Data Protection Bill [ Lords ] (Morning sitting)

Brendan O'Hara Excerpts

Thursday 15th March 2018 Public Bill Committees

If the Government are serious about taking on the double asymmetry—the asymmetry between the humble individual and the gigantic tech giants, and that between a single case and thousands of people having their data breached—they will accept the amendments. They were drawn up and tested very carefully. We sought expert legal counsel to get them right. We are grateful to the House for the fact that they have been framed nice clearly. I urge Ministers not to fail this basic test of judgment as to whether they are serious about protecting our data rights, and to accept the amendments.

[Brendan O'Hara (Argyll and Bute) (SNP)]

It is a pleasure to serve under your chairmanship this afternoon, Mr Streeter.

I support amendment 154. We strongly recommend that if the Government are, as they claim to be, serious about providing the best possible data protection regime to achieve the gold standard that they often talk about for UK citizens, they should look again at the issue of collective redress and make provision for suitably qualified non-profit organisations to pursue data protection infringements and breaches of their own accord, as provided for by the GDPR.

The right hon. Member for Birmingham, Hodge Hill rightly said that the amendments would allow representative bodies to bring such cases, but would also allow individuals to opt out. Currently there is not a level playing field. If the Bill is not amended, the already uneven playing field will become impossibly uneven for individuals whose rights are breached or infringed—probably by a tech giant.

Collective redress was one of the most controversial and hotly debated issues when the Bill was in the House of Lords. The Government resisted all attempts to change it there. There have been slight amendments since then, and an understanding has been reached, but I feel that what the Government propose does not go nearly far enough to address the concerns expressed by Scottish National party and Labour Members.

Anna Fielder, a former chair of Privacy International, wrote:

“Weak enforcement provisions were one of the widely acknowledged reasons why the current data protection laws, in the UK and elsewhere in Europe, were no longer fit for purpose in the big data age. As a result, it has been more convenient for organisations collecting and processing personal information to break the law and pay up if found out, than to observe the law — as profits made from people’s personal information vastly outweighed even the most punitive of fines.”

That is the situation we are in, and it is incumbent on legislators to level the playing field—not to make it even more uneven. However, as the Bill currently stands, it only enables individuals to request that such suitably qualified non-profit organisations take up cases on their behalf, rather than allowing the organisations themselves to highlight where they believe a breach of data protection law has occurred.

All too often, as has been pointed out on numerous occasions, individuals are the last people to know that their data has been unlawfully and in many cases illegally used. They depend on suitably qualified non-profit organisations, which are there to conduct independent research and investigations, to inform them that that is the case. Indeed, there was a very striking example recently in Germany, where the consumer federation took one of the tech giants to court over a number of platform breaches of current German data protection law, and it won. However, there are numerous examples across the world of organisations and groups highlighting bad or illegal practices that would hitherto probably have gone unnoticed here.

Privacy International recently published a report on the use and possible abuse of personal data connected to the rental car market. Which? has carried out research on online toys that are widely available in this country, which could pose serious child safety risks. The Norwegian consumer council has done similar work on toys, as well as exposing unlawful practices by health and dating apps.

Across the world, there are groups that do collective redress work very successfully in Belgium, Italy, Portugal, Spain, Sweden, Canada and Australia. I urge the Government to reconsider the matter and to see the great consumer benefits and protections that would come from accepting amendment 154. It would give not-for-profit organisations the right to launch complaints with a supervisory authority, as well as seeking judicial remedy, when it considered that the rights of a data subject under the GDPR had been breached.

I repeat that at the moment we have an uneven playing field. If the Bill goes through unamended it will become an impossible playing field for consumers, so I urge the Government to accept the amendment.

[Darren Jones]

I promise not to speak at every opportunity today, Mr Streeter; I am conscious that it is a Thursday and that Members have constituencies to get to, but on this point I will just add my support to the amendment tabled by my right hon. Friend the Member for Birmingham, Hodge Hill.

The Bill puts us in a position that we should not have been in in the first place. The Government’s original view was that they were not going to implement article 80 of the GDPR; they have now gone one step in that direction, and I support the aim that we go the whole hog.

I recognise from my work previous to being an MP that a lot of tech companies are not evil; they want to do the right thing and go about being successful as businesses. It was partly my job in the past to look at these areas of law on behalf of companies, and to work with campaigning groups, regulators and others. It was about being an internal voice to make sure that there was the correct balance within businesses was correct between considering consumers and being pro-business. This amendment would help to facilitate that conversation, because if bodies such as Which? that are private enforcers on behalf of consumers had these legal rights, then of course there would be an obligation on businesses to have ongoing dialogue and relationships. They would have to make sure that consumers’ concerns were at the forefront and that they were doing things in the right way.

The balance to be struck is really important. The Information Commissioner’s Office, for example, has lost quite a lot of staff to other companies recently. The Minister’s Department had to increase the salary bands for ICO staff to try to keep them there. In other sectors of the regulated economy, having private enforcers on behalf of consumers as a collective group works perfectly well for existing regulators.

In the telecommunications sector, in which I have worked in the past, there is Ofcom, which regulates the telecom sector, but there is also Which?, working as a private enforcer under the Consumer Rights Act 2015, which can act on behalf of consumers as a group. That works perfectly well and as my right hon. Friend said, private enforcers will not just start bringing these super-complaints every week, because the risk would be too high. They will only bring these super-complaints when they have failed in their dialogue and have no choice.

--- Later in debate ---

[Margot James]

As I said, the GDPR represents significant change. We believe we should test the effectiveness of the new enforcement scheme before we make further changes of the kind the right hon. Gentleman is suggesting. The Morrisons case was effective. The collective redress mechanism—group litigation orders—was used and was effective. The Information Commission will have new powers under the Bill to force companies to take action when there has been a breach of data.

There are other problems with amendment 154. First, like the right hon. Member for Birmingham, Hodge Hill, we are concerned about children’s rights. We would be concerned if a child’s fundamental data rights were weighed up and stripped away by a court without parents or legal guardians having had the opportunity to make the decision to seek redress themselves or seek the help of a preferred non-profit organisation. Once that judgment has been finalised, there will be no recourse for the child or the parent. They will become mere observers, which is unacceptable and makes a travesty of the rights they are entitled to enforce on their own account.

Secondly, we must remember that the non-profit organisations referred to in the amendment are, by definition, active in the field of data subjects’ rights. Although many will no doubt have data subjects’ interests at heart, some may have a professional interest in achieving a different outcome—for example, chasing headlines to promote their own organisation. That is why it is essential that data subjects are capable of choosing the organisation that is right for them or deciding not to partake in a claim that an organisation has advertised. The amendment would also allow an individual to bring a collective claim on behalf of other data subjects without their consent.

[Brendan O'Hara]

Does the Minister not accept, as I said earlier, that individuals are often the last people to know that their data has been breached and their rights have been infringed? For collective rights in hugely complicated areas, there must be a presumption that those rights are protected, and the Bill does not do that. I do not believe it reflects the principle that individuals are often the last people to know, and that they are the ones who need protecting.

[Margot James]

The Information Commissioner has powers to force companies to notify data subjects of any breach of data, and there is a legal requirement on companies so to do.

The amendment would allow an individual to bring a collective claim on behalf of other data subjects without their consent. We oppose it because it does not give people the protection of knowing that the entity controlling their claim is a non-profit organisation with a noble purpose in mind. I am pleased to say that, as I outlined this morning, the Government’s position was supported in the other place by the Opposition Front Benchers and the noble Baroness Kidron.

--- Later in debate ---

[The Chair]

I think the amendments are to clause 27 of the Bill.

[Brendan O'Hara]

I rise to speak to amendment 161 and amendments 162 to 169.

[The Chair]

That is the next clause.

[Brendan O'Hara]

My apologies.

[The Parliamentary Under-Secretary of State for the Home Department (Victoria Atkins)]

It is a pleasure to serve under your chairmanship, Mr Streeter. Clause 26 creates an exemption for certain provisions in the Bill only if that exemption is required for the purpose of safeguarding national security or for defence purposes. Where processing does not meet these tests, the exemption cannot apply. It is possible to exempt from most but not all the data protection principles the rights of data subjects, certain obligations on data controllers and processors, and various enforcement provisions, where required to safeguard national security or for defence purposes. In relation to national security, the exemption mirrors the existing national security exemption provided for in section 28 of the 1998 Act. The statutory framework has long recognised that the proportionate exemptions from the data protection principles and the rights of data subjects are necessary to protect national security. The Bill does not alter that position.

The exemption for defence purposes is intended to ensure the continued protection, security and capability of our armed forces and of the civilian staff who support them—not just their combat effectiveness, to use the outdated language of the 1998 Act. In drafting this legislation, we concluded that this existing exemption was too narrow and no longer adequately captured the wide range of vital activities that are undertaken by the Ministry of Defence and its partners. We have seen that all too obviously in the last two weeks.

--- Later in debate ---

For an interference with rights to be in accordance with law, it must include safeguards against arbitrary interference. We contest that the provisions regarding national security certificates fall short of that requirement. These clauses, unamended, would leave the Government wide open to legal challenge. We hope that the Minister will see the merit of our amendments and correct the Bill at this stage.

[Brendan O'Hara]

It may come as no surprise that I rise to speak in support of amendments 161 to 169. They are intended to challenge the Government’s plan to introduce a national security certification regime that will allow the restriction of and exemptions from a wide range of fundamental rights on the basis of national security and defence. Although it is absolutely right that, as a country, the UK has the ability to act in its own national security interest, I and many others are worried that the scale and scope of what is proposed in the Bill goes much further than the 1998 Act by widening the national security definition to include a further and, I would suggest, undefined range of defence purposes.

The Minister gave three or four examples earlier, but stressed that it was not an exhaustive list. Given the broad and indefinite nature of those national security exemptions, we are concerned that they do not meet the test of being both necessary and proportionate. How much confidence can we have that an individual’s fundamental rights will be best protected when the exemptions will be signed off by a Government Minister with little or no judicial oversight? It is also concerning that there appears to have been little or no attention to the harmful impact of exempting vast amounts of information from data protection safeguards by relying upon national security certificates.

As we heard earlier, the list of rights that are exempted, set out in clause 26, includes the right to be informed when data is being collected, the right to find out when personal data is being processed and the right to object to automated decision making. Those exemptions are to be exercised by a certificate, which, as I say, will be signed by a Minister, who will certify that an exemption from those rights and obligations is necessary for the purpose of safeguarding national security.

That means that, as the Bill is currently drafted, people’s rights could be removed by a politician without any form of judicial oversight. That cannot be right. We would argue most strongly that there has to be judicial oversight of any such decision, to prevent the removal of individual data protection rights from being permitted purely at the say-so of a Government Minister. I ask the Minister, how do the Government define national security and defence purposes in the context of the Bill? I certainly was not satisfied with the explanation we heard earlier on. I believe that these undefined terms are unnecessarily open-ended and broad, and open to vague interpretation. They could very well result in the removal of an individual’s rights unnecessarily. The lack of a clear definition of national security and defence purposes also means that people will be unable to foresee or understand when their rights will be overridden by the application of these exemptions. Surely that is incompatible with an individual citizen’s fundamental rights.

These exemptions, on the surface, are not limited to the UK’s intelligence and security services. As we heard when debating part 2 of the Bill, which deals with general processing, they broadly permit public authorities, and even private corporations on occasion, to invoke national security and defence as a reason to cast aside privacy rights. Can the Minister explain if, how, and under what circumstances a public authority or private company could invoke national security and defence as a reason to cast aside privacy rights?

That brings me to necessity and proportionality, which are fundamental principles when looking at exemptions from data protection, and which will be examined extremely closely by the European Commission and its legal team when it decides on the UK’s suitability for adequacy after Brexit. The principles of necessity and proportionality are enshrined in the European convention on human rights. A Minister must take them into account when they consider restricting or limiting an individual’s rights, such as those under article 8, the right to privacy.

As the Bill stands, no conditions or tests are imposed on a Minister’s decision to withdraw an individual’s personal data protection rights by issuing a national security certificate. There is no limitation on how a national security certificate should run or how long it should operate for. There is no obligation to review the ongoing necessity of having a live certificate. In effect, a certificate is open-ended and indefinite. My concern is that that may allow the state to use a certificate for activities for which it was not considered relevant or appropriate by the Minister when it was first issued or signed.

That loophole cannot be considered proportionate or necessary. The certificates have to be time-limited. That does not mean that once a certificate has expired it cannot be re-certified, but it would ensure that certificates that are no longer necessary or that have been used beyond their original remit do not continue indefinitely. Perhaps the Minister could explain why she thinks such a system could not work, and why it would not be in the best interest of the state and of protecting an individual’s rights.

As with everything we do, including everything we have done in this area in the past couple of years, the Bill has to be seen against the backdrop of Brexit. Not only do we have to comply with the GDPR, but we have to do so in a way that means the United Kingdom will achieve the vital, much sought after adequacy decision from the European Commission. We also have to keep our laws consistent with EU law to maintain that adequacy status. I fear that the widespread use of exemptions and, perhaps more worryingly, the undefined range of defence purposes could deal a severe blow to the UK achieving an adequacy decision from the European Commission.

Can the Minister tell me whether the Government have been given cast-iron guarantees that the new and undefined range of defence purposes will be consistent with EU law, to allow us not just to achieve adequacy but to maintain adequacy post Brexit?

[The Chair]

I will call the Minister to respond, but before she responds to that point, she wishes to correct the record in relation to a previous point, which I am happy to permit.

Data Protection Bill [ Lords ] (First sitting)

Brendan O'Hara Excerpts

Tuesday 13th March 2018 Public Bill Committees

[The Chair]

I remind Members—particularly new Members—that new clause 12 is being debated now, but will not be voted on, if Members wish to have a vote, until we have completed consideration of the Bill. Today’s debate is on clause 2 and new clause 12, but the vote on the new clause will come later.

[Brendan O'Hara (Argyll and Bute) (SNP)]

I rise in support of new clause 12, for two reasons. With the Bill as it stands, we see an erosion of the rights of UK citizens in a range of areas. This is particularly important because, as drafted, the EU (Withdrawal) Bill, eliminates important rights that are protected by article 8 which would otherwise constrain Ministers’ ability to erode the fundamental data protection rights that we currently enjoy.

On top of that, it is essential that, post-Brexit, the United Kingdom has an adequacy agreement with the rest of the European Union. As we have heard from the right hon. Member for Birmingham, Hodge Hill, if the United Kingdom fails to secure an adequacy agreement, I fear there will be a flight of high-tech, high-skilled jobs from the United Kingdom to other parts of the European Union.

For the UK to be able to take full advantage of this vital continued free flow of data with the rest of the European Union post Brexit, the most straightforward route is an adequacy agreement. As I have heard argued before, that decision is not as straightforward as one would hope. An adequacy agreement is not simply in the Commission’s gift to give; it is a legal judgment.

If I could point again to the data protection lawyer, Rosemary Jay, who said that the EU had to go through a legislative process, and it was simply not in the EU’s gift to do this in any informal way. The Commission has to go through a legislative process in order to give the UK an adequacy agreement. There are further complications because, with an adequacy agreement, the European Commission has to consider a variety of issues, such as the rule of law, respect for human rights, and legislation on national public security and criminal law. That being so, as it currently stands, the Investigatory Powers Act may well prove a block to achieving adequacy. The Act has already been accused of violating the European Union’s charter of fundamental rights. Eduardo Ustaran, the internationally recognised expert, has said:

“What the UK needs to do is convince the Commission—and perhaps one day the European Court of Justice—that the Investigatory Powers Act is compatible with fundamental rights. That’s a tall order”.

While I can understand that the Government are absolutely desperate to secure an adequacy agreement, the harsh reality is that, in these challenging circumstances and with this challenging legal process, it is not going to be as simple as perhaps we had hoped.

No one wants this situation to arise; it is absolutely essential that we have this deal, but, as GDPR evolves over time—as it surely will—in order to maintain that adequacy status, should we attain it, the UK will have to keep its data protection law in line with GDPR. The EU charter of fundamental rights and freedoms is absolutely central to EU data protection law. If we exclude ourselves now from article 8, the chances of achieving adequacy are seriously jeopardised, and the chances of maintaining adequacy are further jeopardised. I urge the Government please to consider the long and short-term consequences of not accepting this new clause. Without article 8, I cannot see how we will achieve or maintain adequacy, and if we cannot achieve and maintain adequacy, the consequences for UK high-tech businesses are unfathomable.

[Darren Jones (Bristol North West) (Lab)]

Thank you, Mr Hanson. It is a pleasure to serve under your chairmanship on my first Bill Committee.

I rise to support the comments made by my right hon. Friend the Member for Birmingham, Hodge Hill about the importance of adequacy and its link to article 8 of the charter of fundamental rights, and therefore in support of new clause 12. The Bill is pragmatic in seeking to bring GDPR principles into areas of non-EU competence and to provide a legislative parking space for GDPR if the UK leaves the European Union. However, we cannot get away from the fact that GDPR in itself has a legal basis that is anchored to the European charter of fundamental rights. In trying to copy and paste that level of protection into UK law, we must therefore also bring with it the fundamental rights to which it is attached.

--- Later in debate ---

[Brendan O'Hara]

Does the Minister not accept that the countries she just listed were in an entirely different situation from the one that the United Kingdom finds itself in at the moment, where it is withdrawing from, rather than joining? One cannot compare like with like, because they are two entirely different situations. I believe that we are putting ourselves outside the scope of the GDPR and of achieving adequacy. The countries that she talked about took many years to achieve an adequacy agreement. The United Kingdom does not have that time. If the United Kingdom does not achieve adequacy on day one post-Brexit, does she not agree that the economy of the United Kingdom will suffer greatly as a result?

Blagging: Leveson Inquiry

Brendan O'Hara Excerpts

Wednesday 7th March 2018 Commons Chamber

[Matt Hancock]

I respect my right hon. and learned Friend’s view. Indeed, it was an honour to serve with him in government. But the question that faces us is: what is the right thing to do now to ensure that we have high-quality democratic discourse, when the press face such great challenges, and to tackle fake news, deliberate disinformation, clickbait and the impact of the internet, which was hardly covered by this inquiry? We are taking that work forward. As I mentioned in my statement, allegations of behaviour such as this were covered and looked into by the original inquiry, and there were extensive police investigations. If it comes to another police case into these allegations, the existing law is there to cover it.

[Brendan O'Hara (Argyll and Bute) (SNP)]

Clearly these new reports are worrying and only add to the serious concerns that many of us across the House have about the behaviour of the press. Scottish National party Members have always said that individuals should be able to seek redress when they feel they have been the victim of press malpractice, and it benefits every one of us to have a media that is both transparent and accountable.

I repeat that if Leveson 2 is to be set up, the Scottish Government must be consulted and Scotland’s distinct legal system recognised. In those circumstances, we would support efforts to establish a new UK-wide press inquiry. What action, if any, is the Secretary of State proposing to take on these new allegations? Can he guarantee that if an inquiry is established, it would happen only after consultation with the Scottish Government and would take into account and respect Scotland’s distinct legal system?

[Matt Hancock]

Of course I respect the constitutional settlement. Action is necessary as a result of these revelations, and it is action for the police into allegations of what appear to be criminal activities.

Data Protection Bill [Lords]

Brendan O'Hara Excerpts

Money resolution: House of Commons & Programme motion: House of Commons
Monday 5th March 2018 Commons Chamber

[Brendan O'Hara (Argyll and Bute) (SNP)]

The Scottish National party acknowledges the need for a new and comprehensive data protection framework that safeguards human rights, and updates UK data protection law to bring it in line with the European Union’s general data protection regulation. We want a Data Protection Bill that makes the UK’s data protection laws fit for the digital age, that enshrines the principle of transparency and accountability and that gives all citizens and consumers greater control over who has access to their personal information and what those parties can do with it.

Despite what we have heard in the debate, this is a wide-ranging and complicated Bill. The House is agreed on many aspects of it, but in certain crucial areas, it falls short of what we expect from modern data protection legislation. Specifically, we are concerned about the Bill’s provisions on the UK’s derogation from the GDPR for the purposes of effective immigration control. We also have concerns about automated decision making, the use of national security certificates and the lack of provision for collective redress. We are also very concerned about the consequences for the UK as it tries to secure an adequacy agreement with the European Union, post Brexit.

As the Secretary of State is well aware, SNP Members and the Scottish Government are extremely concerned about clause 168, which concerns section 40 of the Crime and Courts Act 2013. Clause 168 was inserted in the other place and impinges on areas wholly devolved to the Scottish Parliament. Although we will be as constructive as possible in assisting the passage of the Bill, we will table our own amendments and support other Members’ amendments on those issues in Committee.

We will definitely seek to challenge paragraph 4 of part 1 of schedule 2, which is effectively an immigration exemption that permits the Government to collect and hold data without subject knowledge; we find that deeply worrying. Equally concerning is that there is no legal definition of immigration control, or the maintenance of effective immigration control, anywhere in the Bill. Given that effective immigration control is both highly subjective and highly political, I fear it will make individuals’ rights extremely susceptible to changes in political tides. This broad, wide-ranging exemption is fundamentally unfair, and it runs contrary to basic human rights. It is unprecedented and as unnecessary as it is disproportionate.

Under this exemption, the Government will remove any obligation they have under data protection law to inform an individual that their data has been transferred to the Home Office for immigration control purposes. The individual concerned would not know that their data was being held, or that they were under investigation. They would have no right to see what data of theirs was being held by the Home Office, or to find out why it was being held. They would have no way of checking the accuracy of the information held by the Home Office, and they would have no way of correcting any mistakes in that information, which could be used by the Home Office to decide whether they could live in this country.

That means that one early error in data collection or processing could become indisputable fact by the time it reached the Home Office, and the Home Office could base its case against an individual on that. As MPs, we all know how often information held on individuals turns out to be wrong. This is an issue of basic fairness, and it is little wonder that the measure has been roundly condemned by numerous civil liberties groups and by many in the legal profession.

If the measure is enacted, it would be a fundamental change to the way things currently work, whereby data held on an individual can be obtained through a subject access request. As it stands, the Home Office, the applicant and the applicant’s legal representative all have access to the same information, and it is that information on which claims and legal challenges are based. Surely, if both sides do not have access to the same information, the fairness of legal proceedings is inevitably compromised.

Subject access requests are often the only route through which legal professionals can obtain access to such information, and thereby understand the complicated immigration history of some of their clients. Indeed, for applicants who have been the victim of domestic abuse and who were in a controlling relationship for years before seeking help on immigration matters, a subject access request may be their only way of establishing their basis for settlement and for gaining independence from an abusive partner. This exemption will reduce a legal representative’s ability to best represent their client, and it will remove an important tool in holding the Home Office to account when it ignores or seeks to misrepresent the facts.

Further to the comments of the hon. Member for West Bromwich East (Tom Watson), we also strongly recommend that the Government look again at clause 183, and make provision for suitably qualified non-profit organisations to pursue action against data protection infringements of their own accord. This kind of enforcement, where one person or body represents a group of individuals, is known as collective redress. As it stands, clause 183 only allows individuals to request that suitably qualified organisations take up a case on their behalf, rather than allowing such organisations to highlight where they believe a breach of data protection law has occurred.

All too often, individuals are the last to know that their data has been unlawfully used, and in many cases those best placed to identify unlawful practices are the organisations that do the independent research and investigation. We hope that clause 183 can be amended to ensure that not-for-profit organisations have the right to raise complaints themselves when they consider that people’s data protection rights have been infringed.

I also want to raise the matter of automated decision making and, in particular, clause 14, which permits exemptions from the right not to be subject to an automated decision. We strongly believe that automated decision making without human intervention should be subject to the strictest limitations, and it has to address fairness, transparency, accountability and issues of discrimination. The Bill provides insufficient safeguards. This is not about an online retailer suggesting what book or song someone might wish to download, based on previous purchases; this is about decisions being made without human oversight that can have long-term, serious consequences for an individual’s health, or their financial, employment or legal status.

As I understand it, clause 48 would allow law enforcement agencies to make purely automated decisions. This is fraught with danger and is, we believe, not only at odds with the Data Protection Act 1998, but against article 22 of the GDPR, which gives individuals the right not to be subject to purely automated decisions. The GDPR contains provision for EU member states to opt out of this, but that opt-out does not apply if the data subject’s rights, freedoms and legitimate interests are undermined. I urge the Government to look again at those parts of the Bill on automated decision making and to make it explicit that where automated processing is carried out, a human will have to decide whether it is reasonable and appropriate to continue. That human intervention will provide transparency and accountability, and ensure that the state is not infringing an individual’s fundamental rights, liberties and privacy. Those issues are often subjective and beyond the concept of an algorithm.

Another area of concern, which we will raise in Committee, relates to the issuing of national security certificates, which allow restriction of and exemption from a wide range of rights in the Bill and the GDPR on the basis of national security and defence. It is right that a country should have an ability to do what is deemed to be in the best interests of its national security, but many would argue that, since 1998, national security certificates have received insufficient scrutiny of their impact on privacy or their proportionality. We are concerned that the proposals in the Bill go much further than those in the Data Protection Act 1998. We question whether the broad and indefinite nature of those national security exemptions is necessary and proportionate and whether the oversight of the issuing of national security certificates is sufficient. As the Bill is drafted, an individual’s rights could be removed by a politician without any form of judicial oversight. Surely it cannot be right for an individual’s rights to be undermined so easily, purely on the say-so of a Minister.

Of course, even in normal circumstances, the passage of this Bill would be challenging, given its nature, size, scope and complexity, but it has to be seen against the backdrop of Brexit, as does everything we do and have done for the past two years. We have to not only comply with the GDPR, but do so in such a way that the United Kingdom achieves an adequacy decision from the European Commission, allowing it to continue to operate securely and freely within the framework of the GDPR. I fear that much of what is proposed in this Bill, particularly on the immigration exemption and the national security certificates, jeopardises achieving that adequacy decision, as before granting such a decision the European Commission is obliged to consider a variety of issues, including respect for fundamental rights. As we have heard, the GDPR will evolve over time, and the UK will have to maintain adequacy, and that means amending our data protection to keep it in line with European law.

My final point relates to amendment 147 from the other place, which will have the same effect as implementing section 40 of the Crime and Courts Act 2013. The Minister is aware that although data protection is a reserved issue, both criminal justice and press regulation are wholly devolved to the Scottish Parliament. Furthermore, the concept of exemplary damages does not exist in Scots law, and the Scottish Government have no intention of changing the law for the purposes of incentivising participation in a press regulation system. As it stands, this Bill seeks to regulate the press by means of civil procedure, both of which, as I say, are devolved to the Scottish Parliament.

As I said in the Chamber last week, we believe that all individuals should be able to seek redress when they feel they have been the victim of press malpractice, and the Scottish Government will continue to engage with the Scottish press on independent self-regulation. The Secretary of State has had correspondence on this matter from myself and Fiona Hyslop, the Scottish Government’s Cabinet Secretary for Culture, Tourism and External Affairs, who wrote to the UK Government last month making clear the Scottish Government’s position on this matter. On the second part of the Leveson inquiry, she was equally clear that press regulation and any associated issues around the culture, practices and ethics of the press would be a matter for the Scottish Government and that in any future inquiry, the distinct legal context in Scotland must be taken into account. It benefits every one of us to have a data protection regime that is transparent and accountable and that has at its heart the rights of the individual to control what happens with their data.

Although there is much that we agree on in this Bill, there are areas that give us serious cause for concern. In Committee, we will therefore table amendments and support others’ amendments that seek to address concerns about the immigration exemption, collective redress, automated decision making, the scope of national security certificates and, of course, section 40 as it relates to Scotland. These amendments will seek to strengthen the Bill, to guarantee that everyone’s human rights are protected equally and to ensure that, going forward, the UK has the best chance of securing the adequacy decision that it requires, post Brexit.

Leveson Inquiry

Brendan O'Hara Excerpts

Thursday 1st March 2018 Commons Chamber

[Matt Hancock]

Yes, of course. Not only have I made this statement today, but I will also be publishing a full response to the consultation, with full details—I will place a copy in the Library. I look forward to coming before the Select Committee to discuss this question narrowly, and also to discuss the wider actions we are taking, in which my hon. Friend is playing an important part, to make sure that we have a sound basis for political discourse in this country.

[Brendan O'Hara (Argyll and Bute) (SNP)]

I thank the Secretary of State for prior sight of his statement. I wrote to him on 22 February seeking an update on progress with the inquiry and asking if and when it would be implemented. I am pleased he has come to the Dispatch Box today at least to clarify that.

The Secretary of State will also be aware that the Scottish National party is absolutely committed to ensuring that the practices that led to Leveson in the first place do not happen again. Our position has always been that, should a UK-wide part 2 of Leveson go ahead, it must take into account the distinct legal context in Scotland.

We firmly believe that all individuals should have a right to redress when they feel that they have been a victim of malpractice. However, the Scottish Government have absolutely no plans to introduce statutory incentives for the press in Scotland to sign up to a state-approved regulator. Press regulation and the operation of the civil courts are areas that are clearly within the devolved competence of the Scottish Parliament, so can the Secretary of State assure us that he will respect the devolution settlement and the independence of the Scottish legal system? Does he agree that, by not doing so, he would set a dangerous precedent in determining the ability of the Scottish Parliament to take decisions in devolved areas?

[Matt Hancock]

I agree wholeheartedly with the hon. Gentleman. It is, of course, part of the devolution settlement that these issues are dealt with in Scotland. I of course respect the separate and distinct legal system in this area. He asks whether we will respect that in future, and he knows as well as I do that amendments have been made to the Data Protection Bill in the other place—that Bill will have its Second Reading in this House on Monday—that, with respect to data protection only, require a Leveson 2-type inquiry and the commencement of section 40 on a UK-wide basis. I look forward to discussing with the hon. Gentleman how we can make sure that we have the respect we need for the devolution settlement and for the Scottish press. The single best way that we can deal with the problem he rightly raises is by disposing of those amendments in their entirety.

Proposal for Designation of Age-verification Regulator

Brendan O'Hara Excerpts

Thursday 1st February 2018 General Committees

[Brendan O'Hara (Argyll and Bute) (SNP)]

I welcome the Minister to her place. If nothing else, to be the person remembered for persuading the right hon. Member for Mid Sussex to get on Twitter puts her in the pantheon of the greats of this House. Unlike the right hon. Member for Birmingham, Hodge Hill, I have not had the delight of visiting the “Matt Hancock MP” app, but I certainly have my weekend’s relaxation sorted out. I look forward to the experience.

I share many of the concerns that the right hon. Gentleman expressed around the BBFC’s funding, resources and ability to do the job that it will be charged with doing. Broadly, the Scottish National party supports this age-verification measure, but we are aware that it is not a silver bullet. It has to be part of a much wider package around education and broader internet child safety. We have concerns, which we have expressed in the past, about data protection and individual privacy issues. Privacy, anonymity and proportionality at all times are very important.

We would like to know more about the software that is intended to be used. Are there mechanisms for the Government to report on improvements to the age-verification software as it progresses? How confident are they that the software is robust enough to deter a moderately tech-savvy teenager from getting round its security portals? What safeguards are there to ensure that the security is sufficiently stringent that the software cannot be hacked, leaked and subsequently exploited?

We are broadly supportive but we have questions about the software and about whether the BBFC has the wherewithal to deliver what the Government seek it to deliver.

[The Chair]

I notice that nine hon. Members were searching Twitter.

Sky/Fox Update

Brendan O'Hara Excerpts

Tuesday 23rd January 2018 Commons Chamber

[Matt Hancock]

The CMA’s report does address the fact that the proposed takeover by Disney is uncertain, and it sets out some details of potential options, given that uncertainty. Anybody can make written representations in the next three weeks, based on that interim report, and I will consider the question when I see the full report in the months to come.

[Brendan O’Hara (Argyll and Bute) (SNP)]

I thank the Secretary of State for advance sight of his statement. I have said many times in this place that plurality and diversity are vital components of an independent media, and therefore I welcome today’s findings by the CMA, which have put on the record the valid concerns that many people have about the further concentration of media ownership in fewer and fewer hands. Although the CMA has said that the deal, as it currently stands, does not meet the public interest test, I am pleased that it references a number of possible remedies.

We have heard reports that the owners of Sky might look to close down Sky News if it becomes an impediment in the takeover deal, with the possible loss of 500 jobs. Can the Secretary of State confirm that he will not allow employees of Sky to be used as pawns in any takeover when the final decision comes before him? If the takeover deal between Disney and Fox is likely to be green-lit, what impact will that have on his final decision, given Disney’s reported lack of interest in news broadcasting?

[Matt Hancock]

It is a matter of law that while consideration of the proposal is ongoing, Sky News cannot be shut down in advance of a decision—I can give the hon. Gentleman that assurance. He also made points about his views on the report published today; I shall reserve my judgement, see the final report and come to a conclusion based on that.

BBC Pay

Brendan O'Hara Excerpts

Tuesday 9th January 2018 Commons Chamber

[Matt Hancock]

I pay tribute to the work of my right hon. Friend—my predecessor—who has brought to the EHRC’s attention the importance of acting in this case. It has a statutory duty to act when it sees unequal pay, and I am glad that, as of this morning’s announcement, it is taking that forward.

[Brendan O'Hara (Argyll and Bute) (SNP)]

May I add my congratulations and best wishes to the Secretary of State as he takes up his new position? Does he agree that, as a publicly funded institution, the BBC has to be both transparent and accountable and that the existence of this secret gender pay gap in the corporation shows that it has been anything but? Perhaps that would explain why the BBC management were so vehemently opposed to having to publish how much the BBC pays its top-earning presenters. I am sure the whole House will join me in thanking my predecessor, Mr John Nicolson, and the Select Committee on Culture, Media and Sport for their work in exposing this scandal. Does the Secretary of State believe that the BBC has acted unlawfully in this matter? Is he confident that the BBC should continue to police itself in such matters? Iceland now insists that all companies with more than 25 employees obtain Government certification of their equal pay policies or face heavy fines. Does he believe it is time that the UK followed suit?

[Matt Hancock]

Given the action that Conservative Members have taken to bring this transparency to the BBC, one would have thought that the Scottish National party might say that that was a good idea or welcome it. We strongly support the BBC, but we also believe that it is acting in its own self-interest by sorting out these sorts of issues, and we will make sure that it does.

Oral Answers to Questions

Brendan O'Hara Excerpts

Thursday 21st December 2017 Commons Chamber

[Matt Hancock]

Yes, absolutely, and increasingly we need to ensure that the delivery works on both sides of the border. Obviously, what matters is getting the roll-out of superfast broadband to everybody in the borders and throughout the country. No matter where the administrative boundaries are, what matters is getting broadband connections to people.

[Brendan O’Hara (Argyll and Bute) (SNP)]

In this the season of good will, will the Minister join me in congratulating the Scottish Government following last week’s announcement that, despite it being a reserved matter, they are to invest £600 million in rolling out 30 megabit superfast broadband across Scotland, with priority given to rural Scotland, thereby making Scotland a truly world-class digital nation by 2021?

[Matt Hancock]

I will certainly join the hon. Gentleman in wishing a merry Christmas to everybody in the Scottish National party and the SNP Government in Scotland. I am delighted that, finally, three and a half years after being granted the money, they have got on with the start of the procurement, but it will take another year for the second phase of the roll-out to get going. He, and more importantly his constituents, will understand why we have grown tired of waiting for the Scottish Government and are getting on with delivering directly through local councils in Scotland in future.

Lotteries: Limits on Prize Values

Brendan O'Hara Excerpts

Tuesday 12th December 2017 Westminster Hall

[Brendan O'Hara (Argyll and Bute) (SNP)]

It is as always a pleasure to serve under your chairmanship this afternoon, Sir Edward. I congratulate the hon. Member for North West Norfolk (Sir Henry Bellingham) on securing this important debate, and pay tribute to all those who contributed. The SNP in this place and the Scottish Government agree that the current law covering society lotteries is past its sell-by date and is in need of an overhaul. The restrictions placed on charity lotteries make that kind of fundraising increasingly difficult and complicated, and limit charity lotteries’ ability to support those working at the front line at a time when demands have never been greater and budgets have never been tighter.

Increasing the annual turnover limit and the draw limit will ensure that the moneys raised by society lotteries can be used to fund charities across the UK and the wider world, making a significant difference to the lives of individuals and communities. Like many hon. Members, while preparing for this debate I was contacted by numerous organisations seeking a change in the law. Among them was ActionAid, which explained that like many other UK charities it uses the income from its lottery to provide a level of service and support it would otherwise not be able to provide. The money that ActionAid receives goes on life-saving work here and around the world, including programmes aimed at tackling violence against women and girls in Kenya, Ghana, Ethiopia and Rwanda. As a result, ActionAid and many other charities are strongly petitioning the Government to change the legislation to allow the annual turnover on a single society lottery to rise from the current £10 million to £100 million, and to raise the individual draw limit on a single society lottery from the current £4 million to £10 million.

I take on board what the hon. Member for Strangford (Jim Shannon) said, when he made his usual sensible contribution and highlighted the danger of encouraging further gambling, but I feel that there is a growing consensus that a change in the law is required. We have heard the Digital, Culture, Media and Sport Committee, the Lotteries Council, the Institute of Fundraising, the Hospice Lotteries Association, and many other charities such as ActionAid calling for that change.

One of the biggest concerns is the fear that increasing the scope of society lotteries will somehow have an adverse effect on the national lottery—as has been mentioned, there has been a drop in national lottery income and funds going to good causes this year. As I understand it, however, there is no evidence to suggest that the success of society lotteries has had a negative impact on the national lottery. Numerous studies by a range of organisations between 2012 and 2015 came broadly to the same conclusion that society lotteries complement the fundraising of the national lottery. The recent drop-off in people participating in the national lottery is believed to be due more to changes made by Camelot to the games themselves—both the Gambling Commission and Camelot recognise that.

In February this year the Gambling Commission stated:

“Despite remaining the most popular gambling activity, there has been a continued decline in participation in the National Lottery draws coinciding with, amongst other factors, the increase in ticket price from £1 to £2 which was introduced in October 2013.”

In September, Camelot was reported in the Financial Times as saying that

“the main reason for the fall in sales last year was the disappointing performance of the National Lottery’s core draw based games—especially Lotto, with player confidence in the game still fragile following the recent game changes.”

Let me be clear: this is not a case of playing off the national lottery against society lotteries. Indeed—perhaps worryingly—I find myself in complete agreement with the Secretary of State who said last month that

“we of course want to ensure that we have one strong national lottery, but that does not mean that we cannot also have strong society lotteries”.—[Official Report, 16 November 2017; Vol. 631, c. 565.]

I am therefore pleased therefore that Nigel Railton, Camelot’s new CEO, is on record as saying that, following an internal company review, he is optimistic that the national lottery will return to growth next year. I believe that we can have a world in which the national lottery and society lotteries co-exist, and that charities and good causes can continue to benefit.

We are all aware of the billions that the national lottery raises for good causes and we are delighted by that, but society lotteries also make a hugely valuable contribution and are successful in raising much needed funds for a wide range of charities and good causes. As the hon. Member for Cannock Chase (Amanda Milling) said, the current law means that there is a growing gap between what society lotteries do and what they could do. Nevertheless, they still raise a huge amount of money—as the hon. Members for Ceredigion (Ben Lake) and for North West Norfolk said, in 2011 society lotteries raised around £100 million for good causes, but they now raise more than £250 million. Such has been their success that that money has become one of the principal means of survival for many charities and organisations. As the hon. Member for Ceredigion said, society lotteries can help small local charities that could not otherwise access national lottery funding.

The hon. Member for Aldridge-Brownhills (Wendy Morton) and the right hon. Member for Witham (Priti Patel) spoke eloquently about the scope of local charities in their constituencies, and they were right to do so. However, not only local charities benefit. Many of the UK’s best known charities, such as Children 1st, the Red Cross, the Marine Conservation Society, the Royal Botanic Garden Edinburgh, Dogs Trust, Save the Children, WaterAid, the Riding for the Disabled Association, and the wonderful Mary’s Meals in my constituency, all benefit as well. Collectively, those charities are asking the Government to revisit the Gambling Act 2005 and make it fit for purpose. They argue that raising the existing cap on what society lotteries can pay out will allow more money to go to charity and good causes while reducing administration costs. The proposed changes have been much talked about—indeed, I understand that the Government’s review was announced on 15 December 2012, which means that this was first discussed five years ago this week.

If we raise the prize money cap on society lotteries, the amounts of money won would not be the complete life-changing experience that happens by winning the national lottery. The Select Committee recognised that. The Secretary of State said recently that the Government remain committed to helping both the national lottery and society lotteries to maximise their contribution to good causes by establishing the right conditions to help them thrive with the appropriate level of regulation. Again I agree, but surely it is time for them to get on and create the conditions that will allow both to thrive.

There is clearly broad cross-party consensus for change. We know that those changes will not come at a cost to the taxpayer or damage the national lottery, and they can be brought forward easily via secondary legislation. It therefore remains only for Ministers to stop delaying and to bring forward the proposed changes as soon as possible. If the Minister is unable to make an announcement today, will she at least provide a timescale for when we can expect such an announcement?