Data Protection Bill [HL]

Lord Ashton of Hyde Excerpts

Report: 2nd sitting (Hansard - continued): House of Lords
Wednesday 13th December 2017 Lords Chamber

Moved by

[Lord Ashton of Hyde]

57: Schedule 2, page 142, line 20, leave out “IPSO”

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

61: Schedule 2, page 142, line 47, at end insert—
“( ) in Chapter IV of the GDPR (controller and processor), Article 36 (requirement for controller to consult Commissioner prior to high risk processing);( ) in Chapter V of the GDPR (transfers of data to third countries etc), Article 44 (general principles for transfers);”

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

65: Schedule 3, page 148, line 17, leave out from “of” to “or” in line 18 and insert “section 2(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)),”

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

67: Clause 15, page 9, line 14, leave out paragraph (d)

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

70: Clause 16, page 9, line 38, leave out subsection (4)

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

71: Clause 17, page 10, line 31, leave out subsection (3) and insert—
“(3) Regulations under this section—(a) are subject to the made affirmative resolution procedure where the Secretary of State has made an urgency statement in respect of them;(b) are otherwise subject to the affirmative resolution procedure.(4) For the purposes of this section, an urgency statement is a reasoned statement that the Secretary of State considers it desirable for the regulations to come into force without delay.”

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

72: Clause 18, page 10, line 35, after “processing” insert “of personal data”

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

78: After Clause 18, insert the following new Clause—
“Minor definitionMeaning of “court”
Section 4(1) (terms used in this Chapter to have the same meaning as in the GDPR) does not apply to references in this Chapter to a court and, accordingly, such references do not include a tribunal.”

--- Later in debate ---

[Lord Kennedy of Southwark]

My Lords, the amendment in my name, and that of my noble friend Lord Stevenson of Balmacara, would insert a new clause in the Bill that requires a data controller to notify both the Information Commissioner and the police if they are subject to a ransomware attack. Ransomware attacks involve hackers taking control of your information held on a computer and agreeing to release the information back to you only on the payment of a large sum of money. It is kidnapping not of a person but of information.

Apparently thousands of UK businesses have paid these ransom demands and do not bring these issues to the attention of the authorities for fear of damaging their reputation. This is a really serious issue, and one that we cannot allow not to be addressed. I find it shocking that companies are paying these ransom demands, effectively on the quiet. The amendment would make it a legal requirement to notify. It is only by being able to understand the scale of these attacks and understand what has happened—whether or not it is successful is irrelevant—that the authorities can undertake the important work of analysis needed to prevent these attacks happening in the future.

I would go further, and say that it is irresponsible of data controllers or their businesses and organisations not to come forward to notify the proper authorities. They are vulnerable and making the problem worse by hindering the efforts to tackle the problem. Not only are they at risk of whoever is behind the attack coming back for more money later—having paid the hacker, the person will be seen as an easy touch—they are exposing other people, businesses and organisations to this form of attack in the future. My amendment would require notification, and I look forward to a detailed response to the issues I have raised. I beg to move.

[Lord Ashton of Hyde]

My Lords, I am grateful to the noble Lord, Lord Kennedy, for his amendment on data protection breaches and ransomware attacks. The repercussions of such attacks are felt by everyone, whether or not they are a direct victim of the crime. It is estimated that in 2016 the cost of fraud and cybercrime in the UK was £193 billion, with the full social cost likely to be much higher. It is therefore essential that stringent measures are in place in legislation to ensure that cyberattacks and fraud are prevented, and any perpetrators found and stopped.

We, nevertheless, believe that Amendment 78A is unnecessary. Article 33 of the GDPR, referenced in the noble Lord’s amendment, requires the data controller to inform the Information Commissioner within 72 hours of all data breaches, including as a result of ransomware attacks. The controller is required to provide information of the likely consequences of the personal data breach, and to describe the measures taken or proposed by the controller to address the breach. There is one exception, given in Article 33, for breaches unlikely to result in a risk to data subjects, but that hardly seems relevant in cases where hackers have proven access to the data in question.

The GDPR does not require data controllers to report cyberattacks to the relevant police forces, for good reason. It is well understood that the Information Commissioner has the expertise and resources to take the appropriate and necessary action in the first instance, including, if she deems it appropriate, referrals to the police or to investigate and bring prosecutions herself under data protection law. I am also puzzled by the amendment’s intention to single out ransomware as the only form of cyberattack worth reporting to the police. A huge range of cyberattacks cause substantial distress and harm to individuals, such as insider attacks, attacks from third countries and other cybercrimes, such as malware and phishing. In addition, organisations can report cyberattacks or fraud to Action Fraud, which in turn ensures that the correct crime reporting procedures are followed. This organisation is overseen by the City of London Police, the national lead for economic crime, and we believe that it represents an effective and scalable structure. For the reasons I have stated, therefore, I would be grateful if the noble Lord would withdraw his amendment this evening.

[Lord Kennedy of Southwark]

I am happy to withdraw my amendment this evening. I wanted to raise the issue here. The Minister cited the figure of £193 billion lost through these and other forms of attacks—he went through a number of them—and this is a very serious matter. I hope that he is correct that companies are required to notify the Information Commissioner on the back of this legislation. This is very serious. I hope that he is correct that it is not necessary to go to the police—the sums of money that he mentioned are absolutely shocking. At one point, he said that the Information Commissioner can start prosecutions. That is fine, if we can find the people behind the crime and if they are in this country. If they are somewhere in lands far away, I wish him all the best, but I suspect that we will have some trouble in catching the perpetrators or bringing them to justice. My worry is that, because of reputational damage, companies will be reluctant to notify anyone about this stuff. It is very serious.

[Lord Ashton of Hyde]

Can I just echo what the noble Lord says? We agree that it is serious, which is why we have set up the National Cyber Security Centre to help to protect public services online and why the Chancellor allocated nearly £2 billion for cybersecurity when he launched that centre.

[Lord Kennedy of Southwark]

It is very pleasing to hear that. I welcome that, but these are matters that we will have to keep under review. Unfortunately in this world, the people involved in this stuff are usually quite skilful and bright and can keep one step ahead of the law or the people trying to catch them. We should keep these matters under review but, unfortunately, they are not going to go away. My worry is that these crimes are committed many miles from these shores and catching the perpetrators is the problem. However, I am very happy at this stage to withdraw my amendment.

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

79: Clause 19, page 11, line 22, leave out “carried on”

--- Later in debate ---

[Baroness Hamwee (LD)]

At the risk of making myself unpopular for one more minute, all I can say to my noble friend is: Humpty Dumpty.

At an earlier stage of the Bill I asked how we would interpret a particular provision when we were no longer tethered to the European Court of Justice. The response I received was that it would be interpreted in accordance with UK law at the time. If this amendment is agreed, it will be an extremely helpful contribution to UK law applying while taking into account the impact of the recitals.

[Lord Ashton of Hyde]

My Lords, I cannot think of a better way to end our debate than with a discussion on recitals, which we have talked about a lot during the course of this Bill. I point out to both noble Lords that it was not only me who referred to recitals; they have both done so ad nauseam.

[Lord Clement-Jones]

Ad infinitum!

[Lord Ashton of Hyde]

Sorry, I should have said “ad infinitum”—that is perfectly correct.

The Government do not dispute that recitals form an important part of the GDPR. As I said, we have all referred to one recital or another many times. There is nothing embarrassing or awkward about that. It is a fact of EU law that courts often require assistance in properly interpreting the articles of a directly applicable regulation—and we, as parliamentarians, need to follow that logic, too.

I would remind noble Lords that the Government have been clear that the European Union (Withdrawal) Bill will be used to deliver two things which are very important in this context. First, under Clause 3 of the withdrawal Bill, recitals of directly applicable regulations will be transferred into UK law at the same time as the articles are transferred. There is no risk of them somehow being cast adrift. Where legislation is converted under this clause, it is the text of the legislation itself which will form part of domestic legislation. This will include the full text of any EU instrument, including its recitals.

Secondly, Clause 6 of the withdrawal Bill ensures that recitals will continue to be interpreted as they were prior to the UK’s exit from the EU. They will, as before, be capable of casting light on the interpretation to be given to a legal rule, but they will not themselves have the status of a substantive legal rule. Clause 20(5) of this Bill ensures that whatever is true for the interpretation of the GDPR proper is also true for the applied GDPR.

More than 10,000 regulations are currently in force in the European Union. Some are more important than others but, however you look at it, there must be more than 100,000 recitals across the piece. The European Union (Withdrawal) Bill provides a consistent solution for every single one of them. It seems odd that we would want to use this Bill to highlight the status of 0.1% of them. Nor, as I say, is there a need to: Clause 20 already ensures that the applied GDPR will be interpreted consistently with the GDPR, which means that it will be interpreted in accordance with the GDPR’s recitals wherever relevant, both before and after exit.

There is one further risk that I must draw to the House’s attention. Recitals are not the only interpretive aid available to the courts. Other sources, such as case law or definitions of terms in other EU legislation, may also be valid depending on the circumstances. Clause 20(5) as drafted provides for all interpretive aids to the GDPR to apply to the applied GDPR. By singling out recitals the amendment could uniquely elevate their status in the context of the applied GDPR above any other similar aids. This, in turn, may cause the GDPR and applied GDPR to diverge.

The drafting of the noble Lord’s amendment is also rather perplexing. It seeks to affect only the interpretation of the applied GDPR. The applied GDPR is an important part of the Bill but it is relatively narrow in its application. I am not sure it has the importance that the noble Lord’s amendment seeks to attach to it. It is, at most, a template for what will follow post exit.

I will not stand here and say that the noble Lord’s amendment would be the end of the world. That would be disingenuous. However, it is unnecessary, it risks unintended consequences and it does not achieve what the noble Lord is, I think, attempting. For those reasons, I am afraid I am unable to support his amendment this evening and I ask him to withdraw it.

[Lord Stevenson of Balmacara]

That is a very disappointing end to a rather splendid day. If you read Amendment 81 closely, it simply says “having regard to”, which is probably the weakest form of expression you can find in any legal circumstance. I am a bit surprised that the Minister could not come to a better conclusion than he did. In fact, we got a sort of Pepper v Hart-ish approach to it; we can rely on it but it is not as good as it would have been if we had agreed Amendment 81. I can say nothing more on this except that I am sure that we will return to this at some stage. I beg leave to withdraw the amendment.

Electronic Communications Code (Jurisdiction) Regulations 2017

Lord Ashton of Hyde Excerpts

Monday 11th December 2017 Lords Chamber

Moved by

[Lord Ashton of Hyde]

That the draft Regulations laid before the House on 1 November be approved.

Considered in Grand Committee on 6 December

Motions agreed.

Data Protection Bill [HL]

Lord Ashton of Hyde Excerpts

Report: 1st sitting: House of Lords
Monday 11th December 2017 Lords Chamber

Moved by

[Lord Ashton of Hyde]

1: After Clause 1, insert the following new Clause—
“Protection of personal data
(1) The GDPR, the applied GDPR and this Act protect individuals with regard to the processing of personal data, in particular by—(a) requiring personal data to be processed lawfully, on the basis of the data subject’s consent or another specified basis,(b) conferring rights on the data subject to obtain information about the processing of personal data, and(c) conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions.(2) When carrying out functions under the GDPR, the applied GDPR and this Act, the Commissioner must have regard to the importance of securing an appropriate level of protection for personal data, taking account of the interests of data subjects, controllers and others and matters of general public interest.”

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, it is with some degree of anticipation that I open the debate on the first day of Report on this Bill with amendments relating to the EU Charter of Fundamental Rights. While we have, in the great tradition of this House, managed to discuss and settle many of our differences over recent weeks while debating this legislation, it was this topic, concerning the charter, where we first found ourselves at odds, really since arguments at the other end of the Palace were sent here to tease us.

Since we last considered this matter, the European Union (Withdrawal) Bill has been making progress in the other place. On 21 November, there was an extensive debate on the future of the charter. My honourable friend the Minister of State for Justice and my honourable friend the Solicitor-General explained at length that the charter is not the original source of the rights contained within it; it was only intended to catalogue rights that already existed in EU law. Those rights, codified by the charter, came from a wide variety of sources, including the treaties, EU legislation and, indeed, case law, which recognised fundamental rights as general principles. All those substantive rights, of which the charter is a reflection not the source, will already be protected in domestic law by the European Union (Withdrawal) Bill. It is not necessary to retain the charter in order to protect such substantive rights.

Last week, on 5 December, the Government published a detailed memorandum setting out how each article of the charter will be reflected in UK law after we leave. That document explains in detail how the right to data protection is already reflected in our law. The Government are well aware of the economic benefit of ensuring that, once we have left the EU, we preserve the free flow of personal data with our main trading partners. Indeed, that is one of the guiding principles that underpins this legislation. On 7 August, when we published our statement of intent before we introduced this Bill, we set that out clearly, and we have repeated this time and again. Every amendment that noble Lords have proposed to this Bill has to be considered against that key test. Will it support or will it harm our arguments that we have wholly implemented the necessary data protection reforms to support the free flow of personal data?

There is no doubt in our minds that we have fully implemented the right to data protection in our law. No one has convincingly put forward any counter argument. None the less, our Amendment 1 is designed to provide additional reassurance on this point. Not only will it be clear in the substance of the legislation and all of the statements and announcements around the legislation; it will also be written into the Bill. This Bill exists to protect individuals with regard to the processing of personal data. Personal data must be processed lawfully. Individuals have rights, and the Information Commissioner will enforce those. The Bill does what it says on the tin.

--- Later in debate ---

[Lord Ashton of Hyde]

My Lords, I turn first to the amendment of the noble Lord, Lord Stevenson. During the course of the Bill I met the noble Lord frequently, both formally and informally. When I met him two weeks ago he told me that he was working on his Amendment 2 and he had a look of foreboding about him. He said, “Wish me luck”. I had sympathy with his position—I almost felt sorry for him—because this is a legally and constitutionally complex area. Amendment 2 reads well—it sounds attractive and has seductive packaging—but when taken out of that packaging and slotted into this Bill it is not only ineffective but damaging. It is rather like pouring diesel into a petrol engine.

The amendment makes great play of creating a new and freestanding right. Unlike the government version it is not framed within the context of the Bill. It is a wider right. Indeed, it is far wider even than article 8 of the charter. It is not constrained to the context of EU law but applies to everything. It is attractive, perhaps, but it is seriously problematic.

How is the court to interpret this new right? If this was in the context of the Human Rights Act, there is a framework within which to operate, so if a court finds primary legislation to be incompatible with a convention right, it will make a declaration of incompatibility. The Human Rights Act sets out the effect of that finding on the validity, continuing operation and enforcement of the legislation. This simply would not exist if we were to agree Amendment 2, so the consequences of any finding would be unclear. That could create legal, regulatory and economic chaos.

How would data controllers operate if they could not tell whether the apparently incompatible legislation they were operating under was still effective or not and there was no mechanism to fill any gap? What if the courts found parts of the GDPR incompatible with this new super-right? Rather than enabling the free flow of data we could be crippling it. Further, how would the courts approach other legislation in light of this new right and how would they approach other rights? Could this new right be balanced against other rights, and if so, would it carry additional weight?

Apart from these legal problems, in our view Amendment 2 is simply unnecessary. The general principles of EU law will be retained when we leave the EU by the European Union (Withdrawal) Bill for the purposes of interpretation of retained EU law. The GDPR will be retained. Indeed, this Bill firmly entrenches it in our law. The right to protection of personal information is a general principle of EU law and has been recognised as such since the 1960s. The European Union (Withdrawal) Bill requires our courts to interpret the GDPR consistently with the general principle reflected in article 8, and with retained CJEU case law so far as it is possible to do so. In that context, the jurisprudence of the CJEU will continue to have influence in much the same way as the judgment of a court in Australia might have an influence on how common legal principles should be applied.

The amendment also refers to the status of judgments of the European Court of Human Rights. This is completely unnecessary and unwelcome. Section 2 of the Human Rights Act already requires our courts to take into account relevant judgments of the Strasbourg court. If we write this here, where else must we write it? We do not want to cast doubt on our absolute and total respect for human rights on any issue, not just data protection. The Government have reaffirmed and renewed our commitment to human rights law. It is reflected through UK national law as well as in a range of domestic legislation that implements our specific obligations under UN and other international treaties, from the convention against torture to the Convention on the Rights of the Child. Of course, the principal international treaty most relevant to the UK’s human rights laws is the European Convention on Human Rights. I am happy to repeat the commitment made by my fellow Ministers in recent months that the Government are committed to respecting and remaining a party to the ECHR. There will be no weakening of our human rights protections because we are leaving the EU.

All of these issues interlink. Article 6 of the Treaty on European Union makes clear that due regard must be had to the explanations of the charter when interpreting and applying it. The explanations for article 8 of the charter confirm that the right to data protection is based on the right to respect for private life in article 8 of the ECHR. The European Court of Human Rights has confirmed that article 8 of the ECHR encompasses personal data protection.

It is easy to conclude that we are spiralling in circles on this matter, and in a sense, we are. We believe that there is simply no problem here of any substance. The right to data protection is fully implemented in our law and it is fully enforceable. Government Amendment 1 makes it clear that this is the case. While Amendment 2 seeks to do the same it trips and falls, creating confusion rather than the clarity the noble Lord is after. So I hope that he will feel able to withdraw his amendment. I wish to press government Amendment 1. As the noble Lord, Lord Pannick, said, we are seeking to provide reassurance. I said at the beginning that we would remain open for discussions on this, and if we can provide any further reassurance, taking into account some of the four points made by the noble Lord, Lord Pannick, we will do so.

The noble Baroness, Lady Ludford, gave a long explanation of why adequacy is important and some of the extra issues that will be taken into account when we have to approach an adequacy decision from the EU, including for example areas of law which at the moment are not susceptible to EU jurisdiction, such as national security. I agree completely that that will be taken into account when we go for an adequacy arrangement. That is exactly why we have tried to apply the GDPR principles to all our laws, so that we have a complete and systematic data protection regime. On that basis, I accept the four questions asked by the noble Lord, Lord Pannick. We will consider those issues in the discussions.

[Baroness Ludford]

I thank the Minister for his response. I was glad that he addressed the question of an adequacy assessment at the end of his remarks, but with respect, it is not enough—or adequate—to address an adequacy assessment only at the point of asking for it. We must lay the foundations now. I cannot see the point in storing up potential problems when we could solve the problem of the basis. We ought to do everything in that prism. We can have delightful legal discussions—it is important to get the law right—but this is also crucial to business. We have had so many representations on that point. I am sure that the Minister’s colleague, the Secretary of State for Digital, Culture, Media and Sport, is preoccupied with this question. Surely we need to front-load our response? We cannot wait until the UK applies for an adequacy assessment to be told, “Well, it’s a pity that you didn’t enshrine the principles and the essence of article 8 of the charter”. We have a chance to do that now and ensure a solid platform for requesting an adequacy assessment. I admit that I am puzzled as to why the Government would not want to do that; it is important for law enforcement as well. Why would we not want to solve that problem now, instead of finding later that we have entirely predictable problems as a result of not doing so?

[Lord Ashton of Hyde]

I completely agree with the noble Baroness. We have applied the GDPR principles to areas such as defence, national security and the intelligence services in different parts of the Bill so that when we seek an adequacy arrangement, we can say to the EU that we have arranged a comprehensive data protection regime that takes all the GDPR principles into account, including areas that are not subject to EU law. That is why, contrary to what we said in Committee, we have taken the arguments on board and tabled government Amendment 1 to provide reassurance on that exact point. We originally said that the rights under article 8 were contained in the Bill, but we are now putting further reassurance in the Bill. Other areas of the Bill, without direct effect, signpost how the Bill should be regarded.

The noble Baroness supports the amendment but would like, I think, to create a free-standing right. I have explained why we do not agree with that. Before Third Reading, we will try to seek a form of words in our amendment that provides more reassurance, so that when it comes to seeking an adequacy decision—we cannot do that until we leave the EU—there will be no doubt about what this regime provides. That would be the best way to do it, I think.

[Lord Pannick]

Does the Minister also agree that a further answer to the points made by the noble Lord, Lord Faulks, and the noble and learned Lord, Lord Mackay of Clashfern, is that it is absolutely inevitable that the detailed provisions of the Bill will be, on occasion, the subject of dispute, uncertainty and litigation, and that it would be very helpful to have a statement of principle on what is intended at the commencement of the Bill? This would not be the first time that a Bill has done that. Everybody would then know what the principles were. Of course, the Minister still needs to consider before Third Reading what that statement should be, but that is the point, as I understand it, of government Amendment 1.

[Lord McNally]

Why does the Minister feel it so necessary to push ahead with his amendment when it is quite clear that the best and most constructive way forward would be for both amendments not to be pressed to allow constructive discussion and resolution at Third Reading?

[Lord Ashton of Hyde]

Government Amendment 1 provides a basis for the discussion that we will have before Third Reading. Of course, I accept that it could be amended at that stage.

As for the remarks of the noble Lord, Lord Pannick, I will have to read my noble friend Lord Faulks’s words. I was not entirely sure that he was as supportive as the noble Lord feels, but I may have misinterpreted him.

[Lord Faulks]

My Lords—

[Lord Pannick]

As I understand them, both the noble Lord, Lord Faulks, and the noble and learned Lord, Lord Mackay, doubt the need for any amendments of this sort. I am suggesting to the Minister that there is a real need for a statement of principle—that is all.

[Lord Ashton of Hyde]

I thank the noble Lord. As I said in Committee, we too saw no need for this. The Government have moved because they are always listening and we hope that we can make this more acceptable. I will read what was said by the noble Lords, Lord Pannick and Lord McNally, and my noble friend Lord Faulks, but I would like to press my amendment so that we might have it as a basis for further discussion before Third Reading.

[Lord Stevenson of Balmacara]

My Lords, the Minister has received quite a lot of comment from around the Chamber on this and I made it clear in my opening remarks that I though the best solution was to have neither amendment. If we are to have a genuine discussion, it does not seem helpful to have in the Bill the wording which the Minister has alighted on at this stage in his conversion. It would be much better to start with a blank sheet and try to work to a common solution. I beg him to reconsider his view and withdraw his amendment; I will not press mine. We could then move to Third Reading with a clean slate.

[Lord Ashton of Hyde]

My Lords, I understand what the noble Lord is saying. This amendment has been around the houses in government; it has had many people from many departments looking at it from top to bottom. The feeling of the Government at the moment is that it is better to have something on paper as a basis for discussion. I would like to press my amendment.

Data Protection Bill [HL]

Lord Ashton of Hyde Excerpts

Monday 11th December 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, we have had a good discussion this evening about topics raised in Committee, where the strength of feeling and expertise displayed was highly instrumental in persuading Ministers to think again about the approach they were taking towards the regulatory process for children’s data being transferred into the internet. It shows that well-argued cases can get through even the most impervious armour put on by Ministers when they start battling on their Bills. I am delighted to see it.

The noble Lord, Lord Clement-Jones, commented on Amendment 117, tabled by the noble Earl, Lord Clancarty. I wondered why that amendment had been included in the group because it seemed to point in a different direction. It deals with data collected and used by the Government, having cleared what would presumably be the highest standards of propriety in relation to it. However, the story that emerged, endorsed by the noble Lord, Lord Clement-Jones, is shocking and I hope that the Minister will be able to help us chart a path through this issue. Several things seem to be going wrong. The issues were raised by my noble friend Lord Knight in Committee, but this amendment and the paperwork supplied with it give me a chill. The logic behind the amendment’s being in this group is that this is the end-product of the collection of children’s data—admittedly by others who are providing it for them in this case—and it shows the kinds of dangers that are about. I hope that point will be answered well by the Minister when he comes to respond.

I turn to the substantive amendment; it is an honour to have been invited to sign up to it. I have watched with admiration—as have many others—the skilful way in which the noble Baronesses, Lady Kidron and Lady Harding, and others have put together a case, then an argument and then evidence that has persuaded all of us that something can be done, should be done and now will be done to make sure that our children and grandchildren will have a safe environment in which they can explore and learn from the internet.

When historic moments such as this come along you do not often notice them. However, tonight we are laying down a complete change in the way in which individuals relate to the services that have now been provided on such a huge scale, as has been described. I welcome that—it is an important point—and we want to use it, savour it and build on it as we go forward.

I first sensed that we were on the right path here when I addressed an industry group of data-processing professionals recently. Although I wowed them with my knowledge of the automatic processing of data and biometric arguments—I even strayed into de-anonymisation, and got the word right as I spoke in my cups—they did not want anything to do with that: they only wanted to talk about what we were going to do to support the noble Baroness, Lady Kidron, and her amendments. When the operators in industry are picking up these debates and realising that this is something that they had always really wanted but did not know how to do—and now it is happening and they are supporting it all they can—we are in the right place.

The noble Baroness, Lady Harding, said something interesting about it being quite clear now that self-regulation does not work—she obviously has not read Adam Smith recently; I could have told her that she might have picked that up from earlier studies. She also said, to redeem herself, that good regulation has a chance to change behaviour and to inculcate a self-regulatory approach, where those who are regulated recognise the strength of the regulations coming forward and then use it to develop a proper approach to the issue and more. In that sense she is incredibly up to date. Your Lordships’ House discussed this only last week in a debate promoted by the noble Baroness, Lady Neville-Rolfe, on what good regulation meant and how it could be applied. We on these Benches are on all fours with her on this. It is exactly the way to go. Regulation for regulation’s sake does not work. Stripping away regulation because you think it is red tape does not work. Good regulation or even better regulation works, and that is where we want to go.

There are only three points I want to pick out of the contribution made by the noble Baroness, Lady Kidron, when she introduced the amendment. First, it is good that the problem we saw at the start of the process about how we were going to get this code applied to all children has been dealt with by the Government in taking on the amendment and bringing it back in a different way. As the noble Baroness admits, their knowledge and insight was instrumental in getting this in the Bill. I think that answers some of the questions that the noble Baroness, Lady Howe, was correctly asking. How do the recommendations and the derogation in the Bill reducing the age from 16 to 13 work in relation to the child? They do so because the amendment is framed in such a way that all children, however they access the internet, will be caught by it, and that is terrific.

The second point I want to make picks up on a concern also raised by the noble Baroness, Lady Harding. While we are probably not going to get a timescale today, the Bill sets a good end-stop for when the code is going to be implemented. However, one hopes that when the Minister comes to respond, he will be able to give us a little more hope than having to wait for 18 months. The amendment does say,

“as soon as reasonably practicable”,

but that is usually code for “not quite soon”. I hope that we will not have to wait too long for the code because it is really important. The noble Baroness, Lady Harding, pointed out that if the message goes out clearly and the descriptions of what we intend to do are right, the industry will want to move before then anyway.

Thirdly, I turn to the important question of how the code will be put into force in such a way that it makes sure that those who do not follow it will be at risk. Yes, there will be fines, and I hope that the Minister is able to confirm what the noble Baroness asked him when introducing her amendment. I would also like to pick up the point about the need to ensure that we encourage the Government to think again about the derogation of article 82. I notice in a document recently distributed by the Information Commissioner that she is concerned about this, particularly in relation to vulnerable people and children, who might not be expected to know whether and how they can exercise their rights under data protection law. It is clear that very young people will not be able to do that. If they cannot or do not understand the situation they are in, how is enforcement going to take place? Surely the right thing to do is to make sure that the bodies which have been working with the noble Baroness, Lady Kidron, which know and understand the issues at stake here, are able to raise what are known as super complaint-type procedures on behalf of the many children to whom damage might be being done but who do not have a way of exercising their rights.

If we can have a response to that when we come to it later in the Bill, and in the interim get answers to some of the questions I have set out, we will be at the historic moment of being able to bless on its way a fantastic approach to how those who are the most vulnerable but who often get so much out of the internet can be protected. I am delighted to be able to support the amendment.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, first, like other noble Lords, I pay tribute to the noble Baroness, Lady Kidron, for her months—indeed, years—of work to ensure that the rights and safety of children are protected online. I commend her efforts to ensure that the Bill properly secures those rights. She has convinced us that it is absolutely right that children deserve their own protections in the Bill. The Government agree that these amendments do just that for the processing of a child’s personal data.

Amendment 109 would require the Information Commissioner to produce a code of practice on age-appropriate design of online services. The code will carry the force of statutory guidance and set out the standards expected of data controllers to comply with the principles and obligations on data processors as set out by the GDPR and the Bill. I am happy to undertake that the Secretary of State will work in close consultation with the Information Commissioner and the noble Baroness, Lady Kidron, to ensure that this code is robust, practical and, most importantly, meets the development needs of children in relation to the gathering, sharing, storing and commoditising of their data. I have also taken on board the recommendations of the noble Lord, Lord Clement-Jones, on the internet safety strategy. We have work to do on that and I will take his views back to the department.

The Government will support the code by providing the Information Commissioner with a list of minimum standards to be taken into account when designing it. These are similar to the standards proposed by the noble Baroness in Committee. They include default privacy settings, data minimisation standards, the presentation and language of terms and conditions and privacy notices, uses of geolocation technology, automated and semi-automated profiling, transparency of paid-for activity such as product placement and marketing, the sharing and resale of data, the strategies used to encourage extended user engagement, user reporting and resolution processes and systems, the ability to understand and activate a child’s right to erasure, rectification and restriction, the ability to access advice from independent, specialist advocates on all data rights, and any other aspect of design that the commissioner considers relevant.

--- Later in debate ---

I am sorry. I am just finding the right place in my notes.

[Lord Ashton of Hyde]

Keep going.

[Lord Clement-Jones]

I may have to add later to what I have said, which I think the Minister will find totally unpalatable. I will try to move on.

The Minister also said:

“You are concerned that if consent is not a genuine option in these situations and there are no specific processing conditions in the Bill to cover this on grounds of substantial public interest. Processing in these circumstances would be unlawful. To make their consent GDPR compliant, an employer or school must provide a reasonable alternative that achieves the same ends, for example, offering ‘manual’ entry by way of a reception desk”.


Consent is rarely valid in an employment context. If an employer believes that certain premises require higher levels of security, and that biometric access controls are a necessary and proportionate solution, it cannot be optional with alternative mechanisms that are less secure, as that undermines the security reasons for needing the higher levels of security in the first place: for example, where an employer secures a specific office or where the staff are working on highly sensitive or confidential matters, or where the employer secures a specific room in an office, such as a server room, where only a small number of people can have access and the access needs to be more secure.

Biometrics are unique to each person. A pass card can easily be lost or passed to someone else. It is not feasible or practical to insist that organisations employ extra staff for each secure office or secure room to act as security guards to manually let people in.

The Minister further stated:

“You also queried whether researchers involved in improving the reliability or ID verification mechanisms would be permitted to carry on their work under the GDPR and the Bill. Article 89(1) of the GDPR provides that processing of special categories of data is permitted for scientific research purposes, providing that appropriate technical and organisational safeguards are put in place to keep the data safe. Article 89(1) is supplemented by the safeguards of clause 18 of the Bill. For the purposes of GDPR, ‘scientific research’ has a broad meaning. When taken together with the obvious possibility of consent-based research, we are confident that the Bill allows for the general type of testing you have described”.


It is good to hear that the Government interpret the research provisions as being broad enough to accommodate the research and development described. However, for organisations to use these provisions with confidence, they need to know whether the ICO and courts will take the same broad view.

There are other amendments which would broaden the understanding of the research definition, which no doubt the Minister will speak to and which the Government could support to leave no room for doubt for organisations. However, it is inaccurate to assume that all R&D will be consent based; in fact, very little of it will be. Given the need for consent to be a genuine choice to be valid, organisations can rarely rely on this as they need a minimum amount of reliable data for R&D that presents a representative sample for whatever they are doing. That is undermined by allowing individuals to opt in and out whenever they choose. In particular, for machine learning and AI, there is a danger of discrimination and bias if R&D has incomplete datasets and data that does not accurately represent the population. There have already been cases of poor facial recognition programmes in other parts of the world that do not recognise certain races because the input data did not contain sufficient samples of that particular ethnicity with which to train the model.

This is even more the case where the biometric data for research and development is for the purpose of improving systems to improve security. Those employing security and fraud prevention measures have constantly to evaluate and improve their systems to stay one step ahead of those with malicious intent. The data required for this needs to be guaranteed and not left to chance by allowing individuals to choose. The research and development to improve the system is an integral aspect of providing the system in the first place.

I hope that the Minister recognises some of those statements that he made in his letter and will be able, at least to some degree, to respond to the points that I have made. There has been some toing and froing, so I think that he is pretty well aware of the points being raised. Even if he cannot accept these amendments, I hope that he can at least indicate that biometrics is the subject of live attention within his department and that work will be ongoing to find a solution to some of the issues that I have raised. I beg to move.

[Baroness Hamwee (LD)]

My Lords, I wonder whether I might use this opportunity to ask a very short question regarding the definition of biometric data and, in doing so, support my noble friend. The definition in Clause 188 is the same as in the GDPR and includes reference to “behavioural characteristics”. It states that,

“‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data”.

Well:

“There’s no art


To find the mind’s construction in the face”.

How do behavioural characteristics work in this context? The Minister may not want to reply to that now, but I would be grateful for an answer at some point.

[Lord Ashton of Hyde]

My Lords, I thank the noble Lord, Lord Clement-Jones, for engaging constructively on this subject since we discussed it in Committee. I know that he is keen for data controllers to have clarity on the circumstances in which the processing of biometric data would be lawful. I recognise that the points he makes are of the moment: my department is aware of these issues and will keep an eye on them, even though we do not want to accept his amendments today.

To reiterate some of the points I made in my letter so generously quoted by the noble Lord, the GDPR regards biometric data as a “special category” of data due to its sensitivity. In order to process such data, a data controller must satisfy a processing condition in Article 9 of the GDPR. The most straightforward route to ensure that processing of such data is lawful is to seek the explicit consent of the data subject. However, the GDPR acknowledges that there might be occasions where consent is not possible. Schedule 1 to the Bill makes provision for a range of issues of substantial public interest: for example, paragraph 8, which permits processing such as the prevention or detection of an unlawful act. My letter to noble Lords following day two in Committee went into more detail on this point.

The noble Lord covered much of what I am going to say about businesses such as banks making use of biometric identification verification mechanisms. Generally speaking, such mechanisms are offered as an alternative to more conventional forms of access, such as use of passwords, and service providers should have no difficulty in seeking the data subject’s free and informed consent, but I take the point that obtaining proper, GDPR-compliant consent is more difficult when, for example, the controller is the data subject’s employer. I have considered this issue carefully following our discussion in Committee, but I remain of the view that there is not yet a compelling case to add new exemptions for controllers who wish to process sensitive biometric data without the consent of data subjects. The Bill and the GDPR make consent pre-eminent wherever possible. If that means employers who wish to install biometric systems have to ensure that they also offer a reasonable alternative to those who do not want their biometric data to be held on file, then so be it.

There is legislative precedent for this principle. Section 26 of the Protection of Freedoms Act 2012 requires state schools to seek parental consent before processing biometric data and to provide a reasonable alternative mechanism if consent is not given or is withdrawn. I might refer the noble Lord to any number of speeches given by members of his own party—the noble Baroness, Lady Hamwee, for example—on the importance of those provisions. After all, imposing a legislative requirement for consent was a 2010 Liberal Democrat manifesto commitment. The GDPR merely extends that principle to bodies other than schools. The noble Lord might respond that his amendment’s proposed subsection (1) is intended to permit processing only in a tight set of circumstances where processing of biometric data is undertaken out of necessity. To which I would ask: when is it genuinely necessary to secure premises or authenticate individuals using biometrics, rather than just cheaper or more convenient?

We also have very significant concerns with the noble Lord’s subsections (4) and (5), which seek to drive a coach and horses through fundamental provisions of the GDPR—purpose limitation and storage limitation, in particular. The GDPR does not in fact allow member states to derogate from article 5(1)(e), so subsection (5) would represent a clear breach of European law.

For completeness, I should also mention concerns raised about whether researchers involved in improving the reliability of ID verification mechanisms would be permitted to carry on their work under the GDPR and the Bill. I reassure noble Lords, as I did in Committee, that article 89(1) of the GDPR provides that processing of special categories of data is permitted for scientific research purposes, providing appropriate technical and organisational safeguards are put in place to keep the data safe. Article 89(1) is supplemented by the safeguards in Clause 18 of the Bill. Whatever your opinion of recitals and their ultimate resting place, recital 159 is clear that the term “scientific research” should be interpreted,

“in a broad manner including for example technological development and demonstration”.

This is a fast-moving area where the use of such technology is likely to increase over the next few years, so I take the point of the noble Lord, Lord Clement-Jones, that this is an area that needs to be watched. That is partly why Clause 9(6) provides a delegated power to add further processing conditions in the substantial public interest if new technologies, or applications of existing technologies, emerge. That would allow us to make any changes that are needed in the future, following further consultation with the parties that are likely to be affected by the proposals, both data controllers and, importantly, data subjects whose sensitive personal data is at stake. For those reasons, I hope the noble Lord is persuaded that there are good reasons for not proceeding with his amendment at the moment.

The noble Baroness, Lady Hamwee, asked about behavioural issues. I had hoped that I might get some inspiration, but I fear I have not, so I will get back to her and explain all about behavioural characteristics.

[Lord Clement-Jones]

My Lords, I realise that, ahead of the dinner break business, the House is agog at details of the Data Protection Bill, so I will not prolong the matter. The Minister said that things are fast-moving, but I do not think the Government are moving at the pace of the slowest in the convoy on this issue. We are already here. The Minister says it is right that we should have alternatives, but for a lab that wants facial recognition techniques, having alternatives is just not practical. The Government are going to have to rethink this, particularly in the employment area. As more and more banks require it as part of their identification techniques, it will become of great importance.

We are just around the corner from these things, so I urge the Minister, during the passage of the Bill, to look again at whether there are at least some obvious issues that could be dealt with. I accept that some areas may be equivocal at this point, only we are not really talking about the future but the present. I understand what the Minister says and I will read his remarks very carefully, as no doubt will the industry that increasingly uses and wants to use biometrics. In the meantime, I beg leave to withdraw the amendment.

Data Protection Bill [HL]

Lord Ashton of Hyde Excerpts

Report stage (Hansard - continued): House of Lords
Monday 11th December 2017 Lords Chamber

Moved by

[Lord Ashton of Hyde]

11: Schedule 1, page 114, line 9, leave out from “rights” to “, and” in line 11 and insert “which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection”

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, in Committee the noble Earl, Lord Kinnoull—I am very grateful to him for his help and that of the industry bodies that I have now met—told us that the language in the Bill enabling the processing of sensitive data relating to employment might be interpreted more narrowly than the similar wording in paragraph 2 of Schedule 3 to the Data Protection Act 1998. This was never the Government’s intention and I thank the noble Earl and the noble Lord, Lord Clement-Jones, for bringing the issue to the Government’s attention. Amendments 11 and 12 to address these concerns by reverting to the wording used in the 1998 Act, thereby removing any doubts as to their proper interpretation. I will sit down and wait for the noble Earl to propose his amendments and reply to them after. I beg to move.

[The Earl of Kinnoull (CB)]

My Lords, I am very grateful to the Minister for that news on those government amendments. It is very helpful and will prevent a lot of insurers having to redo their administrative systems. I shall speak to Amendments 25 and 26, which are another pair of insurance amendments. I declare my interests as set out in the register of the House, particular those in respect of the insurance industry.

I thank the noble Lord, Lord Clement-Jones, who has been very helpful. He brings great clarity at all times of day to our discussions. Although he is the chairman of the Artificial Intelligence Select Committee, his intelligence is far from artificial and is most helpful. Also, I see the Bill team over there. They have been excellent. Given the amount of fire coming in they are very calm, collected and user-friendly. I thank them for everything they have done so far on the Bill.

The Lloyd’s Market Association, the British Insurance Brokers’ Association and the Association of British Insurers, among other insurance associations, have helped in the preparation of some of these remarks. The insurance industry is trying to deliver products in the public interest. Indeed, some major classes of insurance, such as motor insurance and employers’ liability insurance, are compulsory. There is a long list of other insurances that are quasi-compulsory. For instance, one cannot get a mortgage without buying household insurance. It is greatly to society’s benefit that a wide choice of good products is available at a reasonable price.

--- Later in debate ---

[Lord Kennedy of Southwark]

My Lords, I welcome government Amendments 11 and 12. As we have heard, they address some of the concerns that were raised in Committee. The Government have said that they never intended to have a narrow interpretation and they have put back the words of the 1998 Act, which is very welcome. As was said earlier, the noble Earl, Lord Kinnoull, has laid out in great detail the issues addressed in his Amendments 25 and 26. He makes a very important and clear case and raised some important issues. I hope that the noble Lord, Lord Ashton of Hyde, will respond to those. I certainly think that there is a case for bringing these things back at Third Reading to address the points the noble Earl has raised.

[Lord Ashton of Hyde]

My Lords, I am grateful to everyone who has spoken in this debate. As we have just heard, Amendment 25 would replace the existing processing conditions:

“Insurance and data concerning health of relatives of insured person”,


and:

“Third party data processing insurance policies and insurance on the life of another”,


with a broader insurance processing condition. Amendment 26 would require the Information Commissioner to produce sector-specific guidance for the insurance sector. These processing conditions are made under article 9(2)(g), the substantial public interest derogation. When setting out the grounds for such a derogation, the Government are limited by the need to meet this substantial public interest test. We are also required to provide appropriate safeguards for data subjects.

The Government recognise the importance of insurance products, in particular compulsory classes and the protection afforded by third-party liability. As the noble Earl mentioned, engagement between the insurance sector and government officials has continued since this matter was discussed in Committee and, indeed, since I met him and representatives of the insurance industry after Committee. There is still some work to do on the precise drafting of the relevant provisions, but I am grateful for the opportunity to place on record the Government’s intention to table an amendment addressing this issue at Third Reading, if we can finalise the drafting in time and the House is content for us to do so. At the moment I am not aware of any insuperable problems in that regard, but noble Lords will recognise that this is a complex issue and one that we want to get absolutely right.

As for the Information Commissioner producing sector-specific guidance, as proposed by Amendment 26, I will certainly take that back and pass it on to the department. With that reinsurance, or rather reassurance—“reinsurance” was a bit of a Freudian slip there—I respectfully invite the noble Earl not to move his amendments this evening. I beg to move.

Amendment 11 agreed.

Moved by

[Lord Ashton of Hyde]

12: Schedule 1, page 114, line 17, leave out ““social security law” includes the law relating to” and insert ““social security” includes”

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

18: Schedule 1, page 115, line 32, at end insert “or rule of law”

--- Later in debate ---

[Lord Stevenson of Balmacara]

My Lords, I add my voice in support of the noble Baroness’s amendment and wish it well. I suspect she has run into the logjam that constitutes the waiting list to see the Bill team and the Ministers, who have been worked so hard in the last few months. But I hope it will be possible, given that there is a bit of time now before Third Reading, for this matter to be resolved quickly and expeditiously before then.

[Lord Ashton of Hyde]

My noble friend Lady Neville-Jones explained in Committee that Unique plays a hugely important role in providing advice and support to sufferers of rare chromosomal disorders and their carers. Some of these charities have large databases dating back many years, so we understand their desire to maintain these when the GDPR comes into force without necessarily obtaining fresh consent to GDPR standards for each data subject included on the database. When families are providing support to their loved ones, some of whom may need round-the-clock care, filling in a new consent form may not be high on their agenda.

However, they may still value the support and services that patient support groups provide and would be concerned if they were removed from the charities’ databases. If charities such as Unique had to stop processing or delete records because consent could not be obtained, they worry that this would impede the work they do to put patients and their families in touch with others suffering from rare genetic conditions, help clinicians to deliver diagnoses and facilitate research projects. We recognise that this could be particularly damaging when there is barely any knowledge of the condition other than what they may hold on their database.

Let me be clear: if there is a grey area in the Bill that puts this work at risk, the Government are fully prepared to amend it. Legislating in this area is not straightforward and I am keen that the policy and legal teams in the department are able to continue with the constructive discussions they have been having with Unique and the UK Genetic Alliance to ensure that the legislation adequately covers the specific processing activities they are concerned about, while providing adequate safeguards for data subjects. I assure noble Lords that we will use our best endeavours to work on this legislative solution as quickly as possible. If it is not ready by Third Reading, and I am afraid I cannot promise it will be, the Government will endeavour to introduce any necessary provisions at the next possible amending stage of the Bill. I will of course ensure that my noble friend gets the credit she deserves for her persistent efforts on this subject when that time comes.

Government Amendments 72 to 77 are the products of detailed discussion with the noble Lord, Lord Patel, the noble Baroness, Lady Manningham-Buller, and representatives of the Wellcome Trust. I thank them very much for those constructive and helpful discussions. In Committee we discussed the operation of the safeguards in Clause 18 and the potentially damaging impact they would have on pioneering medical research. As I explained at the time, it was never the Government’s intention to undermine such important work, so it is with great pleasure that I table these amendments today.

Noble Lords will recall that the greatest concern stemmed from the safeguard in what is currently Clause 18(2)(a). That paragraph was designed to prevent researchers using personal data to make measures and decisions in respect of particular data subjects but, as the noble Lord explained, there are certain types of medical research where this is inevitable. In the context of a clinical trial, for example, a data subject might willingly agree to participate, but in the course of the trial researchers might need to make decisions about whether the treatment should continue or stop, with respect to some or all data subjects. Government Amendment 77 addresses this concern by making it clear that the safeguard is automatically met where processing is necessary for the purposes of approved medical research. Approved medical research is defined in the new clause and includes, for example, research approved by an ethics committee established by the Health Research Authority or relevant NHS body. Importantly, the new clause also contains an order-making power so that the definition of approved research can be kept up to date.

--- Later in debate ---

[Baroness Hamwee]

My Lords, I am very glad that the noble Lord is keeping this on the agenda. I had a note to ask what was happening about the meeting to which lots of people were invited at the previous stage. I do not believe that we have heard anything about it. This is not a whinge but a suggestion that it is important to discuss this very widely.

I find this paragraph in Schedule 1 very difficult. One of the criteria is that the processing is necessary for the purposes of political activities. I honestly find that really hard to understand. Necessary clearly means more than desirable, but you can campaign, which is one of the activities, without processing personal data. What does this mean in practice? I have a list of questions, by no means exhaustive, one of which comes from outside, asking what is meant by political opinion. That is not voting intention. Political opinion could mean a number of things across quite a wide spectrum. We heard at the previous stage that the Electoral Commission had not been involved in this, and a number of noble Lords urged that it should be. It did not respond when asked initially, but that does not mean it should be kept out of the picture altogether. After all, it will have to respond to quite a lot of what goes on. It might not be completely its bag, but it is certainly not a long way from it.

We support pinning down the detail of this. I do not actually agree with the noble Lord’s amendment as drafted, but I thank him for finding a mechanism to raise the issue again.

[Lord Ashton of Hyde]

I am grateful to the noble Lord, Lord Kennedy, for raising this issue, and to the noble Baroness for her comments. These issues are vital to our system of government, and we agree with that.

Amendment 27 seeks to expand the umbrella term “political activities” to include any additional activities determined to be appropriate by the Electoral Commission. Noble Lords will agree that engaging and interacting with the electorate is crucial in a democratic society, and we must therefore ensure that all activity to facilitate this is done in a lawful manner. Although paragraph 18(4) includes campaigning, fundraising, political surveys and case work as illustrative examples of political activities, it should not be taken to represent an exhaustive list.

Noble Lords will be aware that the Electoral Commission’s main areas of expertise concern the regulation of political funding and spending, and we are of the opinion that much, if not all the activities they regulate will be captured under the heading “political activity”. As I have just set out, fundraising is included as an illustrative example, which ought to provide some reassurance on this point. Moreover, the greater the number of activities denoted by the Electoral Commission, the less likely it is that any other activity would be considered by a court to be a political activity by dint of its omission. The commission, a body which as far as I am aware claims no expertise in data protection matters, would find itself in an endless spiral of denoting new activities as being permissible under the GDPR. Nevertheless, in recognition of the importance of such processing to the democratic process, the Government are continuing to consider the broader issues at stake and may well return to them in the second House. In this vein, the noble Lord made a number of good points, and I look forward to meeting him with the Minister for Digital, my right honourable friend Matt Hancock, on Thursday this week to discuss the matter in more detail than the parameters of this debate allow. We will see what the noble Lord feels about the timing of that after the meeting.

As for the noble Baroness, Lady Hamwee, we talked about having bigger meetings, and I am sure the time will come. This is just a preliminary meeting to decide on timings and to give the noble Lord, Lord Kennedy, the chance to discuss this with the Minister for Digital. I envisage that further meetings will include the noble Baroness.

I appreciate the sentiment behind the noble Lord’s amendment. In the light of our forthcoming discussions, I hope he feels able to withdraw it.

[Lord Kennedy of Southwark]

I thank the Minister for his response. I tabled the amendment to keep the issue live and to illustrate the problem we have here. In his response, he talked about the responsibilities of the commission and data protection responsibilities and how they may conflict, belonging to different bodies. That begins to highlight the problem that we potentially have here. You could have different regulators trying to enforce different bits of legislation, all on the statute book at the same time and equally legitimate. We have got a real problem here.

I look forward to the meeting on Thursday. It is very important that we have a meeting after that, though, with a much wider group of people from different parties and campaigns. It is a genuine problem that affects every political party represented in this House and the other place and those that are not in either House. There is no advantage here—it is a question of getting a procedure in place that allows political parties to campaign and do their job properly and fairly. Equally, it protects the volunteers so that they understand what they can and cannot do so that they do not unintentionally get themselves in difficulty. I look forward to the meeting, but there are one or two things to sort out before then. I hope that it can get done by Thursday but, if it cannot, we have the other place. But it would be much better to sort it out at this end rather than the other end. I beg leave to withdraw the amendment.

--- Later in debate ---

Moved by

[Lord Ashton of Hyde]

30: Schedule 1, page 124, line 1, at end insert “or tribunal”

Youth Orchestras

Lord Ashton of Hyde Excerpts

Thursday 7th December 2017 Lords Chamber

[Lord Storey (LD)]

My Lords, on behalf of my noble friend Lady Bonham-Carter of Yarnbury, and at her request, I beg leave to ask the Question standing in her name on the Order Paper.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, the Government support a number of national young music organisations, including the national youth music orchestra, with over £1 million of public funding a year confirmed until 2020. These organisations undertook at least 125 performances across the country in 2016-17. The Government remain committed to supporting our orchestras and classical music organisations across the country and at all scales. Music, as well as art and design, is a compulsory subject in the national curriculum for five to 14 year-olds.

[Lord Storey]

I thank the Minister for his reply and the importance the Government attach to these orchestras. Will the Minister give the House an assurance that, if we were to leave the EU, the finance given to youth orchestras and to other cultural institutions, for example for touring, will continue?

[Lord Ashton of Hyde]

I can confirm that, when we leave the EU, the existing amounts that we spend on British youth orchestras will continue. For example, the total Arts Council investment, which includes music, has been guaranteed until 2020.

[Lord Howell of Guildford (Con)]

My Lords, one answer to the noble Baroness’s concern is the Commonwealth Youth Orchestra, which I think the Government currently support, and I hope they will continue to do so strongly.

[Lord Ashton of Hyde]

I agree with my noble friend.

[Baroness McIntosh of Hudnall (Lab)]

I am sure the Minister is aware that youth orchestras in this country, and indeed elsewhere, perform to an extremely high standard, and that the young people who participate put in hours and hours of work although not all—fewer than half of them—actually anticipate having a career as a professional musician. What we need in order to keep those standards up is a good supply of young people who have the skills to take part. What proportion of children and young people in the maintained sector have affordable access to music tuition for long enough to bed in the skills that they need to perform to that standard?

[Lord Ashton of Hyde]

I cannot give exactly the proportions that the noble Baroness has asked for. I can say that we have music education hubs, which were established after the Henley review into music education in 2011. There are 120 music education hubs in place, and they are funded by the Department for Education and overseen by Arts Council England. They create joined-up, high-quality music opportunities for all children and young people in and out of school, and the Government spend £75 million a year on this.

[Baroness Finlay of Llandaff (CB)]

My Lords, I declare my interest as patron of the South Glamorgan Youth Orchestra, now the Cardiff County and Vale of Glamorgan Youth Orchestra. Do the Government recognise the importance of music in intellectual development, with a crossover into the sciences and mathematical skills, and therefore that it is very important to have feeder orchestras from junior schools, school transition and so on finally feeding into youth orchestras? Some children do not achieve that but they achieve the intellectual development necessary to underpin our national development of skills.

[Lord Ashton of Hyde]

I agree with the noble Baroness. I think we realise that music has particular relevance to mathematics and science. That is why music is a compulsory subject in the national curriculum and why we continue to invest in music in our schools.

[Baroness Smith of Basildon (Lab)]

My Lords, this takes me back to my trumpet-playing days at school, which I will not inflict on your Lordships’ House. The Minister has heard from across the House great pride in our youth orchestras. Not only is our cultural and social life enriched by them but the economic life of the country gains. I have heard the Minister talk about the funding for youth orchestras, but do the notes in his folder tell him that since 2010 this Government have taken £48 million away from the arts councils that support them? I accept that he understands the importance of this. Does he not therefore think it is time to ensure that every primary school in the country has money available so that they can enhance the cultural life of all pupils?

[Lord Ashton of Hyde]

I am tempted to bring my trumpet in to have a duet with the noble Baroness, but I am sure she is better at it than I am. I have said that we agree that art and music are important, which is why they are part of the national curriculum. Arts Council England has increased funding for music since 2014-15, so in the difficult choices that have had to be made we think we have sustained our support for the arts. We recognise that the arts, including music, are important as part of an overall education.

[Lord Lexden (Con)]

What reassurance can the Government offer the National Youth String Orchestra, of which I am patron, whose concerns over things like insurance cover and the movement of musical instruments across borders after Brexit have led it to consider abandoning its customary European tours?

[Lord Ashton of Hyde]

I think the orchestra should check with its insurance broker because I am not sure whether that is a critical factor for travelling orchestras. Much more important is the visa requirements that will be needed after Brexit, and we are working hard with the Home Office to ensure that they are acceptable. The other measure that we are taking is the orchestra tax relief, which allows orchestras to travel.

[The Earl of Clancarty (CB)]

My Lords, is the Minister concerned at the continuing fall in income from the National Lottery—the lottery benefiting youth orchestras alongside other areas of the art—and, if so, what measures might be taken to reverse this trend?

[Lord Ashton of Hyde]

The noble Earl is a doughty champion of the arts, for which I pay tribute to him. Of course we are concerned that lottery receipts are reducing. I believe work is under way to look at that. I do not have the information to hand but the Minister responsible in my department is looking at it very closely.

Video Games: Domestic Violence and Child Abuse

Lord Ashton of Hyde Excerpts

Wednesday 6th December 2017 Lords Chamber

[Lord Storey]

To ask Her Majesty’s Government what action they are taking to restrict the sale of video games featuring domestic violence and child abuse.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, under the Video Recordings Act, games on physical media are referred to the Video Standards Council for classification if they contain content unsuitable for children. Anyone supplying a game rated 12, 16 or 18 under the Pan-European Game Information age-rating system to someone below the appropriate age risks a fine or jail sentence. The Video Standards Council can refuse to certify a game containing material that is illegal or that it considers would cause harm to players.

[Lord Storey (LD)]

I thank the Minister for his reply. I am sure that he would agree with Andy Burrows from the NSPCC, who said:

“Any video game that trivialises or normalises child abuse, neglect or domestic violence for entertainment is unacceptable”.


The Video Standards Council, which took over from the British Board of Film Classification, is more like a trade organisation than a regulatory body and uses a very light-touch approach to classifying video games, which does not meet the concerns of parents. In fact, none has been made unavailable or removed from the shelves. Will he consider strengthening how we deal with young people—children—and video games?

[Lord Ashton of Hyde]

The noble Lord is absolutely correct to say that, at the moment, the council has not effectively banned any video game, but its members are the professionals, set up to do the job under the Act. They were the people who Parliament decided were correct to do this and have access to expert advice, including psychologists and legal advice. The video games industry knows that the council can effectively ban a video game if it is unsuitable. However, I take the point that these things need looking at occasionally, and part of the internet safety strategy deals directly with video games. We are asking questions about that to see whether anything further needs to be done.

[Lord Laming (CB)]

Does the Minister agree that we should never allow anything to give the impression that either domestic violence or the abuse of children is normal or acceptable behaviour? This issue needs to be taken very seriously indeed.

[Lord Ashton of Hyde]

I do agree, as any sensible and rational person would. That is why we are looking at child safety in the round, particularly online, which is the new area, and will consider further things that need to be done.

[Baroness Howe of Idlicote (CB)]

My Lords, does the Minister agree that because of amendments introduced in your Lordships’ House to the Digital Economy Bill in March, it will now be perfectly possible for adults using the internet to access very realistic animated computer-generated images of child sex abuse and pornographic violence against women? Does he further agree that it was a terrible mistake to introduce this different enforcement standard online from that which applies offline, and will he undertake to introduce urgent legislation to address this error?

[Lord Ashton of Hyde]

I took the Digital Economy Bill through this House so I cannot agree with the first part of the noble Baroness’s question. These things that are beyond the pale in many ways were available on the internet before and have nothing to do with what is now the Digital Economy Act. We are looking at ways to make this country the best place to be safe online and we will continue to do that.

[Lord Cormack (Con)]

My Lords, why is there any equivocation here? Cannot my noble friend accept that the logical consequence of what every noble Lord has said this afternoon—and what he himself has said—is that these things should be banned, full stop?

[Lord Ashton of Hyde]

That is why we set up an independent body. That is better than giving me or any other Minister the power of censorship over these things.

[Baroness Smith of Basildon (Lab)]

My Lords, I think the noble Lord is really missing the point here. He says there is an independent body set up to do this, but the fact is that it is not doing it. It is all very well having a body to do it, and having rules, regulations and legislation, but if they are not acted upon there is a serious problem. He has said several times that it needs looking at and that something needs to be done. May I press him to take this away and, on the specific issue of violence in video games, to come back to this House with a report of what can be done, and how the Government can take some responsibility for this and not leave it to an independent body that is clearly not doing its job?

[Lord Ashton of Hyde]

I do not agree with the noble Baroness and I see no evidence that this body is not doing its job. It classified the age for 146 out of 498 video games in 2016 as 18, meaning that only adults should be allowed to watch them and that it is a criminal offence to allow other people below that age to do so.

[Lord Paddick (LD)]

My Lords, does the Minister not agree that any depiction of child abuse is likely to normalise that behaviour, not just in the minds of children who are less likely to report it, but also in those of potential perpetrators? Does he not agree that if no video game has ever been banned, something really needs to be done about this so-called independent body that is supposed to be taking action?

--- Later in debate ---

[Lord Ashton of Hyde]

I agree that showing child abuse in a video game is likely to normalise it and I accept there is a difference between, for example, showing it in a play or a film, which does happen. But, set in the context, it might give the right message, depending on what the results are. The difference is that an adult of a particularly perverted nature can access a video game and choose to go down that path, so I do agree. However, I do not agree with the argument—I see no evidence—that because no game has been banned, the Video Standards Council is not doing a proper job. Its members are the experts—they have help from psychologists and they rate these video games according to that advice.

Communications Act 2003 and the Digital Economy Act 2017 (Consequential Amendments to Primary Legislation) Regulations 2017

Lord Ashton of Hyde Excerpts

Wednesday 6th December 2017 Grand Committee

Moved by

[Lord Ashton of Hyde]

That the Grand Committee do consider the Communications Act 2003 and the Digital Economy Act 2017 (Consequential Amendments to Primary Legislation) Regulations 2017.

[The Parliamentary Under-Secretary of State, Department for Digital, Culture, Media and Sport (Lord Ashton of Hyde) (Con)]

My Lords, I intend to be brief. Noble Lords will recall that the Digital Economy Act 2017 received Royal Assent in April this year. That Act included reforms to the Electronic Communications Code, which provides the statutory framework for agreements between site providers and digital communications network operators.

The purpose of the reforms is to make it easier and cheaper for digital communications infrastructure to be installed and maintained, ensuring that this statutory framework supports the wider benefits of the UK’s world-leading digital communications services. The reformed code is subject to commencement by a separate statutory instrument, which will not require parliamentary scrutiny. We expect to bring the code into force by the end of December. However, before taking this step, we need to ensure that a number of sets of supporting regulations are in place.

In addition to the regulations before the Committee today, the supporting measures include two sets of regulations that were laid on 19 October 2017 under the negative procedure, which amend secondary legislation and make specific transitional provisions. Together, the purpose of all these regulations is to ensure a smooth transition from the existing legislation to the new code. They will therefore take effect only when the new code commences, which, as I mentioned, we expect to be by the end of December.

The draft Communications Act 2003 and the Digital Economy Act 2017 (Consequential Amendments to Primary Legislation) Regulations 2017 amend references in other primary legislation to the existing code and to provisions in the existing code, replacing them with terminology and cross-referencing aligned to the new code.

The draft Electronic Communications Code (Jurisdiction) Regulations 2017 bring into effect one of the code’s key reforms: transferring the jurisdiction for code disputes from the county courts to the Lands Tribunal in England and Wales, and from the sheriff court to the Lands Tribunal in Scotland. This reform was strongly recommended by the Law Commission following its consultation on the code, and is expected to ensure that code disputes can be dealt with more quickly and efficiently. The DCMS has worked closely with colleagues in the Ministry of Justice, and their counterparts in Scotland, to prepare for this change. I beg to move.

[Lord Clement-Jones (LD)]

My Lords, the Minister has reminded us of our happy days during the passage of the Digital Economy Bill—now the Digital Economy Act. Of course, we all like to be reminded of our days in the salt mines. These regulations are straightforward and we welcome them. I certainly do not intend to raise again any issues relating to the Electronic Communications Code. Certainly, I would not want to provoke another speech from the noble Lord, Lord Grantchester; that would be very unwise.

However, I will make a couple of comments relating to the implementation of the code. As I understand it, Ofcom is issuing a code of practice on top of that. There is some concern that although the direction of travel of the ECC was very clear, the code of practice is in a sense bringing back a slight bias in favour of the landowners. That is a concern of some commentators. One says:

“While the consultation around the code of practice is to be welcomed, if implemented in its current form, the code of practice is in danger of swinging the pendulum back too far in favour of landowners who will be able to challenge operators at every stage”.


I know that the Government were very keen to get the balance right. It will be interesting to hear what the Minister has to say about that.

The Minister may want to write to me about this, but this is a useful opportunity to ask about the direction of government policy in terms of EU regulatory reforms—if we can bear it. It looks like there are plans from Brussels for a new Electronic Communications Code which includes e-privacy regulation. Obviously, before we exit—if we exit—it will continue to be important to keep the digital single market and the single telecoms market in place. The question arises: will there be time? Will the new Electronic Communications Code, however it is brought in—whether by directive or regulation, I am not quite sure—happen? Will it fall outside? Will it be after 29 March? Will it fall during a transition period? I suspect there are many in the telecoms field and the general area of technology infrastructure who will be extremely interested in the answer to that.

Those are the two areas on which I would very much like to have an answer from the Minister, either now or at some stage in the future.

--- Later in debate ---

[Lord Griffiths of Burry Port]

From the noble Lord’s tone of voice, I honestly thought that it was a sunnier experience than that. Between that and a hypothetical happy future, when other things may or may not happen, I will stick to what is in front of us.

It all seems logical to me. I guess the simplicity of the proposals led to this being referred to me, with my simple mind. I understand perfectly that with the developments in electronic communications we have to have methods appropriate for handling the expansions of systems across the land. I note that the speed and effectiveness of dispute resolution becomes a possible consequence of decisions taken. The balance to which the noble Lord, Lord Clement-Jones, referred is indeed mentioned in these documents and is being sought. I am in no position to judge whether the view expressed that suggested movement back towards landowners is true, but I am sure the Minister will answer that question.

There is a consultation. I note that there is to be no impact assessment because there is no impact, it seems. It is nice to have read that at least six times in these papers. I commend all those who have gone through all the legislation, both past legislation in general and localised legislation from across the land. It is a job for somebody and I pay tribute to the nameless people who have done this trawl. It even goes into the county of my birth—Dyfed in south Wales—where I was rather disturbed to find that “statutory undertakers” are now to be called “operators”. In my life’s work as a Methodist minister, I had rather a lot to do with statutory undertakers and I am sorry that they have been defined out of existence.

There is a logic running through this. It is simplicity itself. It tidies up what is in front of us. I have no hesitation in supporting these measures.

[Lord Ashton of Hyde]

My Lords, I am grateful for both noble Lords’ comments. On the question from the noble Lord, Lord Clement-Jones, on the code of practice, it is not yet published. Extensive consultation was carried out. It is a bit difficult to speculate on its content, but it is important to remember that the code of practice is not binding and cannot change the balance that the law delivers. We spent some time considering that balance. It is certainly true that one of the points of the code was that it should enable operators to do things that were taking too long. There is certainly no intention to change that balance. We absolutely understand the need for operators to access land more easily and more speedily, but preferably on a consensual basis. That was the whole object. These regulations are to do with the occasions, which we hope will not be very often, where agreement cannot be reached, so we can go to a tribunal that has expert surveyors and people like that on it, rather than the county court, which is not expert. I say to the noble Lord that we have no intention and there was no desire to change the balance between landowners and operators. We will have to see what the code of practice says. It is not binding, but if need be we can talk to him when it comes out. We expect to commence the code in December. Ofcom has assured us that the code will come out before it comes into force.

We do not know the timings for the European ECC. If it is acceptable to the Committee I will look at some of the questions the noble Lord asked and do some research into them. We might not know the answers. I do not have them to hand, but if we do know I will come back to the noble Lord.

I am pleased that the noble Lord, Lord Griffiths, was able to come in at the end of this long process. He had one of the more happy experiences. I am very grateful to him. With that, I beg to move.

Motion agreed.

Electronic Communications Code (Jurisdiction) Regulations 2017

Lord Ashton of Hyde Excerpts

Wednesday 6th December 2017 Grand Committee

Moved by

[Lord Ashton of Hyde]

That the Grand Committee do consider the Electronic Communications Code (Jurisdiction) Regulations 2017.

Motion agreed.

Data Protection Bill [HL]

Lord Ashton of Hyde Excerpts

Monday 4th December 2017 Lords Chamber

Moved by

[Lord Ashton of Hyde]

That the amendments for the Report stage be marshalled and considered in the following order:

Clauses 1 to 9, Schedule 1, Clauses 10 to 14, Schedules 2 to 4, Clauses 15 and 16, Schedule 5, Clauses 17 to 20, Schedule 6, Clauses 21 to 28, Schedule 7, Clauses 29 to 33, Schedule 8, Clauses 34 to 84, Schedules 9 and 10, Clauses 85 to 110, Schedule 11, Clauses 111 and 112, Schedule 12, Clauses 113 and 114, Schedule 13, Clauses 115 and 116, Schedule 14, Clauses 117 to 147, Schedule 15, Clause 148, Schedule 16, Clauses 149 to 171, Schedule 17, Clauses 172 to 194, Schedule 18, Clauses 195 to 198, Title.

Motion agreed.