Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Lord Coaker Excerpts

Tuesday 5th March 2024 Grand Committee

Falling data protection standards in the UK also create wider risks. The free flow of data from the EU to the UK is based on the UK and the EU having essentially equivalent data protection standards. If UK standards fall, as the regulations clearly prove that they have, this risks the free flow of data from the EU to the UK, causing significant barriers to trade as well as costs and red tape for UK businesses. I look forward to the Minister’s reply and to our debates on the new data protection Bill.

[Lord Coaker (Lab)]

My Lords, I am pleased to follow the noble Baroness, Lady Hamwee, and the noble Lord, Lord Clement-Jones. I agree with much of what they said. I thank the Minister for his introduction to this important SI.

In May 2021, the Court of Appeal ruled that the wording of the exemption at the time did not comply with GDPR because it did not provide sufficient safeguards against abuse or risks to data subjects. In December 2021, the Government laid an instrument intending to rectify this by introducing guidance. However, officials then found that the guidance was not sufficient and a further Court of Appeal judgment required the Government to come forward with safeguards that they have now put into the legislation. We support the SI in doing that.

I have a couple of questions for the Minister regarding that. Paragraph 5.2 of the Explanatory Memorandum states that the High Court said that,

“the balancing test between the rights of individuals and the maintenance of effective immigration control should be set out more explicitly in the legislation”.

Can the Minister say a little more about how the Government intend that test to work and the criteria for the balance between the rights of the individual versus the rights of immigration control? How is it different from before? Presumably there was some sort of test even if it was not in any legislation. Is there any oversight of how this operates, anywhere that this has to be reported so that there is oversight of it? Who applies for the exemption? Who starts the process of saying, “We think that there should be an exemption in this case”. What is the process for that?

Like the noble Lord, Lord Clement-Jones, I am interested to know how many times this has been used over the past few years. How many exemptions have taken place? What is the status of those who have had this applied to them where their data was not compliant with the law? Presumably they were subject to some sort of immigration sanction. Can the Minister say anything about this?

There is a question that I always ask. Sometimes it is irrelevant, but I ask it anyway. Does it impact on anyone leaving the country? Obviously, it impacts on people coming in, but I am never sure about anyone leaving the country, which is a weakness in our immigration system. We spend a lot of time talking about people coming in, but I sometimes wonder whether counting people out might be an idea as well.

The Explanatory Memorandum talks of the need to consider any,

“potential vulnerability of the data subject”

Does this SI impact on unaccompanied children and children more generally or are children exempt and it is just applicable to adults? I am not sure. I apologise if that is in there, but I could not see it anywhere, so I just wonder whether it applies to children or just to adults. There is some criticism that the Government rejected the idea of including storage and retention periods in the Bill. Can the Minister say why they rejected that?