All 2 Brendan O'Hara contributions to the Data Protection Act 2018

Read Bill Ministerial Extracts

Mon 5th Mar 2018
Data Protection Bill [Lords]
Commons Chamber

Money resolution: House of Commons & Programme motion: House of Commons
Wed 9th May 2018
Data Protection Bill [Lords]
Commons Chamber

3rd reading: House of Commons & Report stage: House of Commons

Data Protection Bill [Lords]

Brendan O'Hara Excerpts
Money resolution: House of Commons & Programme motion: House of Commons
Monday 5th March 2018

(6 years ago)

Commons Chamber
Read Full debate Data Protection Act 2018 Read Hansard Text Read Debate Ministerial Extracts Amendment Paper: HL Bill 77-I Marshalled list for Third Reading (PDF, 71KB) - (16 Jan 2018)
Brendan O'Hara Portrait Brendan O'Hara (Argyll and Bute) (SNP)
- Hansard - -

The Scottish National party acknowledges the need for a new and comprehensive data protection framework that safeguards human rights, and updates UK data protection law to bring it in line with the European Union’s general data protection regulation. We want a Data Protection Bill that makes the UK’s data protection laws fit for the digital age, that enshrines the principle of transparency and accountability and that gives all citizens and consumers greater control over who has access to their personal information and what those parties can do with it.

Despite what we have heard in the debate, this is a wide-ranging and complicated Bill. The House is agreed on many aspects of it, but in certain crucial areas, it falls short of what we expect from modern data protection legislation. Specifically, we are concerned about the Bill’s provisions on the UK’s derogation from the GDPR for the purposes of effective immigration control. We also have concerns about automated decision making, the use of national security certificates and the lack of provision for collective redress. We are also very concerned about the consequences for the UK as it tries to secure an adequacy agreement with the European Union, post Brexit.

As the Secretary of State is well aware, SNP Members and the Scottish Government are extremely concerned about clause 168, which concerns section 40 of the Crime and Courts Act 2013. Clause 168 was inserted in the other place and impinges on areas wholly devolved to the Scottish Parliament. Although we will be as constructive as possible in assisting the passage of the Bill, we will table our own amendments and support other Members’ amendments on those issues in Committee.

We will definitely seek to challenge paragraph 4 of part 1 of schedule 2, which is effectively an immigration exemption that permits the Government to collect and hold data without subject knowledge; we find that deeply worrying. Equally concerning is that there is no legal definition of immigration control, or the maintenance of effective immigration control, anywhere in the Bill. Given that effective immigration control is both highly subjective and highly political, I fear it will make individuals’ rights extremely susceptible to changes in political tides. This broad, wide-ranging exemption is fundamentally unfair, and it runs contrary to basic human rights. It is unprecedented and as unnecessary as it is disproportionate.

Under this exemption, the Government will remove any obligation they have under data protection law to inform an individual that their data has been transferred to the Home Office for immigration control purposes. The individual concerned would not know that their data was being held, or that they were under investigation. They would have no right to see what data of theirs was being held by the Home Office, or to find out why it was being held. They would have no way of checking the accuracy of the information held by the Home Office, and they would have no way of correcting any mistakes in that information, which could be used by the Home Office to decide whether they could live in this country.

That means that one early error in data collection or processing could become indisputable fact by the time it reached the Home Office, and the Home Office could base its case against an individual on that. As MPs, we all know how often information held on individuals turns out to be wrong. This is an issue of basic fairness, and it is little wonder that the measure has been roundly condemned by numerous civil liberties groups and by many in the legal profession.

If the measure is enacted, it would be a fundamental change to the way things currently work, whereby data held on an individual can be obtained through a subject access request. As it stands, the Home Office, the applicant and the applicant’s legal representative all have access to the same information, and it is that information on which claims and legal challenges are based. Surely, if both sides do not have access to the same information, the fairness of legal proceedings is inevitably compromised.

Subject access requests are often the only route through which legal professionals can obtain access to such information, and thereby understand the complicated immigration history of some of their clients. Indeed, for applicants who have been the victim of domestic abuse and who were in a controlling relationship for years before seeking help on immigration matters, a subject access request may be their only way of establishing their basis for settlement and for gaining independence from an abusive partner. This exemption will reduce a legal representative’s ability to best represent their client, and it will remove an important tool in holding the Home Office to account when it ignores or seeks to misrepresent the facts.

Further to the comments of the hon. Member for West Bromwich East (Tom Watson), we also strongly recommend that the Government look again at clause 183, and make provision for suitably qualified non-profit organisations to pursue action against data protection infringements of their own accord. This kind of enforcement, where one person or body represents a group of individuals, is known as collective redress. As it stands, clause 183 only allows individuals to request that suitably qualified organisations take up a case on their behalf, rather than allowing such organisations to highlight where they believe a breach of data protection law has occurred.

All too often, individuals are the last to know that their data has been unlawfully used, and in many cases those best placed to identify unlawful practices are the organisations that do the independent research and investigation. We hope that clause 183 can be amended to ensure that not-for-profit organisations have the right to raise complaints themselves when they consider that people’s data protection rights have been infringed.

I also want to raise the matter of automated decision making and, in particular, clause 14, which permits exemptions from the right not to be subject to an automated decision. We strongly believe that automated decision making without human intervention should be subject to the strictest limitations, and it has to address fairness, transparency, accountability and issues of discrimination. The Bill provides insufficient safeguards. This is not about an online retailer suggesting what book or song someone might wish to download, based on previous purchases; this is about decisions being made without human oversight that can have long-term, serious consequences for an individual’s health, or their financial, employment or legal status.

As I understand it, clause 48 would allow law enforcement agencies to make purely automated decisions. This is fraught with danger and is, we believe, not only at odds with the Data Protection Act 1998, but against article 22 of the GDPR, which gives individuals the right not to be subject to purely automated decisions. The GDPR contains provision for EU member states to opt out of this, but that opt-out does not apply if the data subject’s rights, freedoms and legitimate interests are undermined. I urge the Government to look again at those parts of the Bill on automated decision making and to make it explicit that where automated processing is carried out, a human will have to decide whether it is reasonable and appropriate to continue. That human intervention will provide transparency and accountability, and ensure that the state is not infringing an individual’s fundamental rights, liberties and privacy. Those issues are often subjective and beyond the concept of an algorithm.

Another area of concern, which we will raise in Committee, relates to the issuing of national security certificates, which allow restriction of and exemption from a wide range of rights in the Bill and the GDPR on the basis of national security and defence. It is right that a country should have an ability to do what is deemed to be in the best interests of its national security, but many would argue that, since 1998, national security certificates have received insufficient scrutiny of their impact on privacy or their proportionality. We are concerned that the proposals in the Bill go much further than those in the Data Protection Act 1998. We question whether the broad and indefinite nature of those national security exemptions is necessary and proportionate and whether the oversight of the issuing of national security certificates is sufficient. As the Bill is drafted, an individual’s rights could be removed by a politician without any form of judicial oversight. Surely it cannot be right for an individual’s rights to be undermined so easily, purely on the say-so of a Minister.

Of course, even in normal circumstances, the passage of this Bill would be challenging, given its nature, size, scope and complexity, but it has to be seen against the backdrop of Brexit, as does everything we do and have done for the past two years. We have to not only comply with the GDPR, but do so in such a way that the United Kingdom achieves an adequacy decision from the European Commission, allowing it to continue to operate securely and freely within the framework of the GDPR. I fear that much of what is proposed in this Bill, particularly on the immigration exemption and the national security certificates, jeopardises achieving that adequacy decision, as before granting such a decision the European Commission is obliged to consider a variety of issues, including respect for fundamental rights. As we have heard, the GDPR will evolve over time, and the UK will have to maintain adequacy, and that means amending our data protection to keep it in line with European law.

My final point relates to amendment 147 from the other place, which will have the same effect as implementing section 40 of the Crime and Courts Act 2013. The Minister is aware that although data protection is a reserved issue, both criminal justice and press regulation are wholly devolved to the Scottish Parliament. Furthermore, the concept of exemplary damages does not exist in Scots law, and the Scottish Government have no intention of changing the law for the purposes of incentivising participation in a press regulation system. As it stands, this Bill seeks to regulate the press by means of civil procedure, both of which, as I say, are devolved to the Scottish Parliament.

As I said in the Chamber last week, we believe that all individuals should be able to seek redress when they feel they have been the victim of press malpractice, and the Scottish Government will continue to engage with the Scottish press on independent self-regulation. The Secretary of State has had correspondence on this matter from myself and Fiona Hyslop, the Scottish Government’s Cabinet Secretary for Culture, Tourism and External Affairs, who wrote to the UK Government last month making clear the Scottish Government’s position on this matter. On the second part of the Leveson inquiry, she was equally clear that press regulation and any associated issues around the culture, practices and ethics of the press would be a matter for the Scottish Government and that in any future inquiry, the distinct legal context in Scotland must be taken into account. It benefits every one of us to have a data protection regime that is transparent and accountable and that has at its heart the rights of the individual to control what happens with their data.

Although there is much that we agree on in this Bill, there are areas that give us serious cause for concern. In Committee, we will therefore table amendments and support others’ amendments that seek to address concerns about the immigration exemption, collective redress, automated decision making, the scope of national security certificates and, of course, section 40 as it relates to Scotland. These amendments will seek to strengthen the Bill, to guarantee that everyone’s human rights are protected equally and to ensure that, going forward, the UK has the best chance of securing the adequacy decision that it requires, post Brexit.

Data Protection Bill [Lords]

Brendan O'Hara Excerpts
3rd reading: House of Commons & Report stage: House of Commons
Wednesday 9th May 2018

(5 years, 10 months ago)

Commons Chamber
Read Full debate Data Protection Act 2018 Read Hansard Text Read Debate Ministerial Extracts Amendment Paper: Consideration of Bill Amendments as at 8 May 2018 - (9 May 2018)
Bill Wiggin Portrait Bill Wiggin
- Hansard - - - Excerpts

No, it is not, because it is designed to ensure that victims get access to justice. My hon. Friend will find the local papers that may come under section 40 are owned by large companies. The exemption is designed for the charitable sector, which I will come to in just a moment.

One myth is that The Guardian would not be covered. The Daily Mail claimed that The Guardian would be exempt from the section 40 provisions, which is not true. The Guardian would not be covered by condition A, which is necessary to protect the not-for-profit publications that cannot afford cost-shifting—that is the sector my hon. Friend is interested in protecting. The Guardian would be covered because it declares dividends to its members, so it would not be exempted as the Daily Mail suggested.

The next myth about section 40 is that newspapers would have to sign up to IMPRESS, which again is simply not true. The press are at liberty to create their own regulator, which would simply have to fulfil all 29 of Leveson’s criteria in order to become approved. Becoming approved does not require any sort of Government or political approval. It is entirely independent, and there is nothing to stop IPSO applying to become an approved regulator, except that it does not want to provide the low-cost access to justice that is so necessary. IPSO is a press protector, not a press regulator. I say that because it has introduced what it calls a compulsory low-cost arbitration scheme, but that is not right. IPSO’s scheme is voluntary, and the Financial Times, MailOnline and other newspapers not regulated by IPSO have not signed up. Newspapers may leave the scheme whenever they choose. Although I am delighted that IPSO has admitted that low-cost arbitration is necessary, to add to the express view of both Houses and the recommendation of Lord Leveson, this version of it is not right.

If we choose not to vote for section 40 today, we will once again be trusting the newspapers to reform themselves. They say we should trust them and that IPSO is reforming, coincidentally at exactly the same time as we vote on this important new clause. The newspapers have shown again and again that they cannot be trusted, and we must vote to ensure that all victims have access to low-cost justice, which is so necessary. Lord Leveson, both Houses of Parliament and, now, IPSO have all agreed this is necessary. Section 40 has been on the statute book for five years, and it is now time it was commenced.

Brendan O'Hara Portrait Brendan O'Hara (Argyll and Bute) (SNP)
- Hansard - -

Time is tight, so I will be brief. I rise to speak in support of new clause 18 because the Scottish National party has been clear throughout that all individuals should be able to seek redress when they feel they have been the victim of press malpractice. It benefits each and every one of us to have a media that is both transparent and accountable.

The Scottish National party is committed to ensuring that the practices that led to the Leveson inquiry never happen again. We have been equally clear, however, that if there is to be a second part of the Leveson inquiry, the distinct Scottish legal context must be taken into account and the Scottish Government must be consulted on the scope and scale of any future inquiry.

Both my hon. Friend the Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) and I raised that on Second Reading and again in Committee, and we put on record our dismay at the wholly inappropriate, indeed lazy, amendments made in the other place that sought to impose a blanket, one-size-fits-all, Truro-to-Thurso policy without any cognisance of the devolution settlement or of the fact that matters of press regulation and criminal justice are wholly devolved to the Parliament in Holyrood. I do not think it unreasonable to expect the House of Lords to know that both criminal justice and press regulation, and all the associated issues of the culture, practice and ethics of the press, fall under devolved competence, and that any blanket UK-wide proposal could only negatively impact on devolution.

Scottish National party Members have said repeatedly that, as long as the Scottish Government are consulted and the Scottish legal system is taken into account, we would be happy to support a Leveson inquiry.

Liam Byrne Portrait Liam Byrne
- Hansard - - - Excerpts

I am following the hon. Gentleman’s argument closely. He is right to say that we need to ensure the sins of the past are not repeated, which is why we need new clause 20. Can he confirm whether his party’s position is to support new clause 20 today or, as I have heard, to abstain on it?

Brendan O'Hara Portrait Brendan O'Hara
- Hansard - -

The right hon. Gentleman may push that to the vote, but new clause 20 seeks to impose on Scotland a system of press regulation from Westminster, even though this is wholly devolved. I appreciate the work that he and others in Hacked Off have tried to do to square that circle, but it has not been squared. Therefore, we cannot support a system of press regulation that will be imposed from Westminster on Holyrood. That is why I am so pleased that new clause 18 is presented in such a way that it takes on board all of our concerns. I am extremely grateful for the efforts made by the right hon. Member for Doncaster North (Edward Miliband) in fashioning the new clause in a way that allows the second part of the Leveson inquiry to take place while recognising the devolution settlement and the distinct position in Scotland. I commend the passion with which he put across his argument this afternoon.

There will be some who will say that part 2 of Leveson is now out of date—indeed, the Secretary of State said as much when he announced his plans to scrap it. People are right to say that much has changed since 2011, which was before Brexit or the fake news agenda dominated the newspapers, but we need to ask ourselves how much has really changed since the height of the phone hacking scandal. The Government are convinced that a step change has taken place, but I question whether it really has. The Secretary of State has pointed out that the world has changed, but these concerns are as relevant now as they were then.

We have seen how social media is now part and parcel of everyday life. Surely the time is right, with this second part of Leveson, to investigate the role of social media companies—Facebook, Twitter and others—in spreading fake news and disinformation. I would like to think that this inquiry would look to build on the outstanding work being done by the hon. Member for Folkestone and Hythe (Damian Collins) and his Select Committee in pursuing fake news and the spread of disinformation.

On behalf of the Scottish National party, I am delighted to have added my name to new clause 18 because I believe any reasonable person would agree that the terms of reference for this part of the Leveson inquiry have not yet been met.

Jacob Rees-Mogg Portrait Mr Rees-Mogg
- Hansard - - - Excerpts

The freedom of the press is so overwhelmingly precious that we should preserve it even if sometimes the press upsets us. It is amazing how many people who have had run-ins with the press have suddenly found that they think it should be more tightly regulated. Fascinatingly, the Daily Mail carried out a survey of their lordships House and discovered that more than a third of those who voted to shackle the press had been embarrassed by the press. May I therefore pay all the greater tribute to my right hon. Friend the Member for Sutton Coldfield (Mr Mitchell) for his impressive speech? He has suffered at the hands of the press, yet he recognises that the value of the free press is one of the great jewels in the crown of our constitutional settlement. But it is a jewel that has become tarnished because of actions taken by us; in four years, we have fallen in the rank of free nations from 30th to 40th, so that now we are behind Trinidad and Tobago, and, perhaps most insultingly, even below the French in freedom of the press. The clauses before us today should fill us with shame because they go to the heart of what we should believe in, in terms of our liberties, our freedoms and the rule of law.

New clause 18 seeks to have double jeopardy. Why did Leveson 2 not go ahead in the first place? It was because of a fear that trials could be made unfair by an inquiry going ahead at the same time. But those trials have now gone ahead and juries have returned verdicts. Interestingly, what verdicts did they return? It was not the ones the establishment expected. By and large, the journalists were found not guilty—not guilty of misusing any public office—but the police who gave them information were found guilty.

Was that not proper justice at work? The receiving of information as a journalist is your job, but the giving of information as a policeman is against the law. They have had justice, they have had the inquiry and they have been through the process, but now people want to put those found innocent through it again. They want to call them in front of a tribunal, to put them on oath, to put them in the stocks, and to let them be quizzed, questioned and interrogated so that the freedom of the press can be undermined and pressurised by those who have sometimes had the sharp lash of the press’s tongue against them. It reeks of self-interest.

--- Later in debate ---
Damian Collins Portrait Damian Collins
- Hansard - - - Excerpts

The right hon. Gentleman is absolutely right and that throws up two really important points.

The first point is that the Information Commissioner is also currently investigating this, which links to the right hon. Gentleman’s point about where the money comes from and who the data controllers are in these campaigns. Although Facebook is saying that it will in future change its guidelines so that people running political ads must have their identity and location verified, we know that it is very easy for bad actors to fake those things. It would be pretty easy for anyone in the House to set up a Facebook page or account using a dummy email address they have created that is not linked to a real person, but is a fake account. This is not necessarily as robust as it seems, so we need to know who is running these ads and what their motivation is for doing so.

Secondly, the Information Commissioner is also looking at the holding of political data. It is already an offence for people to harvest and collect data about people’s political opinions or to target them using it without their consent, and it is an offence for organisations that are not registered political parties even to hold such data. If political consultancies are scraping data off social media sites such as Facebook, combining it with other data that helps them to target voters and micro-targeting them with messaging during a political campaign or at any time, there is a question as to whether that is legal now, let alone under the protection of GDPR.

As a country and a society, we have been on a journey over the past few months and we now understand much more readily how much data is collected about us, how that data is used and how vulnerable that data can be to bad actors. Many Facebook users would not have understood that Facebook not only keeps information about what they do on Facebook, but gathers evidence about what non-Facebook users do on the internet and about what Facebook users do on other sites around the internet. It cannot even tell us what proportion of internet sites around the world it gathers such data from. Developers who create games and tools that people use on Facebook harvest data about those users, and it is then largely outside the control of Facebook and there is little it can do to monitor what happens to it. It can end up in the hands of a discredited and disgraced company like Cambridge Analytica.

These are serious issues. The Bill goes a long way towards providing the sort of enforcement powers we need to act against the bad actors, but they will not stop and neither will we. No doubt there will be further challenges in the future that will require a response from this House.

Brendan O'Hara Portrait Brendan O'Hara
- Hansard - -

I will be very brief, Madam Deputy Speaker, because we are incredibly tight for time.

There is so much in the Bill that I would like to talk about, such as effective immigration control, delegated powers and collective redress, not to mention the achievement of adequacy, but I will concentrate on amendment 5, which appears in my name and those of my hon. Friend the Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) and the hon. Member for Brighton, Pavilion (Caroline Lucas).

The amendment seeks to provide protection for individuals where automated decision making could have an adverse impact on their fundamental rights. It would require that, where human rights are or could be impacted by automated decisions, ultimately, there will always be a human decision maker at the end of the process. It would instil that vital protection of human rights in respect of the general processing of personal data. We believe strongly that automated decision making without human intervention should be subject to strict limitations to promote fairness, transparency and accountability, and to prevent discrimination. As it stands, the Bill provides insufficient safeguards.

I am talking about decisions that are made without human oversight, but that can have long-term, serious consequences for an individual’s health or financial, employment, residential or legal status. As it stands, the Bill will allow law enforcement agencies to make purely automated decisions. That is fraught with danger and we believe it to be at odds not just with the Data Protection Act 1998, but with article 22 of the GDPR, which gives individuals the right not to be subject to a purely automated decision. We understand that there is provision within the GDPR for states to opt out, but that opt-out does not apply if the data subject’s rights, freedoms or legitimate interests are undermined.

I urge the House to support amendment 5 and to make it explicit in the Bill that, where automated processing that could have long-term consequences for an individual’s health or financial, employment or legal status is carried out, a human being will have to decide whether it is reasonable and appropriate to continue. Not only will that human intervention provide transparency and accountability; it will ensure that the state does not infringe an individual’s fundamental rights and privacy—issues that are often subjective and are beyond the scope of an algorithm. We shall press the amendment to the vote this evening.

Brendan O'Hara Portrait Brendan O'Hara
- Hansard - -

I would give way, Minister, but I am very pushed for time.

I would like to voice my support and that of the SNP for amendment 15 on effective immigration control. We believe that the exemption is fundamentally wrong, disproportionate and grossly unfair, and we call on the Government to stop it.

Colin Clark Portrait Colin Clark (Gordon) (Con)
- Hansard - - - Excerpts

I am conscious of the time, Madam Deputy Speaker, so I will not take too long.

This country is committed to remaining a global leader on data protection. The fundamental principle behind the Bill is to bring our data protection and information laws up to speed in the digital age. If we are to keep pace with technology and restore accountability in this area, we need a strong Information Commissioner’s Office. I am therefore pleased that the Government have brought forward new clauses 13 and 14. Remarkably, 11.5% of global data flows through the UK. It is vital that the UK plays a key role in ensuring compliance.