Committee stage in the Lords
- Speaker
Lord Black of Brentwood (Con)Conservative- Quote
- My Lords, in moving Amendment 163A I shall speak also to Amendments 164A, 170B to 170D, 172A to 172C—a number of which the noble Viscount, Lord Colville of Culross, has added his name to—and to the Question whether Clause 165 should stand part. I fear that if noble Lords are still suffering from indigestion as a result of the alphabet soup of amendments we had in Committee last week on this subject, today we have an even more indigestible alphabet banquet. The amendments relate to media freedoms. I declare my interest as the executive director of the Telegraph Media Group and draw attention to my other media interests. As with the previous group of amendments we discussed in Committee, the implications in this area go well beyond the press and impact on online and broadcast media, along with a wide range of literary and artistic interests. They are supported by the Media Lawyers Association, the News Media Association and the Society of Editors. In the past few days, noble Lords may also have received very important representation, specifically on Clause 164, from the BBC, ITV and other broadcasters. I highlight two points in particular to give context to this group of amendments. First, Clause 164(3)(c) gives a statutory regulator—the Information Commissioner —powers to interfere with investigations and reporting, pre-publication. Secondly, unless the defences in the Bill are augmented, Clause 161 means that a reporter vindicated as acting lawfully in the eyes of the civil courts could be convicted on the same grounds in the criminal courts. That has widespread ramifications. The exemption for special purposes covers not only the journalism of the BBC, Channel 4, ITN and all newspapers, national and local, but the deadly serious journalistic work of NGOs and campaigning organisations such as Global Witness. The GDPR demands freedom of expression protections for academic, literary and artistic purposes as well. That means that the playwright, producer, professor, provocative cartoonist, artist, author, diarist and publisher of any book whose work at any stage uses information about living individuals, falling within the broad application of the Bill, is as vulnerable to these parts as the media. That is why the provisions deserve the most careful scrutiny and attention. Given that these powers bite pre-publication, the mere assertion of a data protection breach will be a marvellously cheap and convenient way for individuals with something to hide to stop any work that may cast them in an unwelcome light in its tracks. Indeed, there is a double jeopardy in the Bill, as under Clause 165, the Information Commissioner is empowered to provide financial support to people wanting to bring action; her written determination would also lift any stay on legal action in respect of pre-publication processing. Let me explain, as briefly as I can, how these amendments seek to tackle that mischief. The first two of them relate to penalties. Amendment 163A to Clause 143 is intended to prevent inconvenient truths being all too conveniently covered up. Currently, the original publisher of an article de-listed from Google or other search engines, following the complainant’s appeal to the Information Commissioner to have it taken down by the content aggregator, neither knows about this virtual disappearance nor has any opportunity to put the case on the accuracy or continued relevance of the article to the ICO. This amendment introduces the option of the ICO consulting with the originating publisher prior to making a determination and then publicising the determinations made. Amendment 164A to Clause 148 addresses the overall proportionality of penalties for infringements of the Act. As noble Lords will know, a company in breach must pay the appropriate penalty as set out under the Act. However, there is again the risk of double jeopardy as far as the media are concerned, because the standard contractual terms of content aggregators such as Google require media organisations to indemnify them in respect of journalistic material that they then disseminate to their users. Due to their huge global turnovers, such aggregators could be liable for far greater fines under the GDPR, dwarfing those that any media organisation would be liable for on its own transgression. That could result in media organisations facing financial ruin because of the indemnity they are bound to give. This amendment simply proposes that, when any fine is imposed, consideration should be given to indemnities, compensation and other penalties for which organisations are liable, if a breach arises.
- Time
- 15:37
- Source
- View in Hansard ↗
- Speaker
Earl Attlee (Con)Conservative- Quote
- My Lords, it may be for the convenience of the Committee if I speak to my Amendments 170AA, 170AB and 170AC at this point. I am grateful to my noble friend for moving his amendment in the skilful way that he did. I hope that my noble friend the Minister has some good answers because my noble friend worried me somewhat. I fear that I will have to detain the Committee for some time. I wish to make it clear that I have never been mistreated by the media and I do not think I know any celebrity who is not also a parliamentarian. My only complaint is that the general public have never heard of me. Quentin Letts once likened me to Lord Lucan, and when I accidentally appeared to cancel a mainline electrification programme from the Dispatch Box, I got three-quarters of an inch on page 2 of the Sun—at £1.6 billion it was quite an expensive way of getting some publicity. During the passage of the Crime and Courts Act, I was in the Government with other responsibilities. I have little doubt that later, as a loyal Government Back-Bencher, I voted against the attempt made by the noble Baroness, Lady Hollins, to get Section 40 of the Crime and Courts Act commenced. Thanks to an intense media campaign, I realised that something was going badly wrong when the Government failed to commence Section 40 after the PRP was established and it had approved its first independent regulator. At present any claims against newspaper publishers where the claimant is an ordinary member of the public is a David versus Goliath battle. The claimant is an individual with limited resources, whereas newspaper publishers are typically well resourced, with teams of lawyers. In effect, the claimant is required to mortgage their home—if they own it—to meet the costs of an action. This is unless they can get a CFA, which is not available for data protection claims—a point that I will come to later. This risk deters ordinary members of the public from ever bringing a claim. When it comes to libel, all they really want is a correction with due prominence. This principle applies to data protection claims as well. Subsequently, publishers have enjoyed impunity in relation to breaching the data rights of ordinary members of the public. However, the reverse can also be true. Sometimes the claimant is exceptionally wealthy—such as a Russian oligarch—and even the newspapers can struggle to meet the costs of defending a claim. In such cases, censorship can occur where a litigant threatens legal action in order to prevent an article being published. What editor is going to risk hundreds of thousands of pounds in legal costs just to have a pop at a billionaire who desperately deserves it? The Committee will recall that Lord Justice Leveson recommended a solution: newspapers join a recognised regulator which must offer arbitration, among other things. Arbitration is cheap for the defendant and the claimant, so the cost risks evaporate for both. The only losers in all this are the lawyers on both sides—which I am sure all Members of the Committee will approve of. Most newspapers, however, favour the ability to breach the rights of ordinary members of the public rather than having the free speech benefits of protection from claims by wealthy individuals. So Lord Justice Leveson recommended this ingenious cost-shifting provision. Newspapers in a recognised regulator offering arbitration are immune from paying the claimant’s costs in cases brought against them, win or lose. Newspapers which have rejected joining a recognised regulator—and, as such, are not offering mandatory arbitration—must meet the costs of all claims brought against them, win or lose. Of course, there are the usual safeguards against frivolous and vexatious claims, even for those not signed up to an approved regulator. As well as protecting free expression and access to justice, this provision would incentivise the press to sign up to a recognised regulator, as Leveson recommended and as Parliament decided and provided for by means of the Crime and Courts Act 2013. I recognise that in its current form the Bill cannot be used to force the commencement of Section 40 for libel and privacy claims and the like, however strong the case for doing so. However, it can apply Section 40 to data privacy claims relating to publication and commence it. That would give ordinary people whose privacy is invaded at least some protection and provide at least some incentive. Section 40 of the Crime and Courts Act contains this provision for all media claims except data protection. This was a concession to the press at the time, when data privacy claims were rare because the 1998 Act was written in a way that would require there to be actual financial loss before bringing a claim. The Vidal-Hall v Google case in the Court of Appeal found that the 1998 Act was not compatible with the parent EU directive on this point and had to be interpreted as allowing “distress only” claims, as with other privacy claims.
- Time
- 15:45
- Source
- View in Hansard ↗
- Speaker
Viscount Colville of Culross (CB)Crossbench- Quote
- My Lords, I declare an interest as a series producer at ITN Productions. I want to talk particularly about Amendments 172A to 172C and whether Clause 165 should stand part of the Bill—all of which relate to the powers of the ICO to investigate special processing. I, too, am very concerned that Clause 164 represents a considerable and troubling extension of the power of the Information Commissioner, which will have a damaging effect on free speech. It will damage not just journalism but academia, art and literature by unleashing a torrent of complaints prior to publication or launch of a work. These amendments will ensure that the powers of the ICO in these matters remain as they are—a situation which has worked well since we have had the Data Protection Act 1998. In Clause 164(3), paragraphs (a) and (b) indeed make no change. They allow the ICO to investigate and give a written determination on whether the processing of data is for special purposes and publication, and therefore exempt. However, my concern is that paragraph (c) seems to be an important and worrying extension of the power of the ICO. It means that even if she thinks that the data processing is journalism, literature or art she can, in addition, investigate whether the means by which the data is being collected or processed is compliant with the Act. These powers can be used prior to publication, meaning that any complainants who want to stop a journalistic or academic investigation from continuing can now call for the ICO to make a written determination on the way in which the data is being collected. This will open the door to a far greater number of complaints to the ICO. At best, dealing with these will be very time-consuming and wasteful of resources. At worst, they will result in public interest journalism being delayed or thwarted altogether by a regulator with limited expertise of the media, and who may well lack the resources for such an endeavour. The provision for such ICO inquiries to take place before publication goes against an important principle of our law, which allows for the information to be published and then for the courts or regulators, such as Ofcom, to decide whether there has been an infringement. Clause 164(3), as drafted, suggests that the commissioner is going to make her own judgment of these questions and not simply assess whether the judgment of the data controller—for instance, the editor of the newspaper or the author—is genuine and reasonable. My concern is that, even if the ICO does not exercise her powers, the prospect of her doing so will have a chilling effect on editors’ decisions about whether to publish. I am already finding that, in the documentaries that I am making, stories which would have been published a few years ago are now not being published for fear—among media lawyers—that there will be a breach of the legislation. In one case, I was told by the media lawyer that I could broadcast a story only if it was already in the public domain—which to me, as a journalist, seems likely to negate the whole purpose of the exercise. I am advised by media lawyers at ITN, the BBC and a number of newspapers, whose views I very much respect, that these new powers of the ICO and other proposed amendments will affect journalists’ investigations in many different ways. Amendment 172B is intended to ensure that the scope of the exemption continues to apply not merely to information that is due to be published but to information that will inform the final publication. The failure to maintain the existing provision would have the damaging effect that, for instance, a fraudulent businessman who is being investigated could submit a subject access request on the relevant data which had been gathered as part of the story. The result would be that the businessman would be able to find out where the investigation was going and take action to close down that investigation. He would also be able put pressure on the sources of the information that would be revealed by the access request. I work in television, and a particular concern of mine is the future of secret filming for journalism, which could be threatened by this clause. It would allow the ICO to look into whether the use of recording, without consent, was appropriate or even necessary. It is not clear from the clause what precise test the ICO will apply, but it will involve the ICO making fine editorial judgments, including whether the investigation could or should have been advanced by using less intrusive means. I have carried out many secret filming assignments in my capacity as a producer at the BBC, and I know that the activity is already very tightly controlled to stop fishing expeditions and to ensure that it is aimed directly at and focused on the suspected parties. The BBC code requires clear evidence that the subject of the filming has been involved in wrongdoing. This evidence is rigorously questioned by the lawyers before permission is given to go ahead, and the results of the filming are carefully looked at to make sure that they relate directly to supporting the story. Unless these amendments are adopted, once the person who is the target of secret filming is told that they are the subject of the story, they could issue a claim or subject access request on the secret filming and delay, or even successfully stop, the story being published. Lawyers at the BBC advise me that some of our important investigations in the public interest would be delayed and maybe in some cases stopped by these new powers. The stories that could have been affected include public interest investigations into wrongdoing, such as those into Winterbourne View and the Rochester young offenders unit or even last week’s BBC “Panorama” on student loan fraud, in which two men were secretly filmed giving advice to prospective students about how to get through a degree by cheating and how to fraudulently collect a student loan. Perhaps even more problematic will be other people who are not the centre of the investigation but who might get caught up in secret filming or open filming without consent. They could include family members or employees of a company being investigated. These people would not be featured in the final publication or broadcast, but their ability to complain prior to publication would allow them to call on the ICO and deliberately delay or stop an investigation because their data had been collected during the filming. An example is the BBC investigation into the payday lender Wonga, which many noble Lords will know about, whose lending practices were questionable and caused bankruptcy and despair across the country. During the secret filming of the Wonga loan agents, the journalist also filmed the receptionist. She was never going to be featured in the final programme, but her data had been collected and she tried to use it to protect her employers and stop the programme going out. Under Clause 164 she would indeed be able to call in the ICO to give a written determination on the way her data had been collected, and the film would be stopped in its tracks. For the complainant, the time and cost would be minimal—meaning that there is a very low barrier to seeking the help of the ICO. Other investigations could be thwarted based not just on the data that might be published but on the way the data might be held by the journalist for use in later articles as part of a continuing investigation. Noble Lords may remember the Sunday Times exposure of Lance Armstrong, a man who at the time was seen as the greatest cyclist in history. He was accused by the Sunday Times of taking performance-enhancing drugs. As a result, he took the paper to court for defamation, and it was forced to settle. Under this clause, Armstrong would then be able to bring a data protection complaint in relation to any data that the Sunday Times had collected to support the original allegation that he had taken performance-enhancing drugs. He could argue that the data was inaccurate and should therefore not be held. Following the court settlement it would be open to the ICO to decide whether continuing to hold the data would be in compliance with the legislation. The Information Commissioner could require the paper to dump the data, which she might deem to be inaccurate. In fact, the ability of the journalist on this story to hold on to Armstrong’s data was crucial in allowing the Sunday Times to continue its investigation into Armstrong’s conduct. The paper subsequently published a number of articles to that effect. Eventually, Mr Armstrong confessed that he had indeed taken performance-enhancing drugs and settled the Sunday Times claim that his libel case was fraudulent after all.
- Time
- 16:00
- Source
- View in Hansard ↗
- Speaker
Baroness Hollins (CB)Crossbench- Quote
- My Lords, I start by adding my strong support to the elegant amendments of the noble Earl, Lord Attlee, and thank him for his perceptive evaluation of the media storm about Section 40 of the Crime and Courts Act. My Amendments 170K, 170L, 170M, 171A, 172AA, 172E and 174AA would remove the existing pre-publication staying mechanism currently available to data controllers when they may be processing data for special purposes. The old Data Protection Act required that a determination had to be made by the Information Commissioner before any data protection claim could be brought in court where data might be processed for journalism. This determination, set out in a “determination notice”, would specify whether the data was indeed being processed for the special purpose of journalism. Any claim which might involve the special purposes could be stayed in this way. This means that someone has no way of accessing the courts to establish if such publication of their personal data was legal—for example, because it was in the public interest—until after it happened. In contrast, people can do this with a privacy claim—and the sky has not fallen in, nor has investigative journalism been affected. Data privacy claims should be no different. The new Bill currently replicates the process that was set out in the old Bill. Unlike other areas of law, and unlike processing for other purposes, before any member of the public can bring a data protection claim in the courts against a data controller prior to publication, Clauses 164 to 166 of the Bill require the ICO to make a determination as to whether the data was being processed for journalistic purposes. This means that when an individual’s data rights are unlawfully breached for publication, without any public interest justification, they can do nothing to prevent use and publication of that data until the determination process is complete, with appeal. That data could include, for example, private medical records or financial transactions that expose deeply personal information. In practice, this means that ordinary people are denied the right to challenge in court the legality of the data being processed prior to publication. Moreover, determination is slow. When the Information Commissioner produces the determination notice, it is then subject to appeal by the publisher. Lord Justice Leveson argued that this whole mechanism is wrong in principle, and that it should be removed. This amendment would have that effect, by removing journalism from those purposes to which the stay could apply. Publishers and the public would still have access to court action, and the courts could determine whether the material has been unlawfully processed and, if it has, whether publication is protected in the public interest under the existing exemptions in the Bill. Journalistic exemptions in the Bill would be entirely unaffected by the amendments. Where breaches are in the public interest and undertaken for publication, journalists remain exempt from all the exemptions listed elsewhere in the Bill. That is right, and it will be protected. However, the additional stay, which prevents victims of data protection breaches by newspapers trying to prevent the damage that would be done by publication before they can argue their case in court, would be removed. In summary, nothing in the amendments will interfere with investigative journalism—that is not my intention. Because this is a complicated area, with many amendments to these clauses, I certainly stand ready to discuss with colleagues the best way forward in this area before Report. My Amendment 179A would require the Government to proceed with a public inquiry into allegations of data protection breaches by or on behalf of newspapers. Such an inquiry would be similar to the already-agreed second half of the Leveson inquiry. In 2005 it was reported, though only in the Guardian, that thousands of individuals had had their personal data, including private phone data, stolen by or on behalf of newspaper publishers. Noble Lords will recall that Operation Motorman was the scandal that allowed phone hacking to occur, but it was far more widespread than just phone hacking. It affected tabloids and other newspapers alike. Data was illegally harvested by private investigators in the pay of newspapers and used for stories or to hack phones, often without any public interest justification. A whole industry of illegal data theft propped up the front pages and exclusives of some of our most powerful and recognisable newspapers for a decade. The Information Commissioner published two reports on Operation Motorman, first, about this practice and, secondly, on the findings of the police investigation. These included the revelations that 58 clients or journalists working for the Daily Mail had used private investigators, and that 1,482 transactions were identified between the investigators and Mirror Group titles such as the Daily Mirror and the Sunday People. Rarely was there any public interest justification. For example, the victims of crime were targeted and their partners, their colleagues and even their painters and decorators were targeted, too. Some newspapers even rehired private investigators who had been convicted of illegal data handling. This is not ancient history. The judge in the Mirror hacking civil trial ruled that the Daily Mirror, the Sunday Mirror and the News of the World used an entirely different set of private investigators hundreds, if not thousands, of times to steal phone billing data and “reverse phone numbers”, and that this was a precursor to hacking their phones. In a new civil action against the Sun, it is alleged that that newspaper continued to use a series of private investigators for illegal activities on an industrial scale all the way up to 2011, if not beyond. A public inquiry, the Leveson inquiry, was established to investigate these matters, and I gave evidence to part 1. However, part 2, established to investigate the extent of breaches of data privacy and other illegality, and to investigate the cover-up of it, has still not taken place. This requirements of the amendment would be satisfied by the Government proceeding with Leveson part 2. I believe I am not alone in your Lordships’ House in finding the Government’s positioning and repositioning on Leveson part 2 shameful. In 2011, when the scandal of hacking broke, the inquiry was established in two parts, the first to deal with regulation and the second to deal with illegality and allegations of corruption and cover-up. The Government claimed they were committed to part 2 of the inquiry once relevant trials had concluded. Those of us affected by this conduct took the Government at their word. A few years ago, though, the Government began to revise their position following heavy lobbying from the press. After this House voted overwhelmingly in support of one of my amendments to the Investigatory Powers Bill last year, the Government faced the prospect of a Commons defeat and announced a consultation on Leveson part 2 on the day of that vote. That consultation was judicially reviewed by a victim of press abuse who had been promised by the Government that part 2 would happen. The Government defended that judicial review by claiming that they had an open mind on the matter of Leveson part 2, but within three months their party manifesto for the 2017 general election pledged to scrap Leveson part 2 altogether. Today, we are no further forward. The Government have still not published the outcome of last year’s consultation. The integrity of the consultation was questioned, and the Government’s intentions were rather exposed by the manifesto commitment to scrap Leveson part 2, although I gather that Conservative Members of neither this House nor the other place were consulted. Nor were victims consulted, despite previous prime ministerial promises to them on this matter. I see no alternative but to return to legislation and the role of Parliament to see that the Government stand firm on these matters and do not cave in to the press lobby. I hope colleagues will support this amendment. I would not of course return with it on Report should the Government proceed with Leveson part 2 with the agreed terms of reference before then.
- Time
- 16:15
- Source
- View in Hansard ↗
- Speaker
Lord McNally (LD)Liberal Democrat- Quote
- My Lords, this debate is part of the unfinished business of Leveson in relation to both Section 40 and Leveson part 2. As the noble Baroness, Lady Hollins, explained, we are having to do this not because we are hijacking the Bill but because the Government have used various devices to avoid their commitments on those parts of Leveson. It is unfinished business because sections of the press, for which the noble Lord, Lord Black, is an eloquent spokesman in this House, have deliberately tried to frustrate the will of Parliament. The noble Baroness, with telling eloquence, has spoken for the people who were hurt and damaged by the excesses exposed by Leveson. They do not feel that they have received either closure or justice; nor is there much evidence of the press mending its ways. I was one of the privy counsellors who signed the royal charter. The coalition Government went out of their way to defend the freedom of the press. Looking back, it is easy to forget just how much public horror, distaste and loathing there was for what was shown to be happening by the Leveson inquiry. Frankly, a Government of the day who had not been interested in the freedom of the press would have had a free hand to deal with it in the most draconian way. So I sometimes resent—not speeches in this House, of course, although they occasionally refer to this—articles in the Times and other papers that see any amendment as an immediate attack on the freedom of the press. We who are tabling these amendments want to strengthen the freedom of the press. The Conservative Government, freed from the constraints of coalition, have gone back on their word to implement Section 40 and dragged their feet about Leveson 2. They added insult to injury by including the IPSO code in their list of approved codes but ignoring the Impress code, which had been approved by the Press Recognition Panel. The noble Earl, Lord Attlee, explained very well how the charter would have given a defence in the David v Goliath contest often faced by the ordinary citizen. We are in Committee, so we will listen to the Government’s response to the amendments moved by the noble Baroness, Lady Hollins, the noble Earl, Lord Attlee, and the noble Lord, Lord Black. We will then make our decision on issues to vote on at Report. I listened very carefully to the noble Lord, Lord Black, and, as the noble Earl, Lord Attlee, said, he gave us food for thought, although he often sounds like the boy who murdered his parents and then asked for mercy because he was an orphan. However, there are issues there that need to be considered. My approach, and the two amendments that I have signed, come from a person whom I know that the noble and learned Lord, Lord Keen, knows very well: the man on the Clapham omnibus. My concern, so very well expressed by the noble Lord, Lord Colville, is that it seems to me, as the man on the Clapham omnibus, that to ask investigative reporters to get prior permission is counterintuitive. Again, I would be very interested to hear the Government’s explanation, particularly of Clause 164(3)(c), which my amendment would delete, and how it would impact on investigative reporting.
- Time
- 16:15
- Source
- View in Hansard ↗
- Speaker
Lord Low of Dalston (CB)Crossbench- Quote
- My Lords, I speak in support of the amendments tabled by the noble Baroness, Lady Hollins, those in the name of the noble Earl, Lord Attlee, and Amendments 185E and 185F, in the name of the noble Lord, Lord McNally, who has just spoken. A range of amendments in this group relate to journalism and have different effects. It would be easy to characterise some of them as being in favour of greater press power and others in favour of reduced press power, but that would be wrong. The amendments that I am speaking to would implement and support the recommendations of the Leveson report. That report was a compromise—a split down the middle of the free speech concerns of some, and the concerns of others for the victims and wider public. Some of the other amendments in this group—not all of them—seek to undermine that compromise. When we have debates about Leveson, let us remember that they are not simply debates between the interests of the press and those of the public, but between those who have accepted the compromise and those who will not give an inch. Let us also remember that government inaction is what inspires the rejectionists to persevere. Amendment 179A, in the name of the noble Baroness, Lady Hollins, would require the Government to proceed with a public inquiry into data protection breaches committed by or on behalf of newspaper publishers. This is long overdue. Such an inquiry is clearly merited after the scale of the abuses and breaches which were made clear in Operation Motorman and since. Court cases still being settled over the last year, with more expected, relate to this conduct. Of course, all parties agreed that such an inquiry was needed in 2011 and established the Leveson inquiry, but that part of the inquiry has still not proceeded. Instead, the Government have twisted and turned to satisfy the interests of the press, which calls for public inquiries into everything but its own scandals. I wonder why that might be. I hope that the Government will respond by beginning Leveson part 2. The amendments of the noble Baroness, Lady Hollins, to Clauses 164 and 166 would prevent publishers accessing a staying mechanism which would in effect prevent pre-publication data protection claims ever being brought. This is anomalous, given that libel law allows such claims to be brought. There is no good reason for keeping the stay so long as the journalistic exemptions are protected. This amendment does not affect those exemptions and should be supported. Amendments 170AA, 170AB and 170AC in the name of the noble Earl, Lord Attlee, replicate the terms of Section 40 of the Crime and Courts Act 2013, which this House voted for, as did the other place, but do so only for data protection claims. It remains a constitutional travesty that the Government have autocratically prevented Section 40 coming into force, using the executive power of non-commencement. Providing the costs protection and regulatory incentive of these amendments for data protection claims is a worthwhile objective in itself. If the relevant amendment also helps make the point to the Government that it is unacceptable to reverse a parliamentary vote in this way, then it will have served a second useful purpose. The amendments of the noble Earl, Lord Attlee, would also restore conditional fee agreements for data protection claims. Conditional fee agreements would ensure that the public are able to access justice even if Section 40 does not apply. Amendments 185E and 185F, in the name of the noble Lord, Lord McNally, respond to five Select Committee reports, the Leveson report and multiple remarks, reports and representations from the Information Commissioner’s Office, allowing custodial penalties for the most egregious cases of data theft. It is not envisaged that many, if any, individuals would be sentenced in this way but, put simply, the mountain of evidence on the matter shows that a fine is not an adequate deterrent and is simply treated as no more than an overhead for the illegal trade in personal data. I therefore believe it important that the House should support the amendments of the noble Lord, Lord McNally.
- Time
- 16:30
- Source
- View in Hansard ↗
- Speaker
Lord Puttnam (Lab)Labour- Quote
- It might surprise the noble Lord, Lord Black, to hear that I think his amendments are important and well worth discussing and crunching out. I listened to his speech very carefully. I will check Hansard tomorrow, but I think that he used the word “reasonable” about a dozen times. However, I ask him to consider that if he wants the sympathy of the House and of Parliament, he has to accept the fact that the reasonable expectations of reasonable people for the media to behave in a reasonable way is the way to go about this. Does he believe that the man on the Clapham omnibus would regard the current policy of apology and correction as remotely reasonable? If he is prepared to reconsider that and talk to the people with whom he works, perhaps there could be real movement here. IPSO does not necessarily have to become Impress but it can look at the obligations that have been placed on Impress and begin to behave accordingly.
- Time
- 16:30
- Source
- View in Hansard ↗
- Speaker
Baroness Stowell of Beeston (Con)Conservative- Quote
- My Lords, I rise in support of Amendment 172C, which refers to Clause 164(3)(c). I have no interest to declare but it might be helpful if I remind your Lordships that, prior to joining this House, I worked at the BBC for the best part of 10 years. For the majority of my time there, I worked in the area of governance and regulation, advising three successive chairmen. I just want to make a couple of simple points. I have not been involved in this Bill so far but, when it was highlighted to me that it would introduce a clause that would, for the first time, bring into statutory regulation a facility for the pre-transmission involvement of regulators in broadcasting in this country, I was surprised—indeed, I was very worried. This is a very big change to our current set-up. Broadcasting is a very heavily regulated sector but it is regulated post hoc, not ex ante—I know that your Lordships like a bit of Latin. When I worked at the BBC under the old governance regime, before Ofcom was set up and before the BBC became subject to Ofcom regulation, there was only one editor-in-chief at the BBC and he had the final say editorially. We have a former editor-in-chief sitting in his place here today. The governors, led by the chairman, were very clear that their responsibilities prevented them ever interfering in any programming pre-transmission, so even the governors did not involve themselves in programmes pre-transmission. When they had done so in the past, the result had been absolutely calamitous. We should remember that we demand impartiality from broadcasters in this country. We set very clear and rigorous codes for them to follow and they take them very seriously. However, in order to ensure that there is impartial broadcasting in this country and to give our audiences confidence, in exchange we give broadcasters their independence. I worry that a very simple clause in the Bill, which may look quite innocuous, could put at risk something that is very important to us. I understand that the media can sometimes be arrogant and that they sometimes get things wrong, but we should make sure that we tackle them when they get things wrong rather than try to interfere and put at risk something which, as I said, is very precious to us in this country.
- Time
- 16:30
- Source
- View in Hansard ↗
- Speaker
Lord Beith (LD)Liberal Democrat- Quote
- My Lords, I simply want to speak about my noble friend’s Amendments 185E and 185F, which relate to custodial sentences. I apologise to the noble Lord, Lord Black. I missed the opening part of his speech as I was looking up the reference to which I now want to refer—the ninth report of Session 2010-12 produced by the House of Commons Justice Committee, of which I was then chairman. As noble Lords know, we took evidence from the Information Commissioner on a number of occasions. We said in the report that we shared, “the Information Commissioner’s concern and dissatisfaction that no order has been brought before Parliament to implement section 77 of the Criminal Justice and Immigration Act 2008, which would have the effect of providing custodial sentences for breaches of section 55 of the Data Protection Act. Currently the only available penalty is a fine, which we feel is inadequate in cases where people have been endangered by the data disclosed, or where the intrusion or disclosure was particularly traumatic for the victim, or where there is no deterrent because the financial gain resulting from the crime far exceeds the possible penalty”. The point was made earlier that in some quarters—this is not particularly a media matter; it refers to many kinds of illicit information-gathering—meeting fines, should they be imposed, can be seen as a “trade expense”. So we said: “We accept the Information Commissioner’s argument that the issue of custodial sentences for section 55 offences is not exclusively, or even primarily, an issue relating to the media and that the issue should be dealt with by Parliament without waiting for the outcome of Lord Justice Leveson’s inquiry”. That illustrates just how long the matter has been going on and how unsatisfactory it is, to the point of disgraceful, that what Parliament has previously enacted remains not in force because of the lack of commencement.
- Time
- 16:30
- Source
- View in Hansard ↗
- Speaker
Lord Stevenson of Balmacara (Lab)Labour- Quote
- My Lords, I apologise to the House because my voice is annoyingly masked. I urge noble Lords to put their hearing aids on because it might not last until I have said what I want to say. Every now and then in this House, we have a debate of such importance and significance that the House behaves in a completely different manner from its normal routine. We have had that today. There is a sense of stillness, expectancy and interest that we do not always get, and it is important that we hold on to it because we are touching on some very important and deep issues. While we obviously need to deal with the narrow question of the amendments before us, I hope very much that the wider resonances of this debate might help unpick some of the difficulties that have been raised in our discussion and which are relevant in society today. I am so taken by the debate we have had that I want first to mention to the House that our amendment in this group, which was laid as one of the first amendments, is an entirely “fake” amendment, if I may use that word. It is a probing amendment and does not mean anything. I can tell the House now that I will not be pressing it. I hope the Minister will do me the justice of not even bothering to respond to it because it has lost all relevance in the light of the issues that have been raised subsequently. My second point is a slightly cheeky one: since I am no longer involved with our amendment in this group and we do not have any names attached to any of the others, I will bring a completely new and independent view to the discussions. I hope that noble Lords will enjoy that. I hope that the noble Lord, Lord Black, does not take this my final opening point the wrong way. I am not going to follow the line of the noble Lord, Lord McNally, and accuse him of crimes he is not going to commit, but this is so important that we need to come back to it in another place and at another time. I hope that he will understand that. I think that it probably needs a Bill of its own to get this right. We can discuss that later. Okay. Trying to make sense of what we have in front of us—in this alphabet soup that we often have in complicated parts of Bills—I want to approach this in the following way. I said at Second Reading, and I repeated in the debate last week, that I do not think the Bill is the right place to rerun some of the long-standing arguments about Leveson. I do not think that anything said today should be withdrawn; it is really important stuff that needs to be resolved. But this is probably not the Bill to do that in and I will give some reasons for that. The main worry that I have, and several noble Lords have mentioned this, is that we are talking about a package of measures that were the product of a particular time. For all the reasons that have been given, bits have succeeded and bits have not succeeded; bits have been implemented and bits have not been implemented, and I do not think that it is right for this Bill at this time to try to kick-start some of the bits that need to be looked at, particularly the amendments that relate to the Crime and Courts Act 2013. The speech of the noble Earl, Lord Attlee, was a very good introduction to those. He made a very good case for them. That case does need to be answered, but this is not the right place for that, so I do not support them. I do not think that Amendment 179A works in the context that I am trying to sketch out. The case made by the noble Baroness, Lady Hollins, as always, was incredibly powerful and one’s heart reaches out to everything she says, which was also picked up by the noble Lord, Lord Low. We want to do something about this and we think that the way that the Government have treated Leveson 2 is a disgrace. It is a shameful way to behave, given the treatment of the victims. We must never forget that. The third group of amendments here—the amendments of the noble Lord, Lord McNally—also makes very good sense. They are sensible amendments but, for the same reason, we should not continue with them today.
- Time
- 16:45
- Source
- View in Hansard ↗
- Speaker
- Lord McNallyLiberal Democrat
- Quote
- The noble Lord is giving the Government a “get out of jail free” card, unless he has something else to say. There are areas in all these amendments that have massive implications for data and data protection. If they do not fit into the scope of a Data Protection Bill, where on earth will they fit?
- Time
- 16:45
- Source
- View in Hansard ↗
- Speaker
- Earl AttleeConservative
- Quote
- My Lords, I would also like to have a little pop at the noble Lord. I understand his point that this is a Data Protection Bill and not something to amend the Crime and Courts Act. Of course, I experienced significant difficulties with the clerks trying to table an amendment to try to amend that Act. But if we had a suitable legislative opportunity—another criminal justice Bill—would the noble Lord’s party support an amendment to make Section 40 of the Crime and Courts Act commence forthwith?
- Time
- 16:45
- Source
- View in Hansard ↗
- Speaker
- Lord Stevenson of BalmacaraLabour
- Quote
- To answer that last point first, we have supported that in the past and on the right occasion we would probably support it again. But my point is not about the quality of the case made or the correctness of the approach. It is just not the right time to do that. The same answer applies to the noble Lord, Lord McNally. I did not say that we would not support him if he brought this back at Report. I am simply saying that, at this particular point, I want to use this debate to focus on something else and that is why I am trying to approach the issue in this way. I hope that noble Lords will bear with me before my voice gives up finally. I hope that I can allow that to ring out so that noble Lords can be inspired by it. That is a faint hope. Underneath the debate that we have had today are some really important questions. I will pose them quickly in the hope that we will get a response from the Minister. It is really important that the noble and learned Lord uses this opportunity to set out very clearly what the Government’s position is on a number of these key points. Is the regime that currently applies to the press, as set out in the Data Protection Act 1998, still the case in the Bill? In other words, has the regime that has worked well since 1998 been changed in any way by its transposition into this Bill? If it has not, he has to be very clear that that is the case. The case that has been made suggests that, in the rewriting and repositioning of Clause 164, something has happened that has alerted everyone to the point, which was made very well by the noble Viscount, Lord Colville, and the noble Lord, Lord Black. I do not think that that was what we understand to be the case, and certainly I and my noble friend Lord Griffiths have asked for chapter and verse on this so that we can be sure that what we are seeing is exactly what the current law is. That is a straightforward question. Secondly, we need to be persuaded, if we have not been already, that either the technology or the working practices in print journalism in particular, but also in relation to how print journalism is now often paired up with moving image technologies, has produced such a step-change in the way they operate that the additional defences proposed by the noble Lord, Lord Black, or the additional protections that might be needed by victims, which are so important and relevant, do not need to be brought into the Bill. The case has been made, the charge is there, and the Government must come back and tell us what arrangements have been made. Thirdly, does the fact that many, but not all, direct investigations of a journalistic type are now done jointly with an audio-visual component, so that we have combinations between major newspapers and television broadcasters or even film, mean that we now have in perpetuity dual regulation, in which case the approach taken by Ofcom has to sit with the regulations under the Data Protection Act 1998 or the Data Protection Bill when it becomes law? If that is the case, we have a problem that needs to be confronted. We have one post hoc regulatory structure and one that is mainly post hoc but has an element, albeit restricted and on a narrow basis, in print journalism. If the way the world is moving suggests that everyone doing this work will have to be involved with two regulators, the Government’s Bill does not take that trick and we will need to come back to the point. Fourthly, what is it about print journalism which is so different that it requires there to be a predetermination capacity for the ICO compared with the situation when the same work, and possibly the same output, is done under Ofcom? My noble friend Lord Puttnam and the noble Baroness, Lady Stowell, made the point that the difference is that the media in this country are very strongly regulated. There are codes, statutory frameworks and editors who are clearly responsible for them and work to them well. However, a different situation pertains here. That does not mean to say that it should be applied across all the outputs involving investigative journalism, but it must be said that if there was in existence a robust, independent and effective press complaints system which enjoyed the confidence of victims, perhaps we would make better progress on the particular issues which have been raised today. That is the point on which we must focus as regards where we might go with this. I hope that when the noble and learned Lord comes to respond, he can bring some light to this issue.
- Time
- 16:45
- Source
- View in Hansard ↗
- Speaker
The Advocate-General for Scotland (Lord Keen of Elie) (Con)Conservative- Quote
- My Lords, I am obliged to all noble Lords for their contributions this afternoon. I would hope that recent debates, particularly in Committee on the Bill, have assured noble Lords that the Government are absolutely committed to preserving the freedom of the press and maintaining the necessary balance between privacy and freedom of expression in our existing law that has generally served us well over many years. Perhaps I may take some of the amendments in turn. The first, Amendment 163A, was brought forward by my noble friend Lord Black. It asks that the Bill should require that greater consideration be given to the right to freedom of expression and information when the Information Commissioner is exercising her enforcement powers. Amendment 164A would require the commissioner to consider, for example, any other financial penalties imposed by another regulator as a result of failure—a point that was touched on tangentially by the noble Lord, Lord Stevenson, in his closing remarks. I hope that my noble friend Lord Black agrees that it is important that any amendments in this space do not impact disproportionately on the commissioner’s resources and her ability to execute her regulatory functions in an effective manner. I will give further consideration as to whether these amendments meet that test. I will address my noble friend’s contribution on this point in Hansard and the Government will reflect upon it. I do not hesitate because I am making a concession; I am merely making an observation.
- Time
- 16:45
- Source
- View in Hansard ↗
- Speaker
Lord Gordon of Strathblane (Lab)Labour- Quote
- Taking up the point made by the noble Baroness, Lady Stowell, does the Minister agree that we are introducing, for the first time, vetting of material before it is broadcast, a power that even Ofcom, the regulator set up by government for broadcasting, does not have? Ofcom regulates only after the event. Surely this is a dramatic new intervention.
- Time
- 17:00
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- The noble Lord makes a perfectly good observation about this provision. It brings me to one of the questions posed independently and neutrally by the noble Lord, Lord Stevenson, on whether the provisions of the Bill as drafted simply implement the provisions of the 1998 Act or extend its provisions. The answer is that they do not change the regime found in the 1998 Act except in respect of Clause 164(3)(c). I acknowledge the significance of that provision and I am happy to look again at that issue in light of the expressions of concern I have heard from around the Committee about it. Some noble Lords also questioned the need for the provision of assistance in special purposes proceedings. Under Clause 165, individuals who are a party, or a prospective party, to special purposes proceedings may apply to the commissioner for assistance in those proceedings. For the application to be accepted, the commissioner must be convinced that the matter is of substantial public importance. There is, as I have implied, an equivalent provision in the 1998 Act. I understand that it has only ever been used once. In my respectful submission, that in itself indicates the effectiveness of the provision. It is not necessary because people know it is there and can be relied on, but only if that very high test of substantial public importance is met. Therefore, we consider it appropriate to retain this as a safeguard for data subjects. It is, I respectfully suggest, an important contributor to maintaining the balance between privacy and freedom of expression that has to underlie all these provisions. Amendment 179A, spoken to by the noble Baroness, Lady Hollins, would require the Government to establish an inquiry with terms of reference similar to those contained in part 2 of the Leveson inquiry, but in relation to data protection only. As I have mentioned, a consultation was launched to look at Section 40 of the Crime and Courts Act 2013, which also asked whether proceeding with part 2 of the inquiry was still appropriate, proportionate and in the public interest. As I stated previously, it is the Government’s intention to publish a response to that consultation by Christmas; therefore, we do not believe that this amendment is appropriate, given the decisions that are currently being taken on that matter.
- Time
- 17:00
- Source
- View in Hansard ↗
- Speaker
- Baroness HollinsCrossbench
- Quote
- My Lords, the Minister stated that the response to the consultation will be published before Christmas. Can he further reassure the Committee that it will be published before Report so that noble Lords can reconsider their amendments?
- Time
- 17:00
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- I am obliged to the noble Baroness. It is the Government’s intention that the consultation response should be published before Christmas. I cannot say that it will be published before Report but we will keep noble Lords advised of any decision with regard to a specific date for publication.
- Time
- 17:00
- Source
- View in Hansard ↗
- Speaker
- Baroness HollinsCrossbench
- Quote
- If is not to be published before Report, would it be possible for me to meet the Minister to discuss these matters?
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- I am certainly open to any meeting that the noble Baroness would wish to engage in to discuss these matters. In so far as I am able to inform her, and indeed the Committee, of developments, I will seek to do so.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord McNallyLiberal Democrat
- Quote
- Just to be helpful to the Committee, if it was published after Report, does the Minister agree that it would be perfectly reasonable to have a Third Reading amendment to reflect whatever has come out of that response?
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- With respect to the noble Lord, I am not the litmus test of reasonableness—at least, I have been told that in the past.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Low of DalstonCrossbench
- Quote
- Would the Minister perhaps agree that it would be highly advantageous to the Government—it would be in the Government’s interest—for the response to the consultation to be published before Report? If it is, its contents might well incline those of us who support these amendments to think again about them, whereas if we do not have the benefit of the Government’s response, we may be obliged to carry amendments that the Government would not wish to be carried.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- I quite understand the force of the noble Lord’s observations. Nevertheless, I am not in a position to say that the response will be available for publication before Report. I am afraid that we have to proceed on that basis. It may have consequences such as those set out by the noble Lord, and we will have to address those in due course. I am afraid that I cannot go further on this point. Finally, I come to some of the observations of the noble Lord, Lord McNally, who spoke to his Amendments 185E and 185F. I begin by saying that I have no wish to disappoint either the gentleman on the Clapham omnibus or the noble Lord himself. Therefore, I will endeavour to address the questions that he raised as fully as I can. I take account of his commendable intention to peruse Hansard over breakfast and to come to a view as to whether or not I have fully responded to his points. Amendments 185E and 185F seek to make the unlawful obtaining of personal data a criminal offence with a custodial sentence of up to two years under Clause 175. Of course we recognise the seriousness of any offence that is committed in this context. That is why it is important that proper thought is given to the introduction of any changes which would seek to put in place custodial penalties that could remove people’s liberty. Under the coalition Government, in March 2011, the noble Lord, Lord McNally, said that the Government would not commence prison sentences for Section 55 offences but would continue to keep the matter under review. At that time Ministers agreed to pursue non-custodial options, instead of a custodial option, including encouraging the use of the Proceeds of Crime Act 2002 and making the offences recordable. Indeed, it is this Government’s intention in this Bill that the offences should now be made recordable. That is addressed in Clause 178. Again, this is one of those complex areas where we have to achieve a balance between competing rights and obligations. We believe that, for the reasons I sought to set out earlier, we are achieving the right balance with the provisions in the Bill. I hope that the noble Lord will feel open to not moving his amendment.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord McNallyLiberal Democrat
- Quote
- My Lords, I will consider that point in a few moments, but I am much reassured that the noble and learned Lord has more respect for the man on the Clapham omnibus than he seems to have for BBC lawyers. That is a step forward.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- No inference can be drawn regarding the considerable respect in which I hold the legal advisers of the BBC.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Viscount Colville of CulrossCrossbench
- Quote
- If I may put the record straight, it was not a BBC lawyer who advised me.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- My respect for all lawyers remains undiminished. As the noble Lord, Lord Stevenson, observed, some issues of fundamental importance underlie this; I refer not just to press freedom but to fundamental rights. I therefore have welcomed the contributions to this debate, but I hope that at this time the noble Lord, Lord Black, will feel it appropriate to withdraw his amendment.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Earl AttleeConservative
- Quote
- Can the noble and learned Lord tell us of any precedent for a Government undertaking a consultation exercise before commencing a provision in a recent Act of Parliament?
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Keen of ElieConservative
- Quote
- I am not immediately reminded of any precedents, but principle often caps precedent.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
- Lord Black of BrentwoodConservative
- Quote
- My Lords, I thank all those who have taken part in this thoughtful and important debate—despite the fact that it is the first time I have been likened to someone who has murdered his parents, thwarted the will of Parliament and, according to the noble Lord, Lord Puttnam, is the personification of all the sins of the media. I regret that, given the seriousness of the issues for the academic, literary and artistic worlds, we have yet again had a debate which has largely been dominated by press regulation. We have been round this course so many times that even Sir Mo Farah would have been exhausted by now. I am inclined to agree with the noble Lord, Lord Stevenson, that this is not really the place to debate press regulation. We should wait to see what the consultation says. Like other noble Lords, I am grateful for confirmation from the noble and learned Lord that we will have a response by Christmas. There were two very important speeches. The noble Baroness, Lady Stowell, talked about the profound change—I shall get my bit of Latin in again—from post hoc to ex ante. We cannot underestimate the scale of the impact of that across the media, and it is right that the noble and learned Lord should look at that. The noble Viscount, Lord Colville, also made some very powerful comments about the serious implications for investigative broadcast journalism. His point about how the Armstrong Sunday Times case would have been impacted by the Bill was a vivid example of the mischief that currently sits in it. I am very grateful to the noble and learned Lord for saying that he will look at the issues raised, particularly by Amendments 163, 164A and 170B, and also at Clause 164(3)(c). It has caused concern around the Committee, and he confirmed that it is a change since the 1998 Act that will have profound implications. On that note, I beg leave to withdraw the amendment.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
The Deputy Chairman of Committees (The Countess of Mar) (CB)Crossbench- Quote
- I cannot call Amendment 170, as it is an amendment to Amendment 169.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
Lord Hunt of Wirral (Con)Conservative- Quote
- My Lords, I declare my interests as set out in the register, in particular as a partner in the global commercial law firm DAC Beachcroft LLP and as chair of the British Insurance Brokers’ Association. In debates on the Financial Guidance and Claims Bill, yesterday and on previous days, noble Lords from all sides of the House expressed profound concern and distaste about the damage wreaked by the so-called compensation culture. What is now widely, perhaps universally, recognised is that the compensation culture is driven not by the legitimate claims of those who have been genuinely wronged and suffered damage or loss but by an utterly cynical industry that operates as a fast-moving profit-driven roadshow, exploiting every possible weakness in legislation and every loose judgment of the courts. The compensation system is like a roof that will always leak and this compensation roadshow, motivated purely by financial gain and entirely heedless of the damage it wreaks upon society, is like the relentless rain that will find every crack and gap—even the tiniest hole—and just pour in. Some years ago, I discussed this matter with a senior senator in the United States. I shall never forget his words to me: “The compensation culture is destroying the civility of civil society”.
- Time
- 17:15
- Source
- View in Hansard ↗
- Speaker
Lord Lucas (Con)Conservative- Quote
- My Lords, I entirely support my noble friend’s amendment. We have got ourselves into a complete mess in this country on insurance, and motor insurance is a pretty good example. Premiums in this country are about double what they should be. They are the highest in Europe, above even Italy, because of a level of fraud that we encourage by our legislation and by the lack of action from successive Governments to do anything about it. We can see the size of the problem that this clause will generate, if unamended, by what has happened in motor insurance. It leaves an open door to an enormous number of claims management companies, of which 500 or so were seriously active the last time I looked. It is a really big, profitable industry, and it will push into a hole like this with no difficulty at all. We took a bit of action a while ago on whiplash injuries. Fine, whiplash injuries are down, but rocketing upwards now is, “Oh, I had this crash and now I get a buzzing in my ears”. It is wonderful—a disease which has suddenly appeared from nowhere because the claims management companies need an opportunity to push in here. We must realise what is happening. I hope we will get around to dealing with the general problem at some stage, but to open another door to these people is just foolish.
- Time
- 17:30
- Source
- View in Hansard ↗
- Speaker
Lord Griffiths of Burry Port (Lab)Labour- Quote
- My Lords, I thank the noble Lord for his eloquent disquisition, which made me much more aware of the issues than I was before. I have no problem in aligning myself with the two points of view that have just been expressed. I had come to the conclusion partly myself, but to be told that the wording is not in the equivalent article in the European GDPR just adds to my simple conclusion that the words “other adverse effects” add precisely nothing but open a potential cave of dark possibilities. The rain of the noble Lord’s eloquence has found a crack in my roof, and I am very happy to align myself with his remarks.
- Time
- 17:30
- Source
- View in Hansard ↗
- Speaker
Baroness Neville-Rolfe (Con)Conservative- Quote
- I also share the concerns expressed by my noble friend Lord Hunt, based on my experience, both in government and in a number of different businesses. We have the experience not only of the motor sector, which has been talked about, but obviously of PPI, where there was compensation that needed to be paid, but the whole business took years and generated not only claims management companies but also nuisance calls and lots of other harms. This is an area that one has to be very careful about, and I support looking at the drafting carefully to see what can be done, and at my noble friend’s idea of trying to estimate the economic impact—the costs—in terms of those affected. That would help one to come to a sensible conclusion on what is appropriate in this important Bill.
- Time
- 17:30
- Source
- View in Hansard ↗
- Speaker
Baroness Chisholm of Owlpen (Con)Non-affiliated- Quote
- My Lords, I thank my noble friend Lord Hunt for explaining Amendment 170A and other noble Lords who have spoken. The amendment seeks to clarify the definition of “damage” provided by Clause 159 and its relationship to the language used in article 82 of the GDPR. This is important because article 82 of the GDPR provides a right to compensation when a person has suffered damage as the result of an infringement of the rights during the processing of their personal data. Currently, the type of damage that can be claimed is broader under article 82 than Section 13 of the 1998 Act, as article 82 expressly extends to “non-material” damage. As a result, in drafting the Bill, the Government considered that some definition of “damage” was necessary, including specifying that it extends to distress, to provide clarity and certainty for data subjects and others as to their rights under article 82. I stress that Clause 159 does not seek to provide a wider definition of “damage” than is currently provided in the GDPR, and nor indeed could it. The intention is simply to clarify the GDPR’s meaning. My noble friend Lord Hunt asked what estimates have been made of the financial consequences of the increase in litigation, but as Clause 159 does not provide a wider definition of damage there will be no financial consequence. The concept of “damage” included in the GDPR reflects developments in case law over a period of some years. As such, I cannot agree with my noble friend’s suggestion that the Bill or the GDPR will suddenly unleash a free-for-all of claims. However, I am happy to reflect on my noble friend’s point that the Bill’s use of the term “other adverse effects” may unintentionally provide uncertainty rather than clarity. With the reassurance that I will go away and look at that, I hope my noble friend feels able to withdraw his amendment.
- Time
- 17:30
- Source
- View in Hansard ↗
- Speaker
- Lord Hunt of WirralConservative
- Quote
- My Lords, I am very grateful to my noble friend Lord Lucas. Together we have been trying to ensure that real victims get justice but that we do not create a market for those who fasten on to discomfort and distress to make money themselves, often with no qualifications at all in the whole arena. That is why I believe my noble friend is so right when he says we have to scrutinise everything that we pass now to ensure that it does not open the door to further claims. I thank the noble Lord, Lord Griffiths of Burry Port, for his very kind remarks, which I much appreciate—whether I have penetrated his roof, as he described it, I am not quite sure, but I certainly got through and I am grateful to him for acknowledging that. I also thank my noble friend Lady Neville-Rolfe, with her great experience in the private and commercial sector. It is right to remind ourselves of what has happened in the past and ensure that we do not create the same problems for ourselves in the future. I am of course grateful to my noble friend the Minister; I believe my noble friend Lady Chisholm of Owlpen has given me all I was hoping for in the context of this debate in Committee. I would just like her to question those who drafted these words over whether they are right in saying, “All it does is clarify”. It does not. Why do we need to add words that are not there in the first place? I understand that we need to rectify Section 13 of the 1998 Act in light of the new legislation, but can we please find a better way to do so without at the same time opening the door to all these additional claims that might well arise unless we are vigilant and stop them before the legislation becomes part of an Act of Parliament? I am grateful to the Minister and beg leave to withdraw the amendment.
- Time
- 17:30
- Source
- View in Hansard ↗
- Speaker
- Lord Stevenson of BalmacaraLabour
- Quote
- My Lords, this is a relatively narrow point and affects only a very small part of the Bill, but is still quite important. The amendments in the group mainly cover the question of how the Bill can reach out to the question about anonymisation and how, or not, it plays against de-identification. There are two amendments and a clause stand part Motion which relate to other slightly different issues, which we will get to in turn. Amendment 170CA would insert into the Bill the term “anonymisation”, as there is no definition of de-identification in the Bill. I will come back to explain what that means in practice. Amendment 170CB provides an important exemption for data scientists and information security specialists dealing with a particular area, because there is a fear that the introduction of criminal sanctions might mean that they would be caught when they are trying to consider the issue for scientific and other reasons. Amendment 170CC adds a definition of identified data—after all, if it is to be criminalised, there needs to be a definition. This definition will cover cases which involve names of individuals, but will also cover those where fingerprints, for instance, are used to identify people. The clause creates a new offence of knowingly or recklessly re-identifying information that has been de-identified without the consent of the controller. Amendment 170F asks for guidance relating to this offence. It is at the request of the Royal Society, because it wants clarity on the legal basis for processing. Amendment 170G concerns transparency. If we are going to go into this area, it is very important that we know more about what is happening. The amendment suggests that the Information Commissioner, “must set standards by which a data controller is required to anonymise personal data”. There may be lots of new technologies soon to be invented or already available, and it is important that the way in which this important work goes forward can be flexed as and when new technologies come forward. We think that the Information Commissioner is in the strongest position to do that. The other set of amendments to which our names are attached, Amendments 170E and 170H, relate to particular problems that can arise in large databases within health. There is a worry that where re-identification occurs by accident or just through the process of using the data, an offence will be created. MedConfidential suggests that some form of academic peer reviewing might be useful in trying to assess whether this was a deliberate act or just an unfortunate consequence of the work being done by those looking at the dataset concerned. The further amendment, Amendment 170H, clarifies whether an offence actually occurs when the re-identification work applies to disseminated NHS data —which of course, by its very nature, is often rather scattered and difficult to bring together. There is a particular reason for that, which we could go into. At the heart of what I just said is a worry that certain academics have communicated to us: that the Bill is attempting to address what is in fact a fundamental mathematical problem—that there is no real way of making re-identification illegal—with a legal solution, and that this approach will have limited impact on the main privacy risks for UK citizens. If you do not define de-identification, the problem is compounded. The reference I have already made suggests that there might be advantage to the Bill if it used the terms used in the GDPR, which are anonymisation and pseudonymisation. The irony which underlies the passion with which we have received submissions on this is that the people likely to be most affected by this part of the Bill are UK information security researchers, one of our academic strengths. It seems ironic that we should be putting into the Bill a specific criminal penalty which would stop them doing their work. Their appeal to us, which I hope will not fall on stony ground, is that we should look at this again. This is not to say in any sense that it is not an important issue, given the subsequent pain and worry that happens when datasets certified as anonymised are suddenly revealed as capable of being cracked, so people can pick up not just details of information about dates of birth or addresses but much more important stuff to do with medical health. So it is very important—and others may want to speak to the risk that it poses also to children, in particular. I hope that that is something that we might pick up. There needs to be a proper definition in the Bill, whatever else we do about it, and that would be right in a sense. But we would like transparency about what is happening in this area, so that there is more certainty than at present about what exactly is meant by anonymous data and whether it can be achieved. That could be solved if the Information Commissioner is given responsibility for doing it. I beg to move.
- Time
- 17:45
- Source
- View in Hansard ↗
- Speaker
Lord Clement-Jones (LD)Liberal Democrat- Quote
- We are in the thickets here at the interface between technology, techno-speak and legality. Picking our way through Clause 162 is going to be rather important. There are two schools of thought. The first is that we can amend this clause in fairly radical ways—and I support many of the amendments proposed by the noble Lord, Lord Stevenson. Of course, I am speaking to Amendment 170E as well, which tries to simplify the language and make it much more straightforward in terms of retroactive approval for actions taken in this respect, and I very much hope that parliamentary draftsmen will approve of our efforts to simplify the language. However, another more drastic school of thought is represented by many researchers—and the noble Lord, Lord Stevenson, has put the case very well that they have put to us, that the cause of security research will be considerably hampered. But it is not just the research community that is concerned, although it is extremely concerned by the lack of definition, the sanctions and the restrictions that the provisions appear to place on their activities. Business is also concerned, as numerous industry practices might be considered illegal and a criminal offence, including browser fingerprinting, data linkage in medicine, what they call device reconciliation or offline purchases tracking. So there is a lot of uncertainty for business as well as for the academic research community. This is where we get into the techno-language. We are advised that modern, privacy-enhancing technologies such as differential privacy, homomorphic encryption—I am sure that the Minister is highly familiar with that—and question and answer systems are being used and further developed. There is nothing worse than putting a chill on the kind of research that we want to see by not acknowledging that there is the technology to make sure that we can do what we need to do and can keep our consumers safe in the circumstances. The fact is that quite often anonymisation, as we are advised, can never be complete. It is only by using this new technology that we can do that. I very much hope that the Minister is taking the very best legal and technology advice in the drafting and purposes of this clause. I am sure that he is fully aware that there is a great deal of concern about it.
- Time
- 17:45
- Source
- View in Hansard ↗
- Speaker
- Baroness Neville-RolfeConservative
- Quote
- I rise to support the noble Lords, Lord Stevenson and Lord Clement-Jones, and some of the amendments in this group on this, the final day in Committee. I congratulate my noble friends Lord Ashton and Lady Chisholm of Owlpen as well as the indefatigable Bill team for taking this gargantuan Bill through so rapidly. The problem caused by criminalising re-identification was brought to my attention by one of our most distinguished universities and research bodies, Imperial College London. I thought that this was a research issue, which troubled me but which I thought might be easy to deal with. However, talking to the professor in the computational privacy group today, I found, as the noble Lord, Lord Clement-Jones, said, that it goes wider and could cause problems for companies as well. That leads me to think that I should probably draw attention to my relevant interests in the House of Lords register of interests. The computational privacy group explained that the curious addition of Clause 162—which is different in character and language from other parts of the Bill, as the noble Lord, Lord Stevenson, said—draws on Australian experience, but risks halving the work of the privacy group, which is an academic body, and possibly creating costs and problems for other organisations and companies. I am not yet convinced that we should proceed with this clause at all, for two reasons. First, it will not address the real risk of unethical practice by people outside the UK. As the provision is not in the GDPR or equivalent frameworks in most other countries, only UK and Australian bodies or companies will be affected, which could lead to the migration of research teams and data entrepreneurs to Harvard, Paris and other sunny and sultry climes. Secondly, because it will become criminal in the UK to re-identify de-identified data—it is like saying “seashells on the seashore”—the clause could perversely increase the risk of data being re-identified and misused. It will limit the ability of researchers to show up the vulnerability of published datasets, which will make life easier for hackers and fraudsters—another perversity. For that reason, it may be wise to recognise the scope and value of modern privacy-enhancing technologies in ensuring the anonymous use of data somewhere in the Bill, which could perhaps be looked at. I acknowledge that there are defences in Clause 162 —so, if a person faces prosecution, they have a defence. However, in my experience, responsible organisations do not much like to rely on defences when they are criminal prohibitions, as they can be open to dispute. I am also grateful to the noble Lord, Lord Stevenson— I am so sorry about his voice, although it seems to be getting a bit better—for proposing an exemption in cases where re-identification relates to demonstrating how personal data can be re-identified or is vulnerable to attack. However, I am not sure that the clause and its wider ramifications have been thought through. I am a strong supporter of regulation to deal with proven harm, especially in the data and digital area, where we are still learning about the externalities. But it needs to be reasonable, balanced, costed, careful and thought through—and time needs to be taken for that purpose. I very much hope that my noble friend the Minister can find a way through these problems but, if that is not possible, I believe that the Government should consider withdrawing the clause.
- Time
- 17:45
- Source
- View in Hansard ↗
- Speaker
- Lord Lucas (Con)Conservative
- Quote
- I very much support what my noble friend has just said. The noble Lord, Lord Stevenson, has tried to give an exemption for researchers, but a lot of these things will happen in the course of other research. You are not spending your time solely trying to break some system; you are trying to understand what you can get from it, and suddenly you see someone you know, or you can see a single person there. It is something that you can discover as a result of using the data; you can get to the point where you understand that this is a single person, and you could find out more about them if you wanted to. If it is a criminal offence, of course, you will then tell nobody, which rather defeats the point. You ought to be going back to the data controller and saying that it is not quite right. There are enormous uses in learning how to make a city work better by following people around with mobile phone data, for instance, but how do you anonymise it? Given greater computational power and more datasets becoming available, what can you show and use which does not have the danger of identifying people? This is ongoing technology—there will be new ways of breaking it and of maintaining privacy, and we have to have that as an active area of research and conversation. To my mind, this clause as it presently is just gets in the way.
- Time
- 17:45
- Source
- View in Hansard ↗
- Speaker
The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)Crossbench- Quote
- My Lords, I am grateful to all noble Lords who have spoken on this very important clause. I agree very much with the noble Lords, Lord Clement-Jones and Lord Stevenson, that these are important issues which we need to consider. The amendments seek to amend Clause 162, which introduces the offence of re-identifying data that has been de-identified. I will start by giving some background to this clause because, as noble Lords have mentioned, this is new to data protection legislation. Pseudonymisation of datasets is increasingly commonplace in many organisations, both large and small. This is a very welcome development: where sensitive personal data is being processed in computerised files, it is important that people know that data controllers are taking cybersecurity seriously and that their records are kept confidential. Article 32 of the GDPR actively encourages controllers to implement technical and organisational measures to ensure an appropriate level of security, including, for example, through the pseudonymisation and encryption of personal data. As noble Lords will be aware, the rapid advancement of technology has opened many doors for innovation in these sectors. However, as we continue to be able to do more with technology, the risk of its misuse also grows. Online data hackers and scammers are a much more prominent and substantial threat than was posed in 1998, when the original Data Protection Act was passed. It is appropriate, therefore, that the Bill addresses the contemporary challenges posed by today’s digital world. This clause responds to concerns raised by the National Data Guardian for Health and Care and other stakeholders regarding the security of data kept in online files, and is particularly timely following the well-documented cyberattacks on public and private businesses over the last few years. It is important to note that the Bill recognises that there might be legitimate reasons for re-identifying data without the consent of the controller who encrypted it. The clause includes a certain number of defences, as my noble friend Lady Neville-Rolfe mentioned. These can be relied on in certain circumstances, such as where re-identification is necessary for the purpose of preventing or detecting crime, to comply with a legal obligation or is otherwise necessary in the public interest. I am aware that some academic circles, including Imperial College London, have raised concerns that this clause will prohibit researchers testing the robustness of data security systems. However, I can confidently reassure noble Lords that, if such research is carried out with the consent of the controller or the data subjects, no offence is committed. Even if the research is for legitimate purposes but carried out without the consent of the controller who de-identified the data in the first place, as long as researchers act quickly and responsibly to notify the controller, or the Information Commissioner, of the breach, they will be able to rely on the public interest defences in Clause 162. Finally, it is only an offence to knowingly or recklessly re-identify data, not to accidentally re-identify it. Clause 162(1) is clear on that point. I turn to the specific amendments that have been tabled in this group. Amendment 170CA seeks to change the wording in line 3 from “de-identified” to “anonymised”. The current clause provides a definition of de-identification which draws upon the definition of “pseudonymisation” in article 4 of the GDPR. We see no obvious benefit in switching to “anonymised”. Indeed, it may be actively more confusing, given that recital 26 appears to use the term “anonymous information” to refer to information that cannot be re-identified, whereas here we are talking about data that can be—and, indeed, has been—re-identified. Amendment 170CB seeks to provide an exemption for re-identification for the purpose of demonstrating how the personal data can be re-identified or is vulnerable to attacks. The Bill currently provides a defence for re-identification where the activity was consented to, was necessary for the purpose of preventing or detecting crime, was justified as being in the public interest, or where the person charged reasonably believes the activity was, or would have been, consented to. So long as those re-identifying datasets can prove that their actions satisfy any of these conditions, they will not be guilty of an offence. In addition, we need to be careful here not to create defences so wide that they become open to abuse. Amendment 170CC seeks to add to the definition of what constitutes re-identification. I agree with the noble Lord that current techniques for re-identification involve linking datasets. However, we risk making the offence too prescriptive if we start defining exactly how re-identification will occur. As noble Lords, including the noble Lord, Lord Clement-Jones, mentioned, as technology evolves and offenders find new ways to re-identify personal data, we want the offence to keep pace. Amendment 170E seeks to add an extra defence for persons who achieve approval for re-identifying de-identified personal data after the re-identification has taken place. The current clause provides a defence where a person acted in the reasonable belief that they would have had the consent of the controller or the data subject had they known about the circumstances of the re-identification. Retroactive approval for the re-identification could be relied on as evidence in support of that defence, so we believe that there is no need to provide a separate defence for retroactive consent.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- My Lords, I think that the noble Lord is misreading the amendment. As I read my own amendment, I thought it was substitutional.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- If we are talking about Amendment 170E, I am certainly prepared to look at that and address it.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- That may have been the original intention, but perhaps it was never put properly into effect.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- In which case, I will read Hansard, the noble Lord can do so and I am sure we will come to an arrangement. We can talk about that, if necessary. Amendment 170F seeks to require the commissioner to produce a code of practice for the re-identification offence three months after Royal Assent. We can certainly explore with the commissioner what guidance is planned for this area and I would be happy to provide noble Lords with an update on that in due course. However, I would not like to tie the commissioner to providing guidance by a specific date on the face of the Bill. It is also worth mentioning here that, as we discussed on a previous day in Committee, the Secretary of State may by regulation require the commissioner to prepare additional codes of practice for the processing of personal data under Clause 124 and, given the issues that have been raised, we can certainly bear those powers in mind. Finally, Amendments 170G and 170H would oblige the commissioner to set standards by which the controller is required to anonymise personal data and criminalise organisations which do not comply. I reassure noble Lords that much of this work is under way already and that the Information Commissioner’s Office has been working closely with government, data controllers and the National Cyber Security Centre to raise awareness about improving cybersecurity, including through the use of pseudonymisation of personal data. It is important to point out that there is no weakening of the provisions contained in article 5 of the GDPR, which require organisations to ensure appropriate security of personal data. Failure to do so can, and will, be addressed by the Information Commissioner, including through the use of administrative penalties. Some have said that criminalising malicious re-identification would create complacency among data controllers. However, they still have every incentive to maintain security of their data. Theft is a criminal offence but I still lock my door at night. In addition, I am not convinced by the mechanism the noble Lord has chosen. In particular, criminalising failure to rely on guidance would risk uncertainty and unfairness, particularly if the guidance was wrong in law in any respect. I accept that the issues noble Lords have raised are important but I hope that, in view of these reassurances, the amendment will be withdrawn, and that the House will accept that Clause 162 should stand part of the Bill. There are reasons for wanting to bring in this measure, and I can summarise them. These were recommendations in the review of data security, consent and opt-outs by the National Data Guardian, who called for the Government to introduce stronger sanctions to protect de-identified patient data. People are generally more willing to participate in medical research projects if they know that their data will be pseudonymised and held securely, and the Wellcome Trust, for example, is supportive of the clause. I hope that those reassurances will allow the noble Lord to withdraw his amendment and enable the clause to stand part of the Bill.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Lord Stevenson of BalmacaraLabour
- Quote
- I thank the noble Baroness, Lady Neville-Rolfe, and welcome her to her first full session. I am glad that we have been able to reorganise our timings so that she has been able to attend and contribute—something that we have missed until now. I also thank the noble Lords, Lord Lucas and Lord Clement-Jones, for their comments and support for this series of amendments. There is a whiff of Gilbert and Sullivan about this. We are talking about a technology that has not yet settled down, and about protections which I do not in any way say are wrong. The technology is still developing and still uncertain, and we are told by experts that what the Bill is trying to do cannot happen anyway. The amendments offer the Government the chance to think again about the need to find a progressive path. We set out on what is often a voluntary basis, under the Government’s approach, with a code that works. People are brought in and consulted, and eventually the crime to be committed is defined—until we have that, we really do not have anything—and we try to be respectful of the fact that people would move out of the sector if they felt that their work would be attacked because it was illegal. I am grateful to the noble Lord for listening to the debates. I hope that we can have a meeting about this to pick up some of the points and take the matter forward from there. I beg leave to withdraw the amendment.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Baroness Neville-RolfeConservative
- Quote
- My Lords, I simply wish to associate myself with the comments of the noble Lord, Lord Stevenson, and say that a meeting on this would be helpful. As I said, I hope that we can find a solution. If we cannot, I have reservations about this measure being part of the Bill.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- I make it plain to my noble friend—my predecessor in this position—that I will arrange a meeting.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
Lord Kennedy of Southwark (Lab Co-op)Labour- Quote
- My Lords, Amendment 170J, which stands in my name and that of my noble friend Lord Stevenson of Balmacara, seeks to address an issue that I am not convinced is sufficiently covered in the Bill as it stands. Freelance workers or self-employed people—whatever you want to call them—offering a range of services and seeking work through various platforms, have sprung up in recent years. In many cases, their customers are able to rate them and the work they have done. However, these individuals often find that they cannot take that rating information with them if they move on to another platform. The reviews are written by third parties, who rate the quality of the work, and understandably it is very valuable to the trades- persons if they can carry those reviews forward with them. This is a very strange situation. Various companies often maintain that they do not have employees and that they are merely acting as a platform, a noticeboard or a portal where people can find tradespersons. However, those tradespersons then find that it is not very easy to take information about them with them when they move on. This is intended as an enabling amendment to put on the face of the Bill that data subjects have the right to take with them the information written about them by third parties when they move on to another platform. At this stage, this is obviously a probing amendment but I am keen to hear what the noble Lord has to say about this issue. It is important for the people concerned—if you have done a good job, you want to take recognition of that with you. I look forward to the noble Lord’s response.
- Time
- 18:00
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- My Lords, I am grateful to the noble Lord, Lord Kennedy, for turning the Committee’s attention to the provisions in Clause 163. The clause makes it a criminal offence for a data controller, or somebody employed by the controller, to deliberately frustrate a subject access request by altering, defacing or destroying information that a person would have been entitled to receive. This offence is not new. A similar offence was provided for in Section 77 of the Freedom of Information Act 2000. The only difference between the offence in Clause 163 and the offence in the Act is that the latter was limited to the handling of subject access requests by public authorities and their employees and agents, whereas Clause 163 extends this to apply to all controllers. The noble Lord’s amendment would make it clear that the offence applies where a data subject requests personal data about them contained in a review about workers written by a third party. I am grateful to the noble Lord for explaining the background to the amendment; nevertheless, I submit that it is unnecessary. Article 15 of the GDPR makes it clear that the data subject has the right to obtain from the controller confirmation as to whether data about him or her is being processed, as well as access to that data. Whether a report about the data subject was compiled by a third party or processor acting on the controller’s behalf is irrelevant, as it still amounts to personal data held by the controller. It is always unacceptable for any controller to destroy or deface personal data with the sole intention of preventing somebody accessing what they were entitled to. That is precisely why Clause 163 creates a criminal offence targeted on that particular activity. I hope that I have addressed the noble Lord’s concerns. If I have not, of course I will be more than happy to discuss them with him later. Therefore, I hope that he will be able to withdraw the amendment.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Lord Kennedy of SouthwarkLabour
- Quote
- I thank the noble Lord for his response. He has not really addressed the point that I was making, so I will be very happy to have a discussion outside the Chamber. This is a real problem that is happening now and I am not convinced that what we have in the Bill will be enough to deal with it. It may well be that my amendment is not in the right place, but there is an issue with people not easily accessing data that is held on them, particularly for the self-employed and others seeking work through various platforms.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- If we have misunderstood the noble Lord’s intention behind the amendment, I apologise. As I said, we will be happy to discuss it with him.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Lord Kennedy of SouthwarkLabour
- Quote
- I do not think that the noble Lord misunderstood; it is just that there are several issues around the gig economy that we need to look at, and I shall be happy to discuss them outside the Chamber. I beg leave to withdraw the amendment.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- My Lords, in moving Amendment 183A I hope to astonish the Minister with my brevity. Clause 172 deals with the avoidance of certain contractual terms related to health records so that, “A term or condition of a contract is void in so far as it purports to require an individual to supply another person with a record which — … (a) consists of the information contained in a health record, and … (b) has been or is to be obtained by a data subject in the exercise of a data subject access right”. The NHS has committed to informing patients how their medical records are used. The legal protections in the Bill against an enforced subject access request on a medical record should also apply to such information about that record. Does this provide the required protection? I beg to move.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Baroness Chisholm of OwlpenNon-affiliated
- Quote
- My Lords, I think that must be a record.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- We try.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Baroness Chisholm of OwlpenNon-affiliated
- Quote
- It is probably for the best that we are not doing a seventh day in Committee because the noble Lord, Lord Stevenson, has told us that his voice is going and I seem to have an infected eye. Slowly, we are falling by the way, so it is probably just as well that this is our last evening. This amendment seeks to amend Clause 172, which concerns contractual terms relating to health records. As noble Lords are aware, the Bill will give people more control over use of their data, providing stronger access rights as well as new rights to move or delete personal data. Data subject access rights are intended to aid people in getting access to information held about them by organisations. While subject access provisions are present in current data protection law, the process will be simplified and streamlined under the new legal framework, reflecting the importance of data protection in today’s digital age. There are, unfortunately, a minority of instances where service providers and employers seek to exploit the rights of data subjects, making it a condition of a contract that a person supplies to them health records obtained through use of their data subject access rights. It is with this in mind that Clause 172 was drafted, to protect data subjects from abuses of their rights. Organisations are able to use provisions in the Access to Medical Reports Act 1988 to gain access to a person’s health records for employment or insurance purposes, and so should not be unduly relying upon subject access rights to acquire such information. Amendment 183A seeks to widen the clause to include prohibiting contractual terms from including a requirement to use subject access rights to supply a person with information “associated with” as well as “in” a health record. While I can see where the noble Lord is coming from with the amendment and appreciate the willingness further to protect data subjects from exploitation, we are not convinced that it is necessary to widen the scope of this clause. The Government believe that avoidance of contractual terms—that is to say a restriction on parties’ freedom of contract—is not something that should legislated for lightly. Our starting point must be that contractual terms are voided only where there is a known, rather than a hypothetical, abuse of them. It is also important to point out that the clause has been carried over from the 1998 Act, which has served us well for many years and we are not aware of any issues with its scope. But I will certainly carefully read the noble Lord’s contribution in Hansard, and with this in mind I encourage the noble Lord to withdraw his amendment.
- Time
- 18:15
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- My Lords, I thank the Minister. She will not need to spend very long reading my contribution in Hansard, as she will appreciate, but I pledge to read what she had to say. The interplay with the Access to Medical Reports Act may be of some importance in this, but on both sides we may need to reflect a little further. The case being made is that, because the NHS is making more information available about the use of patient records, it may be appropriate to change the legislation, which, as the Minister said, may have been fit for purpose for a period of time but now, in the light of new circumstances, may need changing. Indeed, it may not be “hypothetical” any more, to use her word. I will reflect on what the Minister said, but if there is scope for further improvement of the clause, I hope that it might be considered at a future stage. In the meantime, I beg leave to withdraw the amendment.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
- Lord Stevenson of BalmacaraLabour
- Quote
- My Lords, at earlier stages of the Bill, the Minister and others have been at pains to stress the need to ensure that, whatever we finally do, the Bill should help to build trust between those who operate and accept data and those who provide it—the data subjects. It is important that we look at all aspects of that trust relationship and think about what we can do to make sure that it fructifies. Amendment 184 tries to add to the Bill something that could be there, because it is provided for in the GDPR, but is not there. Will the Minister explain when he responds why article 80(2) of the GDPR is not translated into UK legislation, as could happen? The proposed new clause would provide that, “a body or other organisation which meets the conditions set out in that Article has the right to lodge a complaint, or exercise the rights, independently of a data subject’s mandate”. I will largely leave the noble Lord, Lord Clement-Jones, to introduce Amendment 185 because he has a new and brief style of introduction, which we like a lot.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- It is not a new style.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
- Lord Stevenson of BalmacaraLabour
- Quote
- It is certainly new to me. He may have been here a lot longer than I have and there have been other occasions where he has been less than fulsome in his contributions. But I am not in any sense criticising him because everything he says has fantastic precision and clarity, as befits a mere solicitor. It is important that we give him the chance to shine on this particular issue as well. I mentioned what a pleasure it is to have the noble Baroness, Lady Neville-Rolfe, here today, particularly because she will speak very well to the fact that only a few happy months ago we worked on the Consumer Rights Bill, which is now an Act, in which a power was given to private enforcers to take civil action in courts to protect collective consumer rights via an enforcement order. The campaigning consumer body Which? is the designated private enforcer. Also, in the financial sector, Which?, Citizens Advice, the Federation of Small Businesses and the Consumer Council for Northern Ireland have the power to present super-complaints to the FCA. The super-complainant system is working very well; one reason why the PPI mis-selling scandal was discovered was as a result of the work of Citizens Advice. These independent enforcers of consumer rights in the traditional consumer sector and in the consumer finance sector exist. Why is there no equivalent status for digital consumer enforcers? That is the question raised by the amendment. The powers for independent action here are important in themselves and I am sure other noble Lords will speak to that point, but they are also really important at the start of this new regime we are bringing in. With the new Data Protection Bill we have a different arrangement. Far more people are involved and a lot more people are having to think harder about how their data is being used. It makes absolute sense to have a system that does not require too much knowledge or detail, which was aided and abetted by experts who had experience in this, such as Which? and others, and would allow those who are a little fazed by the whole process of trying to raise an action and get things going to have a steady hand that they know will take it on behind them. The Government will probably argue that by implementing article 80(1) of the GDPR they are providing effectively the same service. That is a system under which an individual can have their case taken up by much the same bodies as would be available under article 80(2). However, when an individual complainant is working with a body such as Which?, we are probably talking about redress of the individual whose rights have been breached in some way and exacting from the company or companies concerned a penalty or some sort of remuneration. One can see in that sense that the linking between the individual and the body that might take that on is important and would be very helpful. However, there are cases—recent ones come to mind such as TalkTalk, Equifax, Cash Converters and Uber—where data has gone missing and there has been a real worry about what information has escaped and is available out there. I do not think that in those cases we are talking about people wanting redress. What they want is action, such as making sure that their credit ratings are not affected by their data having come out and that they could perhaps get out of contracts. One of the issues that was raised with EE and TalkTalk was that people had lost confidence in the companies and wanted to be able to get out of their contracts. That is not a monetary penalty but a different form of arrangement. In some senses, just ongoing monitoring of the company with which one’s data is lodged might be a process. All that plays to a need to have in law in Britain the article 80(2) version of what is in the GDPR. I beg to move.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- My Lords, I strongly support Amendment 184. The Minister will have noticed that Amendment 185 would simply import the same provisions into applied GDPR for this purpose. The rationale, which has been very well put forward by the noble Lord, Lord Stevenson, is precisely the same. I do not know whether the Minister was choking over his breakfast this morning, but if he was reading the Daily Telegraph—he shakes his head. I am encouraged that he was not reading the Daily Telegraph, but he would have seen that a letter was written to his right honourable friend Matt Hancock, the Digital Minister, demanding that the legislation can and should contain the second limb that is contained in the GDPR but is not brought into the Bill. The letter was signed by Which?, Age UK, Privacy International and the Open Rights Group for all the reasons that the noble Lord, Lord Stevenson, put forward. The noble Lord mentioned a number of data breach cases, but the Uber breach came to light only last night. It was particularly egregious because Uber did not tell anybody about it for months and, as far as one can make out from the press reports, it was a pay-off. There is a very important role for such organisations to play on behalf of vulnerable consumers. The Which? survey was particularly important in that respect because it showed that consumers have little understanding of the kind of redress that they may have following a data breach. A recent survey shows that almost one in five consumers say that they would not know how to claim redress for a data breach, and the same proportion do not know who would be responsible for helping them when data is lost. Therefore the equivalent of a super-complaint in these circumstances is very important. To add to that point, young people are often the target of advertising and analysis using their personal data. I think they would benefit particularly from having this kind of super-complaint process for a data breach. I hope very much that the Government, who I believe are conducting some kind of review, although it is not entirely clear, will think about this again because it is definitely something we will need to bring back on Report.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
Baroness Jones of Moulsecoomb (GP)Green Party- Quote
- My Lords, I support Amendment 184. As the noble Lord, Lord Stevenson, said, the GDPR does allow not-for-profit organisations to lodge complaints about suspected breaches of data protection without needing the authorisation of the individuals concerned. I really do not understand why this has been taken out; it is such an important piece of legislation that gives teeth to data protection. Most people do not have the time or the inclination to lodge complaints against data controllers. So many organisations are now holding data about us that it is ridiculous to suggest that individuals can become data detectives responsible for finding out who holds data on them and trying to work out whether that data is being processed in accordance with data protection rules. I went through the hassle of getting my own subject access request from the Met police. It took a lot of form filling and cost me £10, which was absolutely not money well spent because the file, when I got it, was so redacted. I did ask for my money back but was not given it. That shows me that most of us will not know that data about us is being held—so the amendment is extremely valid. Despite my opposition to some provisions in the Bill, I accept that it is very important. However, it is equally important that we get it right and that we do not have all these derogations which mean that it has less authority and power. Personally, I think that the amendment strengthens the data protection regime without any hassle for consumers. I hope that the Government will include it in the next iteration of the Bill.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
Baroness Kidron (CB)Crossbench- Quote
- I, too, support the amendment. One thing that we can all agree on is that data regulations is a complex and highly technical area of the law. As the Bill stands, it asks members of the public to become experts on the subject, which actually creates a significant barrier to its successful implementation. My particular and declared interest in the Bill is the rights of children. It is a pervasive myth in the digital environment that all users are equal. That is a category error, because if all users are equal, children are treated in the digital environment as adults and their long-established rights and privileges do not then apply. So it is on behalf of that demographic that I want to say specifically that this amendment is very important. Without the amendment, a child would be expected to take on the very adult responsibility of being a named complainant in a regulatory or judicial complaint for a breach of data law. In the case of a child, such a complaint is very likely to be made against a multimillion or indeed multibillion dollar corporation. That cannot be, in anybody’s mind, a fair fight. While the noble Lord’s amendment and indeed the GDPR are designed to benefit all users, I point out that the amendment usefully aligns with the recommendation made by the Children’s Commissioner and the House of Lords Communications Committee that children urgently need champions in the digital environment. We have seen special provision being made in the Bill for libraries, archivists, the insurance industry, security and intelligence, and possibly even for journalists this evening. Given that, I am waiting for the Government to concede that, like all these other special needs groups, children are data subjects with specific needs. One of those needs is to have an informed advocate if they have a complaint. So, although I do not think that the amendment would adequately fulfil that role, because I would like to see something more formal, it would at least go some way to providing support for children should they have a complaint.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
- Lord LucasConservative
- Quote
- My Lords, without these amendments, I do not see how the Bill can provide an adequate remedy when a large number of people suffer a small degree of damage.
- Time
- 18:30
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- My Lords, I am grateful to all noble Lords who have contributed—in particular my noble friend Lord Lucas, who was even briefer than the noble Lord, Lord Clement-Jones. He made his point very succinctly and well. With the greatest respect to the noble Lords, Lord Stevenson and Lord Clement-Jones—and I do mean that sincerely—during the passage of the 443 amendments in Committee that we are rapidly approaching the end of, we have listened carefully to each other, but in this case I am afraid that we reject Amendments 184 and 185 as being unnecessary. We believe that they are not required because the Bill already provides sufficient recourse for data subjects by allowing them to give consent to a non-profit organisation to represent their interests. Clause 173, in conjunction with article 80(1) of the GDPR, provides data subjects with the right to authorise a non-profit organisation which has statutory objectives in the public interest and which is active in the field of data protection to exercise the rights described in Clauses 156 to 160 of the Bill. Taken together with existing provision for collective redress, and the ability of individuals and organisations to independently complain to the Information Commissioner where they have concerns, groups of like-minded data subjects will have a variety of redress mechanisms from which to choose. It is not true that when we have large numbers of data subjects they are unable, or too ignorant of their rights, to combine. For example, it is worth noting that more than 5,000 data subjects have brought one such action which is currently proceeding through the courts. Furthermore, we would argue that the amendment is premature. If we were to make provision for article 80(2), it would be imperative to analyse the effectiveness not only of Clause 173 and article 80(1) of the GDPR but of other similar provisions in UK law to ensure that they are operating in the interests of data subjects and not third parties. We would also need to assess, for example, how effective the existing law has been in dealing with issues such as aggregate damages, which cases brought under article 80(2) might be subject to. More generally, the Bill seeks to empower data subjects and ensure that they receive the information they need to enforce their own rights, with assistance from non-profit organisations if they wish. The solution to a perceived lack of data subject engagement cannot be to cut them out of the enforcement process as well. Indeed, there is a real irony here. Let us consider briefly a claim against a controller who should have sought, but failed to get, proper consent for their processing. Are noble Lords really suggesting that an unrelated third party should be able to enforce a claim for not having sought consent without first seeking that same consent? We should also remember that these not-for-profit organisations are active in the field of data subjects’ rights; indeed, the GDPR states that they have to be. While many—the noble Lord, Lord Clement-Jones, mentioned Which?—will no doubt have data subjects’ true interests at heart and will be acting in those best interests, others will have a professional interest in achieving a different outcome: raising their own profile, for example. I know that these amendments are well intentioned and I do have some sympathy with the ambition of facilitating greater private enforcement to complement the work of the Information Commissioner. But, for the reasons I have set out, I am not convinced that they are the right solution to the problems identified by noble Lords, and I therefore urge the noble Lord to withdraw his amendment.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- My Lords, I am baffled by the Minister’s response. The Government have taken on board huge swathes of the GDPR; in fact, they extol the virtues of the GDPR, which is coming into effect, as are many of its articles. Yet they are baulking at a very clear statement in article 80(2), which could not be clearer. Their prevarication is extravagant.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- The noble Lord will admit that the GDPR allows member states to do that; otherwise, it would have been made compulsory in the GDPR. The derogations are there to allow member states to decide whether or not to do it. To summarise, we have chosen not to adopt article 80(2) because the Bill is based on the premise of getting consent—but these amendments are saying that, regardless of what the data subject wants or whether they have given consent, other organisations should be able to act on their behalf without their consent. That is the Government’s position and I hope that noble Lords will feel able not to press their amendments.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Stevenson of BalmacaraLabour
- Quote
- I thank the Minister for his honesty and transparency—but not for the content. Like the noble Lord, Lord Clement-Jones, I find this very odd. Is it not true that when early consultations on the Bill were carried out, the consultation included the possibility that article 80(2) would be implemented—in other words, that the derogation would be accepted—and responses were gathered on that basis? That is what we were told by some of those who were consulted. Therefore, the Government must have had a formal change of mind, either based on their own whim or because they received substantial contributions from very important people who felt that these things should not go forward. I would be interested to follow that up with the Minister, perhaps in another meeting. I do think this is very strange. Here is an opportunity to win friends, get people on side and offer them something that will be really helpful. We have heard about children; and there are other vulnerable people who are not experts in these areas, for whom a little extra help was promised by the Government because they felt that that would be right. The idea that, in some senses, this would empower a whole industry of people to manufacture claims to get at data holders seems completely ridiculous. If we look at the comparable arrangements in the consumer field that I tried to draw the Minister’s attention to, we see very strict rules about the levels at which super-complaints can be made: they must be proportionate, relevant and have evidence of support from a wider group of people that allows them to go forward. We are not talking about an open-ended commitment—that would be daft—but when we look at the best way to combat bad practice that affects particular vulnerable groups and is being practised by people who should not do it, this must be in our armoury. We will certainly come back to this—but in the interim, I beg leave to withdraw the amendment.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- My Lords, the Bill creates a comprehensive and modern framework for data protection in the UK. The importance of these data protection standards continues to grow—a point that has not been lost on noble Lords, nor the Government. That is why the Government have tabled Amendments 185A, 185B, 185C and 185D, which provide for a framework for data processing by government. Inherent in the execution of the Government’s function is a requirement to process significant volumes of personal data, whether in issuing a passport or providing information on vulnerable persons to the social services departments of local authorities. The Government recognise the strong public interest in understanding better how they process that data. The framework is intended to set out the principles and processes that the Government must have regard to when processing personal data. All government and public sector activities require some form of power to process personal data, which is derived from both statute and common law. In light of the requirements of the GDPR, such processing should be undertaken in a clear, precise and foreseeable way. The Government’s view is that the framework will serve further to improve the transparency and clarity of existing government data processing. The Government can, and should, lead by example on data protection. To that end, the proposed clauses provide the Secretary of State with the power to issue guidance in relation to the processing of personal data by government under existing powers. As I have already stated, government departments will be required to have regard to the guidance when processing personal data. The Government have consulted the Information Commissioner in preparing the amendment and will, as required in Amendment 185A, consult the commissioner before preparing the framework. The Government are keen to benefit from the commissioner’s expertise in this area and to ensure that the framework does not conflict with the commissioner’s codes of practice. The guidance should provide reassurance to data subjects about the approach that government takes to processing data and the procedures it follows when doing so. It will also help to strengthen further the Government’s compliance with the GDPR’s principles. I beg to move.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Kennedy of SouthwarkLabour
- Quote
- My Lords, government Amendments 185A, 185B, 185C and 185D add four fairly substantial new clauses to the Bill on the last day of Committee. I can see the point made by the Minister when he moved the amendments, but it is disappointing that they were not included right at the start. Have the Government just thought about them as a good thing? The Delegated Powers and Regulatory Reform Committee has not had time to look at these matters. I note that in Amendment 185A, the Government suggest that regulations be approved by Parliament under the negative procedure. I will look very carefully at anything that the committee wants to bring to the attention of the House when we look at these matters again on Report. I am sure the committee will have reported by then. I will not oppose the amendments today, but that is not to say that I will not move some amendments on Report—particularly if the committee draws these matters to the House’s attention.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- My Lords, I want to echo that point. There is time for reflection on this set of amendments and I sympathise with what the noble Lord, Lord Kennedy, said.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- My Lords, I am grateful for those comments. We understand that the DPRRC will have to look at the powers under the clause. As usual, as we have done already, we take great note of what the committee says; no doubt it will opine soon. We will pay attention to that.
- Time
- 18:45
- Source
- View in Hansard ↗
- Speaker
- Lord Clement-JonesLiberal Democrat
- Quote
- My Lords, looking at the amendments and new Schedule 18 is rather like looking for a needle in a haystack, but I hope that the Minister received some notice of what I was going to raise. If not, as ever, I hope that he will helpfully write to me. In paragraph 42 of new Schedule 18, there is a reference to an amendment to Section 77 of the Freedom of Information Act. It deletes any reference to, “section 7 of the Data Protection Act 1998”. That is a deletion of a summary offence, which is rather baffling to many of us. It is about not keeping records. Many of us thought that, since there have been very few or no prosecutions under that section of the Freedom of Information Act, the answer would perhaps have been to ratchet up the penalty. At the moment, it is only a summary offence. Therefore, there is a six-month time limit, and it is difficult to get the information to hand in that period. If it was made a more serious offence, it would be rather more straightforward to prosecute in those circumstances. The Government, however, seem to have swept this off the statute book, buried in new Schedule 18. I hope that the Minister when he writes will elucidate clearly and perhaps say that in another part of the forest a criminal offence still lurks.
- Time
- 19:00
- Source
- View in Hansard ↗
- Speaker
- Lord Ashton of HydeCrossbench
- Quote
- My Lords, I have had some help from the officials, saying, “We debated this earlier”—which was not very helpful. I am not even sure that it was me who debated it, so I am afraid that I will have to look at what the noble Lord said. I do not have the facts at my fingertips. I will certainly write to him and put a copy of the letter in the Library.
- Time
- 19:00
- Source
- View in Hansard ↗