Data Protection Bill [HL]

Debate between Lord Stevenson of Balmacara and Lord Paddick

3rd reading (Hansard): House of Lords & Report: 2nd sitting (Hansard): House of Lords
Wednesday 17th January 2018 Lords Chamber

[Lord Paddick (LD)]

My Lords, Clause 124(4)(b) refers to the United Nations Convention on the Rights of the Child, which defines a child as a person under the age of 18, so we can assume that that is the working principle. Clause 124, introduced at a previous stage by an amendment from the noble Baroness, Lady Kidron, talks about age-appropriate design, and so presumably that means appropriate at different ages—for example, safeguards for those aged 12 will be different from those for people aged 16 and 18. Bearing in mind the United Nations convention definition, will the Minister confirm that that is the working principle for this Bill?

[Lord Stevenson of Balmacara]

My Lords, I do not wish to detain the House. I thank the noble Baroness for raising the point; clarity is always important, as we have learned, and she is right to put her finger on it. However, the point made by the noble Lord, Lord Paddick, is correct.

We run the risk in this Bill of pouring fuel on an already raging fire: the more we try to focus on children as a group, the more we demonise and make difficult the Bill’s attempts—through an amendment we all supported on Report—to raise our sights and find a way of expressing how all people are dealt with in terms of internet access, with particular reference to those with developmental or other support needs to whom the word “child” could well be applied. But that does not mean that we want the more generic approach to fail because it did not mention vulnerable adults, the elderly who may be struggling with internet issues, those with special needs or others. These groups all need to be considered in the right way, and I am sure that, in time, “age appropriate” may not be the most appropriate way of dealing with it. It does get us to a particular point, however. It was a historic decision that we took on Report to do it this way, but we need to have an eye on the much wider case for a better understanding of under what conditions and with what impact those of us who wish to use the internet can do so safely and securely.

Data Protection Bill [HL]

Debate between Lord Stevenson of Balmacara and Lord Paddick

Report: 3rd sitting Hansard: House of Lords
Wednesday 10th January 2018 Lords Chamber

[Lord Paddick (LD)]

My Lords, we are very grateful to the Government for introducing Amendment 118. We still believe that they could and should have gone further. Taking the example of the Investigatory Powers Act 2016—the fact that Ministers are unable to authorise interception without oversight by an independent judicial commissioner of that decision—we wonder why that sort of oversight could not be applied to these certificates as well. Clearly, we are grateful to the Government for going as far as they have done. We are just disappointed that they did not go as far as we wanted.

[Lord Stevenson of Balmacara]

My Lords, my noble friend Lord Kennedy is not available at the moment. He is occupied with a personal matter and has asked me to say that he supports the words of the Minister. She has listened to concerns. It is very welcome that she has done so and we agree with the amendment.

Data Protection Bill [HL]

Debate between Lord Stevenson of Balmacara and Lord Paddick

Committee: 5th sitting (Hansard): House of Lords
Monday 20th November 2017 Lords Chamber

[Lord Paddick (LD)]

My Lords, I will speak to Amendment 153 in my name and that of my noble friend Lord Clement-Jones. Section 17(1) of the Data Protection Act 1998 states that personal data must not be processed unless an entry in respect of the data controller is included in the register maintained by the Information Commissioner. Effectively, processing personal data without registering and without paying a fee is, at the moment, a strict liability criminal offence. This ensures that all data controllers are aware of their most basic obligations and that a central register of who is processing personal data is maintained. It also provides a simple means of collecting notification fee income.

We have been made acutely aware during the debates on the passage of the Bill of the increased responsibilities that will be placed on the Information Commissioner and the need for her to have additional resources. This is one way of ensuring that she has those resources, provided she is able to keep the fees raised and does not have to hand over large amounts of those fees to the Treasury.

This is an important protection for data subjects, and the Government have asserted that they are strengthening the law to protect data subjects. If the requirement to register is removed, as will happen without this amendment, this will weaken those protections. In addition to protections provided by registration and the increased awareness of the other requirements around data protection as a result of registering, it allows for the Proceeds of Crime Act to be used to confiscate money generated by the unlawful processing of personal data by those who are not registered. This would be lost if this amendment is not adopted.

The amendment seeks to maintain the current position by requiring the Information Commissioner to register all data controllers. However, unlike the current requirement for more detailed information, the amendment requires that the data controller provides only the minimum of information—such as his name and address; if he has nominated a representative for the purposes of the Act, their name and address; and the principal activity or activities undertaken by the data controller.

The Minister may wish to pray in aid article 57(3) of the GDPR, which states:

“The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer”.


We argue that this is a notification fee, not a task performed by the Information Commissioner, and a fee that would be levied on the data controller and not the data protection officer. I beg to move.

[Lord Stevenson of Balmacara (Lab)]

My Lords, I shall speak to Amendment 153ZA in my name and that of my noble friend Lord Kennedy of Southwark. I support the amendment tabled by the noble Lords, Lord Clement-Jones and Lord Paddick, which is important. We look forward to hearing what the Minister says in response.

Our amendment is in two halves. The first probes the question of what happens in cases where the data controller relies on derogations or limitations provided for under the GDPR that have been brought, directly or indirectly, into UK law through the existence of the GDPR after 25 May 2018 or through secondary legislation, whichever is appropriate. It asks whether there is a need for a bit more guidance on the commissioner’s duties, in that she may wish to look at the proportionality of such reliance by the data controller—in other words, whether it is appropriate relative to the overall aims and objectives placed on the data by the data controller—and whether it is appropriate under the GDPR or its subsequent limitation or derogation. It also asks whether adequate systems are in place to make sure the rights of data subjects are safeguarded. This may seem to be gold-plating, but it is important to understand better how the mechanics of this works in practice. These are very important issues.

The second part returns to an issue we touched on earlier in Committee, but about which there is still concern. We have again had representations on this issue. The amendment is framed as a probing amendment, but it comes back to familiar territory: what will happen in later stages of the life of the Bill as we leave the EU and are required to make sure our own legislative arrangements are in place? At present, the GDPR has an extraterritorial application so that even when companies are not established in the EU they are bound by the GDPR where they offer goods or services to EU citizens or monitor their behaviour. As well as requiring that lawful processing of data is not excessive, data controllers are required to keep data secure.

So far, so good. The important point is that under the GDPR at present—there is no derogation on this—it is necessary for such companies to make sure they have what is called a representative in the EU. This would be a physical office or body, staffed so that where EU citizens wish to take up issues that affect them, such as whether the data is being properly controlled or whether it has been processed legally, contact can be made directly. But under the Bill as I understand it, and I would be grateful if the Minister could confirm what exactly the situation is, after the applied GDPR comes in the requirement for a company to make sure it has a representative in the UK—in the GDPR, it is for a company to have a representative in the EU—will be dropped. If that is right, even if the operating company is well-respected for its data protection laws or is in good standing as far as the EU is concerned, any individual based in the UK would obviously have much more difficulty if there is no representative, such as in a situation with different foreign laws, where an individual would probably rely on an intermediary who may not see non-nationals as a sufficiently high priority. If things do not work out, the individual may have to have recourse to law in a foreign court. This will make it very difficult to enforce new rights.

Is it right that the Government will not require foreign companies operating in the UK after Brexit to have a representative? If it is, how will they get round these problems? I look forward to hearing what the Minister says on these points.

--- Later in debate ---

[Lord Stevenson of Balmacara]

My Lords, I want to come back to an issue relating to the situation post Brexit: companies operating in the UK, for which a representative will not be required. I listened to the Minister very carefully and I understand what he is saying, but I take it that, post Brexit, he is basically relying on the force of the Information Commissioner’s personality and her ability to maintain her current relationships and build on them. As such, when taking issues abroad, individuals in the UK will not have any statutory provision, as they currently do, but will have to rely on the informal mechanisms the Minister mentioned and their own resources. He has failed to answer the question whether that is a good situation to be in as we progress through the Bill, but I will read what he said more carefully and come back to him later.

[Lord Paddick]

My Lords, I thank the noble Baroness, Lady O’Neill of Bengarve, for her contribution—we will look at that should we bring back the amendment on Report. I also thank the noble Lord, Lord Stevenson of Balmacara, for his support for the amendment.

The Minister said that provision in the 1998 Act requiring all data controllers to be registered was an important part of data protection, yet his argument for not continuing with that seemed to be that it would be difficult to maintain a register with the numbers now involved. Either the register is an important contribution to data protection or it is not. In any event, we should bear in mind that a charge could be levied. The Minister suggested that a register would not be a proportionate use of the Information Commissioner’s resources, but those resources could significantly increase. If the existing law were enforced, it is estimated that an additional £1 billion in income would be possible.

On a detailed central register, I said when introducing the amendment that the detail suggested would be far less than is currently the case. However, we will reflect on what the Minister said. For the moment, I beg leave to withdraw the amendment.

Digital Economy Bill

Debate between Lord Stevenson of Balmacara and Lord Paddick

Committee: 2nd sitting (Hansard - continued): House of Lords
Thursday 2nd February 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, we spent a considerable amount of time earlier in Committee on the question of the powers that would be allocated to any regulators appointed under the Bill. We did not spend much time on who the regulators would be, although some concerns were raised. However, over the weeks and even today, we have increasingly gathered that the Government’s intention is that the British Board of Film Classification, the BBFC, should be given a major role in the work discussed in this particular part of the Bill.

I will start with the report of the Delegated Powers and Regulatory Reform Committee, which has already been extensively referred to in the debate. It raised questions about what the position would be of any regulator appointed under the powers being taken in the Bill. It said, for example, that the age verification regulator—without naming that regulator—will have powers including,

“to require the provision of information … impose substantial civil penalties … take steps to direct internet service providers to block access to material … and … publish guidance”.

Of course, there is a quite a lot in the report that we have already discussed about how and under what conditions a body such as the regulator that will be appointed should be able to publish guidance, particularly if it is on behalf of the Secretary of State and has not been subject to discussion within Parliament.

Without having any expert knowledge of the work of the committee, I think that, had they known directly who the regulator would be, they might also have raised the issue in my amendment: the status and constitution of the body that is likely to be appointed. I assume that the comments made by the Minister earlier in this Committee session that the BBFC is to be appointed will be carried forward in due course. If I am wrong, obviously the points I make are still valid—although they may apply to a different regulator of a different nature.

The issue I want to pick up comes in paragraph 15 of the DPRRC report, which talks about a memorandum exchanged between it and the department in relation to the powers that would be applied to the regulator. It starts by saying where those powers are found: in Clause 17. It explains that the department feels that it is important to retain flexibility as to who is to be appointed to ensure that the right person or persons are appointed as a regulator. Of course, that point has probably now been overcome by time. It also makes the point that the functions could be regulated. Indeed, we had earlier recommendations that suggested quite persuasive arguments for the regulatory burden to be carried by more than one body. I hope that we will be able to make progress on this as we move through the Bill.

It is clear that if the regulator is to be the BBFC, the work of which is really the basis for the classification system that will be relied on in the legislation, it has a designation to do only part of its work under the Video Recordings Act 1984. It is important to pause here. The amendment that I am putting forward asks the Government to think hard about the correctness of a decision to appoint as a regulator a body that is only partially covered by statute at present. Does the Minister think it right that a private company over which the Secretary of State has limited powers in relation to who is appointed to that body should take on the sorts of responsibilities on civil penalties and the blocking of activity, as well as regulatory functions?

As the amendment suggests, does he not think that it might be more appropriate to look carefully at the body that takes on these responsibilities and to propose, as I do, that it should be either a body corporate or subject to more extensive powers of direction as to who is appointed and how any appointments are made? If that were the case, we could have more confidence in the ability of that body to make the right decisions in relation to all the functions that it has, which extend quite widely, and in particular to age verification, which is the subject of the Bill.

The British Board of Film Classification is a private company. Its number is 00117289. I checked today on the company’s register and, limited as the information is, it is quite revealing. It was first incorporated on 17 August 1911. So for nearly 107 years it has been a monopoly operator in a private capacity, acting in some senses on behalf of the Government in some of its functions. As I said, there are statutory functions in relation to video and now DVD, but none to any great extent in relation to film classification, which is the basis of the work that is being carried on in the Bill.

It is well known that, in its original form, the BBFC was called the Incorporated Association of Kinematograph Manufacturers Ltd. It was created by the then manufacturers of projection equipment to protect the investment that they made in cinemas up and down the country against the watch committees, which had sprung up before but were now displaying an active concern about the impact of films on the morals of the population. This still exists. Technically, films are licensed for exhibition in the United Kingdom only through the local authorities. They normally take the advice of the BBFC. That was a clever move by the manufacturers of the equipment, which was at risk, to ensure that they stepped in ahead of the possibility of moral outrage by creating a situation in which they said and alleged that people would not be shocked by the sorts of thing that might cause alarm and despondency around the country. At that stage they could not have anticipated that Life of Brian is still banned in Glasgow—I think that I am right in saying that. That may or may not be of interest to anybody in the Committee, though perhaps it woke your Lordships up a bit. That is the kind of thing that can come from this rather unfortunate arrangement.

I will recap slightly. This private company last year made a profit of approximately £1.5 million on a turnover of £5.4 million. It owns freehold property not a million miles from here worth quite a lot of money. It has a board appointed by itself and a membership that is not disclosed in the company’s records. It operates in an area of considerable complexity and certainly some moral concern—and it is about to be given additional statutory responsibilities. Those are the main points that I want to make in this amendment.

I do not know whether what I propose in this amendment is right. It is an issue that should be thought carefully about before we move further. For instance, within the BBFC structures at the moment there is no appeal system. The regulatory functions of the Secretary of State are limited; they are mainly related to video and not to film. The powers that are about to be referred to it are mentioned by the Delegated Powers Committee as being of concern, so we need to find a way through that. We have yet to see how that will happen because we have not yet had the Minister’s response. I beg to move.

[Lord Paddick]

My Lords, I support the amendment but not necessarily for the reasons articulated by the noble Lord, Lord Stevenson. Our concern is that if the Government started to appoint members of the British Board of Film Classification and therefore it was not independent of government, we would have a situation in which the Government would potentially be involved in deciding which films or material should be censored or not, which is not a path we would like to go down, particularly in the current climate of populism and the historical issues that that raises.

Press Matters

Debate between Lord Stevenson of Balmacara and Lord Paddick

Tuesday 1st November 2016 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I thank the noble and learned Lord for repeating the Statement by the Secretary of State in another place and welcome him to the Dispatch Box. I hope it will not be a single guest appearance on this occasion.

We can judge from its opaque title and surprising appearance that the Statement, “Press Matters”, has very little to do with the substance of either the commencement of Section 40 of the Crime and Courts Act 2013 or announcing a date for Leveson 2 to commence. Its purpose seems to be to muddy the waters around the remaining stages of the Investigatory Powers Bill, which is about to be debated in the other place.

Surely the right thing to do is to honour the Government’s commitment to the victims of press intrusion and harassment. Let us remind ourselves what the test is for this process. The former Prime Minister summed it up on 14 June 2012 when he said, having met the Dowler family in Downing Street:

“It’s not: do the politicians or the press feel happy with what we get? It’s: are we really protecting people who have been caught up and absolutely thrown to the wolves by this process? … that’s the real test”.

Labour supports a free press as essential to democracy. We do not support any state control of the press. It is 1,324 days since all parties agreed to implement the recommendations of the Leveson inquiry in full. The Leveson inquiry looked into press behaviour following the public outcry over illegal phone hacking and after it emerged that there had been many victims of press intrusion.

A key recommendation of the report was the creation of a,

“genuinely independent and effective system of self-regulation”.

The new system was debated in Parliament and received unanimous cross-party agreement. It involved creating the Press Recognition Panel by royal charter in October 2013 as an independent body to oversee press regulators. Has the Minister read the recent annual report of the PRP? If so, he will be aware of what it says about the need for Section 40 of the Crime and Courts Act 2013 to be implemented. Does he agree with the chair of the PRP, David Wolfe QC, who says:

“There has been a significant delay in doing this, despite the Act being enacted nearly four years ago. Commencing section 40 will strengthen the public’s access to justice. Everyone agrees that politicians should not interfere with the running of the press, but paradoxically, the failure to commence section 40 has kept a political presence in place. The new system intended by Parliament is not in place, and the public interest has not been safeguarded in the way that was expected”?

On Leveson 2, is the Minister aware that one of the original terms of reference given to Lord Justice Leveson was:

“To inquire into the extent of the corporate governance and management failures at News International and other newspaper organisations and the role, if any, of politicians, public servants and others in relation to any failure to investigate wrongdoing at News International”?

This part of Leveson was delayed—as the Minister knows because he has been answering my questions on this matter—until all outstanding court cases are dealt with. Can he confirm that that is imminent?

As my right honourable friend the shadow Secretary of State for Culture, Media and Sport said in the other place, Leveson 2 is the investigation into how the cover-up of phone hacking was conducted, but what the Government are in effect announcing today is a consultation on whether the original cover-up should be covered up. This is shameful. We need the immediate implementation of Section 40 of the Crime and Courts Act 2013 and we want an early date for the second part of the Leveson inquiry. We do not need a faux consultation on these matters. If the Government are to proceed on this route, I would be grateful if the Minister could explain in some detail what elements of the recent police investigations referred to in the Statement—the Hillsborough inquiry and its findings on misleading police statements to government officials and subsequently newspapers; the case of Mazher Mahmood, who perverted the course of justice to secure his scoops and left scores of previous convictions unsafe; senior police resignations; the new revelations on the Daniel Morgan case; and what we have just heard about Orgreave—persuade him that further consultations are not now required.

We must not miss this historic opportunity. We must ensure that what the press did to the Dowlers, the McCanns, the family of Abigail Witchalls and others who suffered so terribly, can never happen again.

[Lord Paddick (LD)]

My Lords, I too thank the noble and learned Lord for repeating the Statement. I must declare an interest, in addition to being a victim of phone hacking by the press. In 2002, I was the subject of a kiss-and-tell story on the front page and eight inside pages of a Sunday tabloid newspaper. Many of the allegations were untrue and the rest were a massive intrusion into my private life by a former partner whom I had lived with for four years. He was paid £100,000 for the story. In the absence of an effective and independent press complaints system, my only course of action was to sue the newspaper and although I was able to secure a conditional fee agreement, many ordinary people are not. Lawyers acting for the newspaper tried every trick in the book to get me to concede, in which case I would have been liable for both my own and the newspaper’s costs and I would have been made bankrupt. If the paper had not admitted libel and agreed a settlement a week before the case was due to go to trial, and had I lost the action, I would have lost my home.

If newspapers do not sign up to an independent, royal charter-compliant, press complaints system that the public can have real confidence in, the press must be prepared to cover the costs if their refusal to sign up results in complainants having to take action through the courts. This was a cross-party agreement, reached at considerable effort and cost, resulting in a royal charter that the Government are preparing to consign to the dustbin. Not only that, they are preparing to ditch detailed scrutiny not only of the matters detailed by the noble Lord, Lord Stevenson of Balmacara, but of the relationship between the police and the press—issues that were to be covered in Leveson 2—despite such recent cases as that involving South Yorkshire Police, the BBC and Sir Cliff Richard.

If the Statement is designed to head off amendments to the Investigatory Powers Bill currently being considered, does the Minister not agree that it adds fuel to the fire, rather than dampening things down?