Data Protection Bill [HL]

Debate between Lord Stevenson of Balmacara and Lord Patel

Report stage (Hansard - continued): House of Lords
Monday 11th December 2017 Lords Chamber

[Lord Patel (CB)]

My Lords, I have already spoken on this at length and I do not intend to repeat myself, but I support the amendment from the noble Baroness, Lady Neville-Jones. This is a very important database. It is not just national but international, and it is difficult to collect. That is why I am glad that an accommodation has been made to support the amendment.

[Lord Stevenson of Balmacara]

My Lords, I add my voice in support of the noble Baroness’s amendment and wish it well. I suspect she has run into the logjam that constitutes the waiting list to see the Bill team and the Ministers, who have been worked so hard in the last few months. But I hope it will be possible, given that there is a bit of time now before Third Reading, for this matter to be resolved quickly and expeditiously before then.

Data Protection Bill [HL]

Debate between Lord Stevenson of Balmacara and Lord Patel

Monday 30th October 2017 Lords Chamber

[Lord Stevenson of Balmacara (Lab)]

My Lords, I do not need to say very much about our amendments in this group because they overlap to a great extent with what has just been said by the noble Lord, Lord Clement-Jones. I should not really delay the House as it is anxious to get on to other business, but the noble Lord made an interesting comment about the response that might come from my noble friend sitting to my right. In our Whips’ Office we have a regular problem, because Ray Collins and Roy Kennedy are, confusingly, always called Roy Collins and Ray Kennedy. I have never actually heard them be confused when called by their surnames, so we have had a first today. It is always nice to see firsts in our rather dull and restricted life—it is time for dinner.

This is quite an important amendment, and the noble Lord, Lord Clement-Jones, has made the case very well. When I was looking through the Bill and trying to come up with a sense of narrative that we could use here, I wondered about the introduction of “substantial public interest”, which predates this Bill significantly. It appears in the 1998 Data Protection Act but it was not challenged there. It felt to me like a mistranslation—a sort of anglicisation gone wrong, because there should not be gradations of public interest. A matter is either in the public interest or it is not: it should not have to be qualified by the word “substantial” to get it to a different level of concern or consent. In that sense, maybe “substantial” just means of greater sensitivity, rather than more important and therefore to be restricted. I should be grateful if the Minister reflected on that when responding.

I share the concern that the noble Lord, Lord Clement-Jones, raised in his first amendment. By and large, the Bill is pretty good at tying down where there is flexibility and where there is not, but here, the terminology seems very loose. We can understand what Clause 7 means, but the idea that it would be relatively easy to extend and adapt the list in subsections (a) to (d) is quite worrying. If that is to stand, and the defence says that it is reasonable in the circumstances to have such wording, we need to understand the powers under which that list could be adapted or amended. Are they to be found in the Government’s ability to seek regulatory approval, or will it be done in some other form? We ought to know the answer to that.

Since we are back on codes, as mentioned by the noble Lord, here is a code that it is really important to have before we get to Report. I would be grateful if the Minister confirmed that that will be possible. I understand that the issue is not in his hands, because the Information Commissioner will be the person responsible. However, given that the terminology in the Bill will have an impact right across our statutory provisions regarding what is or is not in the public interest, and if this is the long-awaited guidance and the substitute for a proper definition in statute, it is very important that we have it in time to discuss it on Report.

[Lord Patel (CB)]

My Lords, I speak to Amendments 11 and 13, in the name of the noble Lord, Lord Clement-Jones, and Amendment 154, in the name of the noble Lord, Lord Stevenson of Balmacara, and to which I have added my name in support.

When I first read the amendments tabled by the noble Lord, Lord Clement-Jones, I was concerned because I thought them quite restrictive. Now that he has spoken to them, I can see that he intended them to be wider, so I apologise to him that I did not have the opportunity to speak with him beforehand, so that I would have had that clarification. None the less, having said that, I am concerned that the amendment would restrict the interpretation of,

“a task carried out in the public interest”,

and a narrow list is set out in Clause 7(a) to (d). That is a major concern for universities and other institutions involved in research.

It is absolutely important that universities and other public bodies that carry out research functions are able to use,

“task carried out in the public interest”,

as a legal basis for processing personal data. Restricting this clause to apply only to those functions listed in paragraphs (a) to (d) would instantly make all processing of personal data carried out for research purposes with a university illegal. That is unless it could meet the stringent requirements of GDPR-compliant consent, which I will speak to on an amendment in the group that follows.

None the less, providing further clarity through regulations would ensure that “public interest” was not used as a catch-all for public bodies, negating the incentive to restrict the definition in the Bill in the way proposed by this amendment. I have no doubt that we will have a discussion and that the amendment is not intended to be so restrictive. I look forward to the Minister’s summing up.

I support Amendment 154 in the name of the noble Lord, Lord Stevenson of Balmacara. However, under the GDPR, all users and controllers of data will need to be much clearer about the legal basis that they use to process personal data, and more explicit with data subjects about what is happening to data about them. However, this shift is also likely to generate a certain amount of confusion among researchers who process personal data as part of their studies.

An enormous amount of research using personal data is carried out by universities, which constitute public bodies. As it stands, the Bill defines “public interest” in quite a narrow way—and I shall come to that in more detail when I deal with a group of amendments in my name. But “public interest” is an underspecified notion that could be interpreted in many ways, in the absence of authoritative guidance—and it is that absence that the amendment under the name of the noble Lord, Lord Stevenson of Balmacara, deals with. Placing the requirement to produce codes of practice in the Bill will ensure that it is an undertaking that receives the urgent attention that it demands, and I support it for that reason.

Data Protection Bill [HL]

Debate between Lord Stevenson of Balmacara and Lord Patel

Committee: 1st sitting (Hansard - continued): House of Lords
Monday 30th October 2017 Lords Chamber

[Lord Patel]

I shall respond to some of the points raised. First, on the research ethics committee, we established through legislation—and I remember the debates that we had—a national Research Ethics Committee to deal with all applications for biomedical research, but particularly research involving patient data and transfer of data. If I as a clinician want to do a trial, I have to apply to that committee with a full protocol as to what consent procedures and actual research there will be, and what will be the closing time of that consent. If I subsequently found the information that I had could lead to further research, or that the research that I had carried out had suddenly thrown up a next phase of research, I would have to go back to the committee and it would have to say, “Yes, that’s part of the original consent, which is satisfactory to progress with the further research”. It is a robust, nationally driven, independently chaired national ethics committee, apart from the local ethics committee that each trust will run. So the national ethics committee is the guardian.

Furthermore, there is a separate ethics committee for the 500,000 genomes project, run by the Wellcome Trust and other researchers; it is specifically for that project, for the consent issues that it obtains, the information given at the time when the subject gives the consent and how the data can be used in future. The genomes project aims to sequence all the 500,000 genomes, and to link that genome sequence data with the lifestyles that people had and diseases that they developed to identify the genes that we can subsequently use for future diagnosis and treatment—and to develop diagnostic tests that will provide early diagnosis of cancers, for instance. The future is in the diagnostic tests. Eventually we will find them for diseases which have not developed but which have a likelihood of developing. Those diagnostic tests will identify the early expression of a protein from a gene and then find a treatment to suppress that expression well before the diseases develop, rather than waiting until the cancer develops and then treating it.

All this is based on the data originally collected. At this stage, it is impossible to know where that research will lead—that is the history—apart from the clinical trials which are much more specific and you get consent for them. I realise that there is a limit to how much the text of the Bill can deviate from the GDPR, unless it is dealing with specific issues which the GDPR permits member states to provide derogations for. I realise that, post exit, the UK will need an adequacy agreement and some equivalent, neutral recognition of data protection regimes between the UK and the EU. We need that for the transfer of data. For instance, the noble Baroness, Lady Neville-Jones, has talked about extremely rare diseases, which require the exchange of data across many countries because their incidence is low and no one country could possibly have enough information on that group of patients.

The research exemption does not undermine agreement on Clause 7—which is what the noble Lord, Lord Clement-Jones, was leading up to when he asked about the ethics committee. The noble Baroness, Lady Neville-Rolfe, suggested that medical research should be possible through the research exemption, but that has to be wide enough yet not specific enough to encompass wider exemptions. I hope that the Minister will come up with that trick in an amendment which he might bring forward. It will not be restrictive, yet protect the patient’s personal interest.

There is a research exemption for processing specific categories of data, including health data. The legal basis for this is through article 9 of the GDPR, referred to in Part 1 of Schedule 1 to the Bill. However, all processing of personal data also needs an article 6 legal basis: research is not exempt from needing this. I am arguing today that research needs that exemption, defined in wide enough terms. For processing special categories, you need both an article 6 and an article 9 legal basis. We need to have provision for both in the Bill. One of the article 6 legal bases is consent and I have explained why this is not suitable for much research. The other feasible route for universities and other public bodies processing personal data for research is public interest. This is why it is so important to be clear on what processes can use this legal basis.

There was serious concern about the likely impact of the GDPR on research as it was being drafted. However, this was successfully resolved and it provides the necessary flexibility for the UK to create a data protection regime that is supportive of research in the public interest. The Government, and other UK organisations, worked hard to make sure that this was the case. The provision is there: it is now for the Government to act on it. It is also important to seek an adequacy agreement post Brexit: we will have to have one. It will be vital to consider the need to retain, post Brexit, cross-border transfers of data for research. I give the same example of rare diseases as the noble Baroness, Lady Neville-Jones, used. The Government have recognised the value of retaining a data protection regime consistent with the EU, but the research community would welcome knowing whether it will seek a status of adequacy as a third country or an equivalent agreement.

The plea I make is that unless we include a provision, and there are exemptions which can be written in the Bill in the format that is required, we will not be able to carry out much of the research. A question was asked about the life sciences industrial strategy. It is the key pillar of the Government’s industrial strategy Green Paper. It relies on data that the NHS collects and the data that the science community collects and marrying up the two to produce, and lead the world in, treatments and developing technologies. If we are not able to do this, the whole thing will be unworkable.

[Lord Stevenson of Balmacara]

I am very grateful to the noble Lord for a very full response. It was quite a narrow question. I did not need all of that response but I have learned a lot more in the last few minutes—

[Lord Patel]

I thought that it might have been leading up to more.

[Lord Stevenson of Balmacara]

It might have been. The noble Lord has exposed a much greater issue than we thought we were grappling with. The case has now been well made that there are four pillars rather than the three that I adumbrated before. We seem to have a case for special treatment. I am sure that the noble Lord, Lord Patel, with his assiduous workload and high work rate will have made this point several times to officials and Ministers. However, if he is not getting the answers he needs, we have a bit of a problem here, so I hope that the Minister will be able to help us on that.

This goes back to an earlier debate about the public interest. It again worries me—I think the noble Lord, Lord Clement-Jones, touched on this—that “public interest” is becoming an overworked term for rather too many issues. In other words, the argument here is not about the public interest at all; it is about the public good that would come from a differential approach, safeguarded by the ethics approach—I said that was new to me and I am grateful to hear about it—and about reinforcing the contribution that would make to an industrial strategy covering a much broader range of understanding about what we are doing, thus making this country a world centre for all that. So there is a power behind this that I had not appreciated and I am grateful to the noble Lord for explaining it. It is easy to analyse it in this way and come up with the answer that he might want, but is it the right way forward on this?

The noble Lord was wise to point out that there are constraints within the GDPR and limits on what the Government can do, but it must be possible to think more creatively about the problem that has come forward. If, as the noble Lord said, the GDPR opens up the question of not requiring consent in that very formal sense, and we are looking for an evidence-led policy initiative which addresses the public good, it behoves Ministers to think very carefully about how one might take it forward.

This may or may not be the only issue that requires this sort of approach, but the case has been made on its merits that more needs to be done. Listing existing bodies that are not included, to put it in the positive, in a list of issues—for example, the administration of justice is a function of the Houses of Parliament—is not the way into this issue. I appeal to the Minister to think creatively about this because it seems to me that we need a new approach here. I am very convinced by that and look forward to hearing what the Minister says.

--- Later in debate ---

[Lord Stevenson of Balmacara]

I think we have already made the point and we do not need to come back to it. What I took from the noble Lord’s earlier contribution was that one way in which medical research is developed and carried out involves a consent process, and we would not want to change anything in that sense. However, for lots of reasons—the noble Lord gave three or four—you cannot always use consent. You may not want to go to the patient, or perhaps you cannot go to or find the patient. Alternatively, the noble Lord made the more general point that you often collect data without any real sense of where it might go in the future. We are not saying that any of that is good, bad or indifferent—one is no better than the other—but they all need to be considered in a broader understanding of the public good being best served by having the least restrictive system concomitant with appropriate procedures being in place. That is the line, with the ethics committee sitting at the top, that gets you to the point where that would be a fruitful conversation to have with Ministers.

[Lord Patel]

I must make the issue absolutely clear. If I did not do so before, I will set it out again slowly and carefully. Medical researchers are not asking to be allowed to do research without consent. They are asking for consent to be interpreted not in a narrow sense but in a sense that will allow research to continue with consent having been obtained. I shall give an example. When I chaired the UK Stem Cell Bank, we made it clear that consent would have to be obtained from those who donated stem cell material, including embryonic stem cells. Consent was given on the basis that the embryonic stem cells would be used for research to improve healthcare, but at that time it was not possible to say which healthcare.

Embryonic stem cells, properly kept, are immortal: they can survive for generations. There is a classic example of this. Most of your Lordships are familiar with the lady whose tissue was taken in 1950. Her name was Henrietta Lacks—hence the cells are called HeLa cells. These aggressive cervical cancer cells were taken from her in the United States without consent, but they still exist in every laboratory in the world. A billion dollars-worth of drugs have been developed and marketed using HeLa cells. If consent had been obtained, what would that consent have been for? Exactly the same applies to consent for stem cells—it is for the development of drugs.

Researchers are not saying that we should not have consent. They are saying that there ought to be an authority like the ethics committee that gives consent and to which you can go back and say, “By the way, I have that material and I have found more. I am still developing drugs but this is not the same”. I hope I have been clear about that. We are looking for exemptions that are wide enough.

Perhaps I may come back to the matters raised by the Minister and refer, first, to the public interest issues. I understand that the Government do not intend the functions listed in Clause 7 to be exhaustive and to allow, for example, research conducted by universities or NHS trusts to use the public interest legal basis. It would provide much needed clarity and assurance for the research community if that could be made explicit in the Bill. That, basically, is all we are saying on the public interest. There is currently a highly risk-averse culture in data protection, driven in part because people are unclear about the rules and about what they can or cannot do with that data and for what purposes. If it is made clear what they can do or where they have to go to make it clear, that will be helpful. This is why the public interest legal basis matters so much for research. The Data Protection Bill is an opportunity to set out very clearly the legitimate basis for processing personal data, setting out a clear public interest function for research that will give researchers the confidence to know when they are operating within the law.

I will now make a comment about what the Minister said about the safeguards. My Amendment 111 is to Clause 18, which prohibits the processing of personal data to support measures or decisions with respect to particular individuals. This is clearly problematic for any research that involves an intervention for an individual, which forms the bedrock of our understanding of a vast range of treatment of diseases. The range of law covering the use of personal data for research is complex, governed both by data protection law and common law, where duties of confidentiality toward the data subject exist. In my view, the implementation of GDPR through the Bill is an opportunity to provide clear information to researchers about the legal basis for processing personal data and the requirements of accountability, transparency and safeguards.

It is therefore essential that authoritative, comprehensive and unambiguous guidance is created to assist with this transition to a new data protection law. The Health Research Authority is working on guidance for health research, but researchers are urgently in need of this advice to ensure they are compliant by May 2018.

Those are my comments in response to the Minister. I am labouring these points today because this is the only opportunity I will have in Committee to debate these issues at length. I do not wish to rehearse this at Third Reading if we can resolve these issues by communication and find a way out.