits-all basis, which does not provide sufficient clarity.
The root of the issue is that the threshold for valid consent under the GDPR will now be much higher, which impacts the handling of special-category personal data. For insurers and reinsurers, the two most common types of special-category personal data are information relating to health and information relating to criminal convictions. Being able to consider health and criminal conviction data is hugely important for insurers uniformly and throughout the world both in taking policies on and in handling claims. As I remarked previously, the ABI estimates that the ability to process such data helped in detecting around £1.3 billion in fraudulent claims in 2015 alone. The LMA estimates the size of the Lloyd’s market alone where health data are required at £2.3 billion of premiums annually.
The ICO draft guidance suggests that consent as a precondition of accessing a service, as would be the case for a proposal for an insurance contract, would not be a legitimate basis for processing special-category personal data. This gives rise to a chicken-and-egg problem for insurance. In Committee, I gave several examples of undesirable results, which I do not propose to revisit.
There are many examples where ordinary citizens and small businesses would have problems were the Bill to be unamended. Where society asks for insurance to be bought, be it the compulsory classes of motor insurance or employers’ liability insurance, or the quasi-compulsory classes, of which there are many—household insurance with a mortgage in place is one—there is a substantial public interest in allowing heavily regulated insurers to process special-category personal data.
As I have said before, trying to shoehorn insurance business into the GDPR consent environment under article 9.2(a) is far from being in the public interest and the public would be best served to use the derogation under article 9.2(g)—that is,
“processing is necessary for reasons of substantial public interest”.
The amendments set out one way in which the issues might be tackled while being wholly consistent with the GDPR. While our detailed and highly constructive discussions continue, the eventual solution may or may not look like them, but I hope that it will have the same effect. Under Amendment 25, the new “insurance” paragraph would continue to sit within the “Substantial Public Interest Conditions” sub-heading in Schedule 1, Part 2, as do the current paragraphs 14 and 15, but the substantial public interest derogation for processing special-category personal data would be used rather than the consent derogation. Further, it makes it clear that special-category personal data can be used only for “necessary … purposes” and not, let us say, for a marketing drive. Sitting over the top will be the ICO and FCA, which I have no doubt will patrol matters with their usual thoroughness.
The other amendment would ask the ICO to prepare insurance-specific guidance and in doing so to consult. In its September response to the consultation on consent, the ICO noted the differing worries of various sectors but said that it did not intend to give any sector-specific guidance. The amendment asks them to do so. Given that the sectors named by the ICO included health and social care, education and charities as well as insurance, it is right that Parliament should ask its Information Commissioner to be as helpful as possible to all sectors. The case for that has grown strongly in the many days of debate that we have had on this Bill, and again today and tonight. I therefore ask the Minister to confirm that these issues will be brought back at Third Reading.
My Lords, it is a pleasure to follow the noble Earl, Lord Kinnoull, who has very impressively pursued these issues with considerable care and determination. He has said pretty much everything that needs to be said. Processing special category data, including health data and criminal convictions is, as he said, fundamental to calculating levels of risk and underwriting. I hardly need to say that to the Minister. His amendments are welcome, but of course the essence of the noble Earl’s amendments is to get from the Minister a progress report on how things are moving on in terms of enabling the continued processing of special category and criminal conviction data and whether we can get something along the right lines that allows a derogation for processing of special category and criminal conviction data where it is necessary in relation to insurance policies and claims. That would prevent disruption to consumers in the way the noble Earl mentioned. Then, of course, there is the guidance produced by Amendment 26; this is what you might call a sprat to catch a mackerel and I hope that the Minister will deliver the mackerel.
My Lords, I welcome government Amendments 11 and 12. As we have heard, they address some of the concerns that were raised in Committee. The Government have said that they never intended to have a narrow interpretation and they have put back the words of the 1998 Act, which is very welcome. As was said earlier, the noble Earl, Lord Kinnoull, has laid out in great detail the issues addressed in his Amendments 25 and 26. He makes a very important and clear case and raised some important issues. I hope that the noble Lord, Lord Ashton of Hyde, will respond to those. I certainly think that there is a case for bringing these things back at Third Reading to address the points the noble Earl has raised.
My Lords, I am grateful to everyone who has spoken in this debate. As we have just heard, Amendment 25 would replace the existing processing conditions:
“Insurance and data concerning health of relatives of insured person”,
“Third party data processing insurance policies and insurance on the life of another”,
with a broader insurance processing condition. Amendment 26 would require the Information Commissioner to produce sector-specific guidance for the insurance sector. These processing conditions are made under article 9(2)(g), the substantial public interest derogation. When setting out the grounds for such a derogation, the Government are limited by the need to meet this substantial public interest test. We are also required to provide appropriate safeguards for data subjects.
The Government recognise the importance of insurance products, in particular compulsory classes and the protection afforded by third-party liability. As the noble Earl mentioned, engagement between the insurance sector and government officials has continued since this matter was discussed in Committee and, indeed, since I met him and representatives of the insurance industry after Committee. There is still some work to do on the precise drafting of the relevant provisions, but I am grateful for the opportunity to place on record the Government’s intention to table an amendment addressing this issue at Third Reading, if we can finalise the drafting in time and the House is content for us to do so. At the moment I am not aware of any insuperable problems in that regard, but noble Lords will recognise that this is a complex issue and one that we want to get absolutely right.
As for the Information Commissioner producing sector-specific guidance, as proposed by Amendment 26, I will certainly take that back and pass it on to the department. With that reinsurance, or rather reassurance—“reinsurance” was a bit of a Freudian slip there—I respectfully invite the noble Earl not to move his amendments this evening. I beg to move.
Amendment 11 agreed.
12: Schedule 1, page 114, line 17, leave out ““social security law” includes the law relating to” and insert ““social security” includes”
Amendment 12 agreed.
Amendments 13 to 15 not moved.
16: Schedule 1, page 115, line 25, at end insert—
“ This condition is met if the processing is—(a) in the exercise of a function of either House of Parliament, and(b) necessary for reasons of substantial public interest.”
My Lords, this group of amendments in my name, prompted by House officials, covers a number of issues concerning parliamentary privilege. The Bill in its present form contains some exemptions to its application to Parliament, but these are considered rather too narrow in scope. The group relates to four areas which have been raised by officials—that is, counsel and clerks of both Houses—as giving rise to concerns about how the Bill as drafted risks infringing parliamentary privilege. These concerns have been discussed extensively with the Bill team and the Leader’s office at official level, and drawn to the attention of the Senior Deputy Speaker, who is of course chairman of the Committee for Privileges and Conduct of this House. I say at once that these discussions have been most helpful and constructive. I pay tribute to the Bill team for its co-operation throughout.
Happily, the Bill team is now, as I understand it and as I expect the Minister shortly to confirm, satisfied that amendments to the Bill in all four areas of concern are appropriate, so that those will be forthcoming before Third Reading in the new year. I recognise and accept that those amendments may not follow the precise wording suggested in the present proposals but, provided they address the substance of these various specific concerns, we shall obviously be disposed to accept them.
In these circumstances, and given that we shall obviously not divide the House at this stage, it is unnecessary to outline the detailed nature of each of these proposed amendments. It is, I hope, sufficient to indicate that they include, for example, meeting concerns lest the Information Commissioner take enforcement action against Members or the corporate officers of either House—here, the Clerk of the Parliaments—in respect of the processing of personal data in parliamentary proceedings. Such action could lead to very substantial administrative penalties amounting to millions of pounds. There are concerns, too, about the liability of both corporate officers to prosecution for certain specified offences for things done on behalf of the two Houses of Parliament. I hope that that is sufficient, and at this stage I beg to move Amendment 16 and ask that the eight other amendments be accepted.
My Lords, from these Benches I support the noble and learned Lord, who is absolutely the right person to pursue this matter. If I might simply add to what he said, it is important that we bear in mind that in the same way as legal professional privilege is the privilege of the client, these provisions would be for the benefit of the public, the running of good democracy, good scrutiny and holding the Government to account. It is not a personal benefit that is proposed here and I hope—I trust, because this is very important—that the Government can find a way through this. I look forward to hearing from them, as the noble and learned Lord said, early in the new year.
My Lords, I am grateful to the noble and learned Lord, Lord Brown, for raising these amendments and for the words of the noble Baroness, Lady Hamwee. His amendments address concerns about the interaction of the Bill with parliamentary privilege. I agree wholeheartedly with him that parliamentary privilege should continue to be safeguarded and maintained for future generations, as it has been for centuries past. As I said in Committee, the Government’s view is that the Bill contains adequate protections to ensure that this is the case. However, we recognise the concerns that, in some areas, these protections could be enhanced and clarified, and we will bring forward amendments at Third Reading to address some of the points that the noble and learned Lord has raised in his amendments.
With that in mind, I will now turn briefly to the amendments themselves, starting with Amendments 16, 17 and 185. The Government recognise the concerns raised in these amendments about the way the conditions for processing sensitive personal data apply in respect of parliamentary proceedings, and liability under Clause 193(5). I am happy to reassure noble Lords that the Government intend to bring forward amendments to address these points at Third Reading.
Amendment 47 would create an exemption for personal data breaches which occur in the context of parliamentary proceedings from the requirement in article 34 of the GDPR. This article requires the data controller to notify data subjects about breaches of their personal data if the breach is likely to result in a high risk to their rights and freedoms. I understand the concerns raised by the noble and learned Lord, Lord Brown, which my officials have discussed with the House authorities. Having reflected on this further, the Government have decided to table an amendment to this effect at Third Reading.
Amendments 128, 129, 132 and 137 would preclude the Information Commissioner from exercising any of her enforcement functions in respect of personal data that is being processed for the purposes of proceedings in either House of Parliament. It is worth highlighting two points to noble Lords. First, the commissioner has all of these enforcement functions under the 1998 Act. While the scale of the penalties that can be levied under the GDPR will increase, there is no fundamental change to the nature of the commissioner’s enforcement functions. Secondly, the protections afforded for parliamentary privilege in the 1998 Act have been broadly mirrored and, where appropriate, developed in the Bill. There is no absence of protection where it was previously provided. To the extent possible, the Bill maintains the status quo for parliamentary privilege. However, we recognise the concerns that the enhanced scale of penalties that the commissioner will be able to apply under the GDPR may inadvertently have a chilling effect on freedom of expression in either House. While the Government cannot accept Amendments 128, 129, 132 and 137 in their current form, given the stringent requirements of the GDPR, the Government will work with the House authorities and look to bring forward an amendment which speaks to these concerns at Third Reading.
I hope that I have reassured the noble and learned Lord and the noble Baroness, Lady Hamwee, that the Government understand the concerns raised through these amendments and will undertake to work with the House authorities to, where appropriate, bring forward amendments to address them at Third Reading.
Before the Minister sits down, I put it to her that, in the considerations that will take place between now and the return in January, one thing that changes between 1998 and today in terms of the Act is something we have not looked at specifically, although it comes up in the Bill. It is the need to ring-fence the Information Commissioner from any involvement with Parliament or the Government. She is answerable to Parliament, but she should not be in that sense exposed to considerations that might adversely affect her. I hope that might be taken into account as well.
I agree with the noble Lord, and we will take that into account.
My Lords, I am most grateful for the reassurance given to us by the Minister. On the basis that all these matters will be brought back in some shape or form at Third Reading, I beg leave to withdraw the amendment.
Amendment 16 withdrawn.
Amendment 17 not moved.
18: Schedule 1, page 115, line 32, at end insert “or rule of law”
Amendment 18 agreed.
Amendments 19 to 23 not moved.
24: Schedule 1, page 118, line 33, at end insert—
“Processing by patient support groups
(1) This condition is met if the processing—(a) is necessary for the purpose in accordance with the conditions listed in sub-paragraph (2), and(b) is necessary for reasons of substantial public interest.(2) The processing is carried out— (a) in the course of its legitimate activities with appropriate safeguards by a foundation, association or other not for profit body with a patient support aim, and(b) on condition that—(i) the processing relates solely to the members or former members of the body or to persons who have regular contact with it in connection with its purposes, and(ii) the personal data is not disclosed outside that body without the consent of the data subjects.”
My Lords, I introduced the same amendment in Committee and do not intend to repeat what I said then. I am glad to say that, since I put down that amendment, there has been a very helpful meeting between DCMS officials, the Genetic Alliance UK and UNIQUE. I very much hope that that meeting will form the basis of a solution on which we can build for Third Reading. I thank my noble friend the Minister for his personal contribution to the progress that we have made.
My understanding is that at that meeting it was accepted that an amendment would have to be brought forward to ensure the legality of the work of patient support groups. My understanding also is that the Government would prefer to do this by their own amendment, and I am certainly very happy to accept that. I also hope that it will be possible to agree such an amendment before Third Reading.
My noble friend has said that he is concerned about defining the scope of the amendment. I certainly accept that that is a legitimate issue. The family of patient support groups is quite large, but I accept that it is right to prevent any amendment becoming a loophole for evasion of the Bill’s provisions. I am conscious of that issue. However, the purpose of the amendment is not controversial and I am happy to look to finding words and drafting that will both safeguard the points that we want to make and provide the right scope for the amendment. It would be highly desirable to be able to deal with this matter in our House.
I hope and trust that my noble friend will be able to confirm that he shares my understanding of the point that we have now reached and that he will be able to give me an assurance at least of best endeavours to present a government amendment at Third Reading. I might say that Genetic Alliance and other patient support groups stand ready to help in any way that they can to meet this deadline.
My Lords, I will speak briefly to support the noble Baroness, Lady Neville-Jones, in her amendment. Clearly, this is of great importance to patient groups. I very much hope that the Minister will carry on the good work and come back at Third Reading with something substantive for the benefit of patient organisations that collect vital health information from their members, so that they will not be required to destroy or anonymise data. Without amendment, the Data Protection Bill has the potential to seriously damage the work of these patient support groups and hinder the work of certain public agencies, too, such as Public Health England and NICE—so I very much support the noble Baroness.
My Lords, I will say a couple of things on this in full support of the proposition made by the noble Baroness, Lady Neville-Jones. These issues are very complicated. We tend to try to brush them aside and hope that they will be dealt with by the person who is enforcing and regulating. But that can be dangerous, because they will find it very difficult as well, and sometimes, if you do not have the intention in the Bill, it may just not happen.
This is important because, while I fully support the intention and objectives of the GDPR in the Data Protection Bill in front of us, which is there for all the right reasons, we have to be careful not to throw out the baby with the bathwater. This is one of those instances where, in trying overzealously to introduce a rules-based system in a complex world and a complex society, you find unexpected consequences. Some of them cannot be defined terribly easily in regulation, but I think it would be wise to put this in an amendment.
We in this House tend to think in principle much more than another place. To try to deal with this in another place when it gets there may be unwise in case they run out of time. It would be good to put something in the Bill in this House at Third Reading, if the Minister were so minded, and I would wholeheartedly support that.
My Lords, I have already spoken on this at length and I do not intend to repeat myself, but I support the amendment from the noble Baroness, Lady Neville-Jones. This is a very important database. It is not just national but international, and it is difficult to collect. That is why I am glad that an accommodation has been made to support the amendment.
My Lords, I add my voice in support of the noble Baroness’s amendment and wish it well. I suspect she has run into the logjam that constitutes the waiting list to see the Bill team and the Ministers, who have been worked so hard in the last few months. But I hope it will be possible, given that there is a bit of time now before Third Reading, for this matter to be resolved quickly and expeditiously before then.
My noble friend Lady Neville-Jones explained in Committee that Unique plays a hugely important role in providing advice and support to sufferers of rare chromosomal disorders and their carers. Some of these charities have large databases dating back many years, so we understand their desire to maintain these when the GDPR comes into force without necessarily obtaining fresh consent to GDPR standards for each data subject included on the database. When families are providing support to their loved ones, some of whom may need round-the-clock care, filling in a new consent form may not be high on their agenda.
However, they may still value the support and services that patient support groups provide and would be concerned if they were removed from the charities’ databases. If charities such as Unique had to stop processing or delete records because consent could not be obtained, they worry that this would impede the work they do to put patients and their families in touch with others suffering from rare genetic conditions, help clinicians to deliver diagnoses and facilitate research projects. We recognise that this could be particularly damaging when there is barely any knowledge of the condition other than what they may hold on their database.
Let me be clear: if there is a grey area in the Bill that puts this work at risk, the Government are fully prepared to amend it. Legislating in this area is not straightforward and I am keen that the policy and legal teams in the department are able to continue with the constructive discussions they have been having with Unique and the UK Genetic Alliance to ensure that the legislation adequately covers the specific processing activities they are concerned about, while providing adequate safeguards for data subjects. I assure noble Lords that we will use our best endeavours to work on this legislative solution as quickly as possible. If it is not ready by Third Reading, and I am afraid I cannot promise it will be, the Government will endeavour to introduce any necessary provisions at the next possible amending stage of the Bill. I will of course ensure that my noble friend gets the credit she deserves for her persistent efforts on this subject when that time comes.
Government Amendments 72 to 77 are the products of detailed discussion with the noble Lord, Lord Patel, the noble Baroness, Lady Manningham-Buller, and representatives of the Wellcome Trust. I thank them very much for those constructive and helpful discussions. In Committee we discussed the operation of the safeguards in Clause 18 and the potentially damaging impact they would have on pioneering medical research. As I explained at the time, it was never the Government’s intention to undermine such important work, so it is with great pleasure that I table these amendments today.
Noble Lords will recall that the greatest concern stemmed from the safeguard in what is currently Clause 18(2)(a). That paragraph was designed to prevent researchers using personal data to make measures and decisions in respect of particular data subjects but, as the noble Lord explained, there are certain types of medical research where this is inevitable. In the context of a clinical trial, for example, a data subject might willingly agree to participate, but in the course of the trial researchers might need to make decisions about whether the treatment should continue or stop, with respect to some or all data subjects. Government Amendment 77 addresses this concern by making it clear that the safeguard is automatically met where processing is necessary for the purposes of approved medical research. Approved medical research is defined in the new clause and includes, for example, research approved by an ethics committee established by the Health Research Authority or relevant NHS body. Importantly, the new clause also contains an order-making power so that the definition of approved research can be kept up to date.
We have also taken the opportunity to make a small change to the safeguard in Clause 18(2)(b), which currently states that processing for research purposes should not occur if it causes substantial damage or distress to “an individual”. The Wellcome Trust and others pointed out that this language is different from that used in the Data Protection Act 1998, which talked about damage or distress caused to “a data subject”—namely those participating in the research. We did not set out to alter this safeguard, nor to jeopardise research that might conceivably offend far removed from the actual activity. Amendment 76 therefore reverts to the tried and tested language of the 1998 Act.
The amendments have been developed in close liaison with the Wellcome Trust and I am grateful to it for its help. On that note, I hope my noble friend feels able to withdraw her amendment and that all noble Lords feel able to support the government amendments in the group.
Before the Minister sits down, I thank him and his team immensely for taking on board the concerns that I and others expressed about the interventional medical research that the government amendments will now allow. It cannot be overstated: this will now allow important research, including clinical trials, to be undertaken that will advance medical research in the United Kingdom, making it an attractive place to do such research. I thank him immensely; I am most grateful.
My Lords, I am extraordinarily grateful to noble Lords who have spoken in support of my amendment, and for the comprehension that the Minister has shown for the work of the patient support groups. They will have greatly appreciated hearing how much the Government support what they do.
I very much hope that we can work on an amendment that will both meet the Government’s concerns and effectively cover the work of those organisations, which, as I think the Minister understands, work in difficult circumstances. They stand ready to participate with the Government in getting language that will both cover their concerns and ensure that we do not open the door to those for whom it is not intended. On that basis, I beg leave to withdraw the amendment.
Amendment 24 withdrawn.
Amendments 25 and 26 not moved.
27: Schedule 1, page 121, line 27, at end insert “and any additional activities determined to be appropriate by the Electoral Commission”
My Lords, I tabled this amendment to keep the issue that I raised in Committee on the agenda. I spoke about it at some length in Committee. I think it is better determined by your Lordships’ House, rather than going off to the other place. I know the Minister has kindly agreed to a meeting. We have not had a chance to have it yet, but we will later this week.
I know that the noble Lord, Lord Hayward, who sits on the Government Benches, fully supports this issue being debated. He, like me, hopes it can be sorted out here by Third Reading, rather than going to the other place. The basic problem is that provisions in the Bill potentially conflict with legislation in respect of elections and other matters already on the statute book. I went through those in Committee. I am sure we do not want to pass legislation that conflicts with existing legislation, but we risk doing that here. That cannot be right. What political parties, campaigners and politicians need—and certainly what the regulators need—is crystal clear legislation and regulation that they can apply. To pass something that is in direct conflict with the Representation of the People Act would be unwise. We need to have our meeting later this week and I hope we can bring something back at Third Reading. These are important issues that we need to get right to ensure that all legislation is working together. I beg to move.
My Lords, I am very glad that the noble Lord is keeping this on the agenda. I had a note to ask what was happening about the meeting to which lots of people were invited at the previous stage. I do not believe that we have heard anything about it. This is not a whinge but a suggestion that it is important to discuss this very widely.
I find this paragraph in Schedule 1 very difficult. One of the criteria is that the processing is necessary for the purposes of political activities. I honestly find that really hard to understand. Necessary clearly means more than desirable, but you can campaign, which is one of the activities, without processing personal data. What does this mean in practice? I have a list of questions, by no means exhaustive, one of which comes from outside, asking what is meant by political opinion. That is not voting intention. Political opinion could mean a number of things across quite a wide spectrum. We heard at the previous stage that the Electoral Commission had not been involved in this, and a number of noble Lords urged that it should be. It did not respond when asked initially, but that does not mean it should be kept out of the picture altogether. After all, it will have to respond to quite a lot of what goes on. It might not be completely its bag, but it is certainly not a long way from it.
We support pinning down the detail of this. I do not actually agree with the noble Lord’s amendment as drafted, but I thank him for finding a mechanism to raise the issue again.
I am grateful to the noble Lord, Lord Kennedy, for raising this issue, and to the noble Baroness for her comments. These issues are vital to our system of government, and we agree with that.
Amendment 27 seeks to expand the umbrella term “political activities” to include any additional activities determined to be appropriate by the Electoral Commission. Noble Lords will agree that engaging and interacting with the electorate is crucial in a democratic society, and we must therefore ensure that all activity to facilitate this is done in a lawful manner. Although paragraph 18(4) includes campaigning, fundraising, political surveys and case work as illustrative examples of political activities, it should not be taken to represent an exhaustive list.
Noble Lords will be aware that the Electoral Commission’s main areas of expertise concern the regulation of political funding and spending, and we are of the opinion that much, if not all the activities they regulate will be captured under the heading “political activity”. As I have just set out, fundraising is included as an illustrative example, which ought to provide some reassurance on this point. Moreover, the greater the number of activities denoted by the Electoral Commission, the less likely it is that any other activity would be considered by a court to be a political activity by dint of its omission. The commission, a body which as far as I am aware claims no expertise in data protection matters, would find itself in an endless spiral of denoting new activities as being permissible under the GDPR. Nevertheless, in recognition of the importance of such processing to the democratic process, the Government are continuing to consider the broader issues at stake and may well return to them in the second House. In this vein, the noble Lord made a number of good points, and I look forward to meeting him with the Minister for Digital, my right honourable friend Matt Hancock, on Thursday this week to discuss the matter in more detail than the parameters of this debate allow. We will see what the noble Lord feels about the timing of that after the meeting.
As for the noble Baroness, Lady Hamwee, we talked about having bigger meetings, and I am sure the time will come. This is just a preliminary meeting to decide on timings and to give the noble Lord, Lord Kennedy, the chance to discuss this with the Minister for Digital. I envisage that further meetings will include the noble Baroness.
I appreciate the sentiment behind the noble Lord’s amendment. In the light of our forthcoming discussions, I hope he feels able to withdraw it.
I thank the Minister for his response. I tabled the amendment to keep the issue live and to illustrate the problem we have here. In his response, he talked about the responsibilities of the commission and data protection responsibilities and how they may conflict, belonging to different bodies. That begins to highlight the problem that we potentially have here. You could have different regulators trying to enforce different bits of legislation, all on the statute book at the same time and equally legitimate. We have got a real problem here.
I look forward to the meeting on Thursday. It is very important that we have a meeting after that, though, with a much wider group of people from different parties and campaigns. It is a genuine problem that affects every political party represented in this House and the other place and those that are not in either House. There is no advantage here—it is a question of getting a procedure in place that allows political parties to campaign and do their job properly and fairly. Equally, it protects the volunteers so that they understand what they can and cannot do so that they do not unintentionally get themselves in difficulty. I look forward to the meeting, but there are one or two things to sort out before then. I hope that it can get done by Thursday but, if it cannot, we have the other place. But it would be much better to sort it out at this end rather than the other end. I beg leave to withdraw the amendment.
Amendment 27 withdrawn.
28: Schedule 1, page 122, line 29, at end insert—
“( ) A member of the House of Lords is to be treated as an elected representative for the purposes of this paragraph and paragraph 20.”
My Lords, this pair of amendments, like the earlier group that I proposed, promoted by House officials, concerns another aspect of parliamentary privilege. Unlike the earlier group, these amendments have failed thus far to attract the support of the Bill team and government. Also unlike the earlier group, they relate only to this House, and not the House of Commons. But I shall have to address the issue at a marginally greater length than previously.
As will readily be apparent from the text of the two amendments, they propose that, with regard to a particular aspect of the processing of sensitive personal data, a Member of this House should be treated in the same way as a Member of the other House—or, for that matter, as Members of every other elected body in the country down to the smallest local authorities. There are really compelling reasons why in this context we should be treated on the same basis as elected representatives.
I begin with two acknowledgements. First, I readily concede that, unlike all the other representatives in public life, Members of this House are not elected. I put aside the Minister’s observation in Committee that he speaks as an elected Member,
“albeit with a fairly small electorate”.—[Official Report, 13/11/17; col. 1818.]
Secondly, I recognise that the Bill as drafted would essentially continue the position that has existed for the past 15 years, established under the Data Protection Act 1998 by secondary legislation in a ministerial order which followed in 2002.
The benefit of the particular provisions in Schedule 1 to the Bill which we are now seeking to amend by our proposed inclusion of Members of this House is that it would better enable elected representatives by dispensing in certain limited circumstances with the need for the express consent of the data subject to campaign on behalf of individuals.
Of course, Members of your Lordships’ House do not have constituency casework in quite the same way as Members of Parliament do. However, it surely cannot be doubted that many Members of this House—the noble Baroness, Lady Hamwee, whose name has been attached to this group, is obviously one such—do champion individual cases and causes on behalf of a variety of interest groups.
Since the ministerial order of 15 years ago, passed in the wake of the 1999 reform, by which we became a House largely of life Peers, an increasing number of the appointed Members have previously been elected representatives in one body or another, such as the House of Commons, devolved Parliaments and Assemblies, the European Parliament or local authorities. Doubtless, at least partially because of that background, they have been more inclined to pursue various causes.
Consistent with this, an increasing number of Members over the last 15 years have been undertaking activities in support of pressure groups and action groups, including the advancing of individual cases. The Government surely do not now want to inhibit these activities or to discourage or dissuade Members from pursuing these cases. I therefore urge the Government to reflect and, indeed, welcome this new reality and put Members of this House, in this strictly limited context, on the same footing as elected representatives so that they are not henceforth disadvantaged in the discharge of these duties.
Finally, unlike the earlier group of amendments concerning parliamentary privilege, this group relates exclusively to the work of your Lordships’ House. Although the Bill eventually goes from here to the House of Commons, that House will perhaps have little interest in this issue—so, par excellence, the question should be considered here. Even if the Minister will not give ground today—I recognise that he may be under clear instructions not to—I hope he will recognise that there is sufficient force and merit in these arguments to agree at least to have another look at this issue before Third Reading. In that case, I suspect that we will not be pushing it further at this stage.
My Lords, I have put my name to this amendment. I stumbled on the omission of Members of this House during debate in Committee, when I asked what I thought was an innocent question. I was asked to appear on the BBC’s “Question Time” after the list of Peers of which I was one was announced but before I actually arrived here. It was a fairly difficult occasion, which I remembered when I was thinking about this issue at lunchtime today. When I referred, during the discussion, to Members of Parliament, Nicholas Ridley said, “You are a Member of Parliament”. We are all Members of Parliament. We happen to be Members of the House of Lords; those who are normally called MPs are Members of the House of Commons. I regard myself as being in a representative position, even though I am not elected.
I disagree with one comment of the noble and learned Lord, which was about the amount of casework that I do. I am so conscious of the problems of getting it wrong, particularly in the area of immigration, that I try not to do that work. However, it is notable how the number of requests to Peers to intervene in individual cases has grown over the last few years. I suppose that reflects the fact that MPs are taking on more and more of what a few years ago one might have called social work. There are not the same demarcation lines as perhaps there used to be.
The casework, among other things, informs our general response to policy issues and specific proposals put before us, so we cannot exclude ourselves from all this. Ten days or so ago, in response to a request to pursue a particular case, I made the point that the individual should approach her own MP. The answer came back, through an intermediary, “She’s an asylum seeker. She doesn’t have an MP. We’re looking for anyone who can help”.
In Committee, questions on this issue were asked round the House. I recall that the noble Lord, Lord Lucas, took up the point after I had asked a question. I am very grateful to the noble and learned Lord for pursuing this matter. I hope that the Minister will accept his suggestion that this should be considered further between now and Third Reading, and that it should be dealt with at this end. I hope that the Minister will this evening assure us that it will remain on the agenda and that we can return to it at the next stage of the Bill in this House.
My Lords, we do not need to think very hard about this issue in terms of providing evidence that might be helpful to Ministers given that at Oral Questions today, at which I think the Minister and the noble Baroness were present, a case was raised by a Peer on our side of the House, in a Question to the DWP Minister, which verged on picking up a particular case. It was very useful in terms of making a broader political point. Are we saying that that will not be possible in future, as it raises significant questions? Secondly, as the noble Baroness, Lady Hamwee, said, irrespective of whether we have been an MP or a Member of the other House, we receive letters and emails almost daily offering individual data and information which, if we used it, would, I think, fall into the category mentioned by the noble and learned Lord.
At the weekend, I had the privilege of seeing the RSC perform the “Imperium” plays, adapted from the books of Robert Harris. These deal with a well-known orator, Cicero. Noble Lords will not be surprised to learn that he recommends to his clients—at one stage, he gives a tutorial to fellow citizens of Rome who intend to seek high office—that it is always helpful, and always catches the attention of an audience, if you give the specifics of an individual case and rise from that to the general. So if there is a possibility of placing a constraint on the ability of Members of this House to raise cases in an effort to improve the quality of life for citizens to whom we owe a duty of care and responsibility, that must be wrong. I hope that the Minister will take this away and work with the noble and learned Lord, Lord Brown, to bring something forward at Third Reading.
My Lords, Amendments 28 and 29 create a new processing condition for Members of this House. The Government’s view is that the provisions in paragraphs 19 and 21 of Schedule 1 are intended to reflect the unique and special nature of the relationship between an elected representative and their constituent.
Like the noble Baroness, Lady Hamwee, and the noble and learned Lord, Lord Brown, I am very aware of the important and valuable work that many noble Lords carry out on behalf of members of the public, advocating for their rights, taking up their cases with government departments and representing their interests in any number of scenarios. However, this relationship between a Peer and a member of the public is of a different nature and order from that conferred on an elected representative by their constituents. Elected representatives have particular rights and duties to act on behalf of the citizens they represent. The Government therefore consider it appropriate for them to be able to deal with urgent situations where they could not reasonably be expected to obtain consent; for example, in the case of an individual facing imminent deportation. There is no such need for Peers to be exempted from the provisions on consent. I stress again that nothing in the Bill or the GDPR prevents Peers undertaking casework if they first obtain the consent of the individual concerned.
I emphasise that these provisions are not new. The position under the 1998 Act is very similar and, in answer to the point made by the noble Lord, Lord Stevenson, it has not prevented Peers who are interested in undertaking casework doing so. Indeed, I have not found difficulty in this respect; I have just obtained consent first.
I hope I have reassured the noble and learned Lord that the Government understand the concerns raised, and that in this instance he will withdraw his amendment.
I confess to being disappointed by the Minister’s response to this. I dealt with the fact that things have changed over the 15 years since the 2002 order. Of course there will continue to be circumstances in which it is possible to get, without inhibiting problems, the express consent of the person concerned. However, it will not always be possible, and to that extent it will inhibit the future ability of Members to discharge a function they have been discharging. Of course I will not divide the House at this stage; nevertheless, I urge the Government to reread the arguments and submissions that the noble Baroness and I have advanced today and see whether they cannot bring themselves to recognise that there is a substantial point here. Although there is a natural reluctance to treat us as elected Members, they should for this limited purpose do so; that is justified in the narrow circumstances in which this point arises.
Before the noble and learned Lord finishes, if the House permits me, I will raise something with the Minister. A number of individual cases are brought to us through other organisations, which may have the consent of the individuals. We would want to pursue a matter in the way the noble Lord, Lord Stevenson, just mentioned—I was not at Question Time today but I can imagine the kind of situation. It would add considerably to the difficulty of doing that if the consent obtained by the organisation was thought not to extend to a Peer taking up the matter. I do not know how we would deal with that. It would be a considerable barrier to our doing what I regard as our job.
I am grateful to the noble Baroness, who puts forward a dimension to the problem that she is much more alive to than I am. However, there it is. I urge the Minister to reread these speeches and, in the meantime, I have no option but to beg leave to withdraw the amendment.
Amendment 28 withdrawn.
Amendment 29 not moved.
30: Schedule 1, page 124, line 1, at end insert “or tribunal”
Amendment 30 agreed.
Consideration on Report adjourned.
House adjourned at 10.15 pm.