Data Protection Bill [HL] - Committee (2nd Day) (Continued)

House of Lords, 6 November 2017.

Lord Clement-Jones (Liberal Democrat)

My Lords, I beg to move Amendment 21A and also speak to Amendment 66A. I also support Amendments 41 and 44, but my noble friend Lord McNally will speak in support of those.

The issue in question is the need for a lawful basis for biometric data used in the context of identity verification and authentication to increase security. Biometric data changes its status under the GDPR and becomes a new category of sensitive data. That narrows the lawful basis on which companies can collect and use biometric data, and it makes this processing of data difficult or impossible because the only lawful basis available is consent, which is not appropriate or feasible in the circumstances.

Biometrics are increasingly being used in different sectors for identity verification and authentication, both as a security measure and to provide greater identity assurance. I am sure that anybody who has used the fingerprint security aspect of an iPad will be aware of that. Employers are also increasingly using biometric access controls for premises or parts of premises that require high security levels and access audit trails. Organisations using biometrics for additional security and assurance also need to keep their mechanisms up to date, and continually test and develop ways in which to prevent bad actors from hacking or gaming their systems. That research and development activity also requires biometric data processing and can involve AI or machine learning to train and test systems.

The Bill has a fraud prevention lawful basis for processing sensitive data, under a heading of “substantial public interest”. However, even assuming that the Bill is clarified and the fraud prevention lawful basis is available to use without having to satisfy an additional “substantial public interest” test, it is not suitable for the biometric uses described. The problem is the risk that necessary and desirable processing of biometric data will not be possible. Increased security benefits everyone, and it would not be desirable for the law protecting the use of personal data to be the barrier to organisations implementing better security for individuals.

The solution is that we acknowledge that the GDPR allows additional lawful bases for processing sensitive data. Specifically, Article 9(4) allows member states to add lawful bases for processing biometric, genetic or health data. The essence is that we use the option available under that article to add a lawful basis, as set out in the amendments. The amendments may not be technically perfect, but I hope that the Minister will agree that they are heading in the right direction. The proposed additional lawful basis covers three biometric data processing activities, described above. There are already safeguards for individuals in the GDPR regarding biometric data processing, as any large-scale processing of sensitive data is subject to a data protection impact assessment, which would be the case for identity verification or authentication as an integral and ongoing security or assurance feature of the service that the individual has chosen to use. The proposed amendment would also introduce this safeguard as a requirement for employee biometric access control processing. I beg to move.

Lord Griffiths of Burry Port (Labour)

My Lords, it falls to me to speak to a sequence of amendments from Amendment 35 to Amendment 68. Whereas we have had complicated issues before us in previous discussions on the Bill, most of these are probing and of a much simpler substance. I will proceed with them as best I may.

Amendment 35 is to paragraph 5(1), which states that a condition for substantial public interest is met only when the processing is carried out by the controller, who has,

“an appropriate policy document in place”.

The amendment we propose seems sensible and simple, which is that the policy document should be,

“made available to the data subject without charge”.

We repeat that in Amendment 68 to Part 4 of Schedule 1, where there is discussion of an “appropriate” document.

Amendment 37 probes the protected characteristics of the Equality Act. Whereas in the Bill just a few are mentioned, our amendment asks why all those included in the Equality Act are not in that list. In the amendment we can see the proposed extra categories that would be placed there to complete that list. Once again it seems sensible, having started on that track, to complete that process.

We come next to preventing or detecting unlawful acts. Amendment 38 asks about “a serious” test. We have had conversations with Reuters and a number of amendments are consequent on some of the observations we made in that conversation. Thus with Amendment 39 we would ask the information commissioning officer to clarify that processing must be carried out without the consent of a data subject where,

“a data subject is unlikely to give consent”,

for example to frustrate prevention or detection, where it would involve disproportionate effort to achieve consent or where the nature of the processing means that withdrawal of consent would prejudice prevention or detection of unlawful acts. That probes the extent to which these matters might apply.

Amendment 40 is again a probing amendment on the question of dishonesty, under the heading:

“Protecting the public against dishonesty”.

Perhaps we need to work out how better to define dishonesty. We all know what telling a lie is, but in the days of fake news we can perhaps have different or varying views on this. Perhaps it needs to be tied down a bit more closely.

Amendment 41 refers to protecting members of the public. It is unclear in the schedule whether this extends to protecting businesses from doing business with other businesses that would cause them severe reputational harm because, for example, they engage in modern slavery, bribery or whatever. It might be good to frame the law so it is clear that it involves businesses and members of the public. To skip an amendment for the moment, that ties in with Amendment 44. Paragraph 12 does not expressly allow screening by private companies for the purpose of checking against non-UK terrorist financing or money-laundering laws. Nor does it allow screening to be undertaken to comply with widely recognised guidelines such as those promulgated by the Financial Action Task Force, in which the United Kingdom Government participate. It seems sensible to include that screening in the Bill. The amendment seeks to achieve that.

Amendment 43 is to paragraph 12, which says that the condition of expressing a public interest is met,

“if the processing is necessary for the purposes of making a disclosure in good faith”,

under sections of the Terrorism Act and the Proceeds of Crime Act. Again, it would be nice to tie some of that down with further clarification. That might help us all. Amendment 45 asks about counselling.

That is the rather interesting daisy chain of amendments it falls to me to present. Since this is, for me, a maiden speech on a piece of legislation, nobody would expect it to be contentious, disputational or controversial. In that sense, I offer it for the consideration of the Committee.

Baroness Neville-Jones (Conservative)

My Lords, I will speak to Amendment 45A in my name. I am advised my Amendment 64 is not in the right place, so I direct the Committee’s attention to Amendment 45A.

Last Monday there was considerable focus in our discussions on the vital need to ensure that legitimate research—especially medical research in the public interest based on the personal data of patients—was not impeded by the terms of this legislation by requiring re-consents that might well be unobtainable. The noble Lord, Lord Patel, spelled out the arguments with great cogency and I do not need to repeat them.

My amendment seeks to ensure that another category of medical activity is not prevented from continuing to give help. I refer to patient support groups. At Second Reading I spoke about Unique, a not-for-profit charity that enables research into, and offers support to, sufferers of rare chromosome disorders and their families. These disorders can and often do result in severe and even profound lifelong disability for which there is no cure.

Since I spoke, many other patient support organisations have been in touch with the same concerns. They support my amendment. They include Genetic Alliance, which comprises 190 organisations giving support to individuals with rare or incurable conditions, such as the Down’s Syndrome Association; the MPS Society, which supports individuals suffering from mucopolysaccharide disease; Alström Syndrome UK; Prader-Willi Syndrome Association; the MND Association for motor neurone disease; Action Duchenne, which supports those suffering from muscular dystrophy; Save Babies Through Screening Foundation, which focuses on infants with Krabbe disease; the Lily Foundation, which supports those with mitochondrial disease; the PCD Family Support Group, for primary ciliary dyskinesia; UKPIPS, Primary Immune-deficiency Patient Support; SMA Support for spinal muscular atrophy; Vasculitis UK; and Annabelle’s Challenge.

All these groups support the amendment I tabled. I could go on; there are others. I have listed them because I do not want it thought that there is in my amendment any suggestion of special pleading for a very small number of organisations. On the contrary, patient support groups are numerous and do unsung but irreplaceable work among individuals and families for whom life can be very hard.

What is the problem with the Bill? Schedule 1 lists a number of circumstances in which the special category of sensitive personal data can be processed without explicit consent for reasons of public interest. But patient support groups do not fall into the categories of organisations that can avail them themselves of this exemption, nor do the purposes for which they collect personal data qualify. This means that the Bill will oblige patient support groups which collect health information from their members either to re-contact everyone from their database to get renewed explicit consent, or to destroy or anonymise any data not re-consented.

On the face of it, this may seem perfectly reasonable, but it takes no account of the real-life situation of the individuals and their families which the patient support groups help. I explained at Second Reading how in reality carers, who may be the other side of the world, may not respond to communications but then, possibly years later, communicate to ask for help or get in touch to help each other. It is certainly wasteful and gratuitously harmful to require such data to be destroyed when it is the very basis on which these groups can offer relevant support. In the case of Unique, experience suggests that up to 50% of existing data would need to be destroyed, having been accumulated over 30 years, and thus lost for current and future research and sufferers. I am sure this cannot be the intended outcome of the Bill.

Anonymisation, which in some circumstances might be an acceptable answer, does not provide a solution in the case of support groups. Matching disease types enables support groups to give informed prognoses to the families of sufferers and to their clinicians, who individually may not have met such a rare condition before. They help with practical advice and put sufferers and their families in touch with each other, thus improving their prospects and relieving distress and loneliness. But to do this, they need access to names and addresses and special-category data of their members, because anonymous data are of absolutely no use in this context.

Medical research would also be the loser as the Bill stands. To take one example, the MND Association, the motor neurone support group, has more than 3,000 blood samples in its collection, cell lines and accompanying clinical information. This database has been and is used in a variety of research projects to look at potential causative genes. Samples will also be used to screen potential drugs. To all this, the personal data of the individuals concerned is essential and it is not guaranteed that they will always be capable of being re-contacted.

In this context, perhaps I may quote from a statement by Public Health England in support of the work of patient support groups:

“We are clear that patient registries, particularly for individuals with less common conditions, are one of the most valuable sources for the care, research and support of patients and their families. In many cases they are the only source of information on some disorders. Some collections stretch back many years. This historical record is essential for longitudinal studies and long term follow up … These searches can only be performed on well curated, identifiable data as people change their names and locations”.

Public Health England goes on to say that the question is about the adequacy of the consent obtained in the first place and whether it meets the enhanced rights of data subjects under the GDPR. Absolutely—there is no argument that the consent at the outset needs to be of a good standard so that subsequent use of personal data can be validly based on it.

My amendment would confine the special provision that I am proposing to members of organisations for specific purposes which I would hope we could all agree lie in the public interest. It would not open the floodgates to a collection of streams of unconsented personal data for undefined purposes. I therefore hope that the Government can agree to my amendment.

Lord McNally (Liberal Democrat)

My Lords, as my noble friend Lord Clement-Jones indicated, I shall speak to Amendments 41 and 44, which were eloquently introduced by the noble Lord, Lord Griffiths. I had no idea that it was a maiden speech from the Front Bench, and it is to the discredit of the Labour Party that it has taken him so long to climb to the top of the greasy pole. Having got there, I hope that he enjoys the view.

As the noble Lord indicated, these amendments are inspired mainly by Thomson Reuters and others in the City. I attended a seminar in the City some weeks ago in which the corporation, the City of London Police and some leading companies talked about the challenges that data was bringing them. At the core of this is a concern that the Bill is loosely and poorly worded in preventing private companies doing work with data which will help them to keep best practice in line with the objectives for corporate governance and efforts to fight crime, terrorism, slavery, bribery and corruption.

I hope the Minister can give some comfort that the Bill will give cover to companies, financial institutions and others to carry out this kind of data activity and allow screening by private companies for the purposes of checking against non-UK laws on terrorist financing or money laundering. It should be amended to allow compliance with widely recognised guidelines such as those promulgated by the Financial Action Task Force. In the light of the Minister’s response and in consultation with those who have asked us to raise this matter, we would see whether we wanted to take it further. At the source of these amendments is a concern on the part of companies which I think genuinely want to help.

Lord Lester of Herne Hill (Liberal Democrat)

My Lords, I want to raise an issue which I would be grateful if it were thought about, although I would not dream of asking the Minister to give an informed reply today. I am puzzled especially by Amendment 37, spoken to by the noble Lord, Lord Griffiths, because I spent a good deal of my time developing the Equality Act 2010 and we were very concerned when doing so about issues of personal privacy and enforceability.

Obviously, one size does not fit all when it comes to equal opportunity and treatment. It is fairly easy to operate a policy measuring ethnicity, for example, without any problem about privacy; it is pretty easy to do so in respect of gender, although gender does not at the moment figure in the list for some reason, but it becomes terribly difficult when one is dealing with sexuality, religion or philosophical belief, which are for some reason in the list at the moment. I would be grateful if the Minister could reflect with people from the Government Equalities Office on whether this is an example of overlegislation, which it would be much better to prune down.

I am all in favour of affirmative action to promote equality between the sexes or people of different ethnicity, but when it comes to religion, philosophical belief and the other matters that are either there at the moment or would be there under Amendment 37, I get very worried. For example, I once represented the Church of Scientology—successfully—in establishing that scientology is a religion. I would not like these provisions to be the source of conflict and division between one kind of religion and another, or one kind of no religion and humanists, and so on. I think it is an example of overlegislation and underlegislation, and needs to be sorted.

Lord Ashton of Hyde (Conservative)

My Lords, I am grateful to all noble Lords who have participated. I am especially grateful for the clear way in which the noble Lord, Lord Griffiths, outlined the case for all his amendments. He could have chosen an easier Bill to start on, I must say, but he did it very well. I am grateful for the opportunity to set out the purpose of various conditions included in Schedule 1, this time specifically with reference to Part 2.

As we have already discussed, for “special categories of data” to be processed lawfully, controllers must demonstrate that their processing meets one of the processing conditions set out in article 9 of the GDPR. We have already touched on several of these. Here we turn to processing which is,

“necessary for reasons of substantial public interest”.

Clause 9 requires that controllers wishing to rely on this processing condition must meet one of the conditions set out in Part 2 of Schedule 1.

Paragraph 7 of Schedule 1 allows processing of certain specified special categories of personal data for the purpose of promoting equality of opportunity. Amendment 37 seeks to expand this condition to permit the processing of additional categories of personal data. This is unnecessary because the categories of data referred to in the amendment are either not considered by the GDPR framework be special categories of data in the first place or covered by the categories already listed in paragraph 7 of Schedule 1; for example, “Personal data revealing age” need not be listed because it is not subject to additional protection to begin with.

The Government accept that the existing special categories of data are broad and in some circumstances will overlap with the categories of data suggested in the amendment; for example,

“Personal data revealing a disability”,

will fall within the special category of “Data concerning health”. But in these cases, paragraph 7 already permits the processing of such data for equality-monitoring purposes. I will read carefully the remarks of the noble Lord, Lord Lester. I suspect his point is to do with what is and what is not a special category of data, but I will read Hansard and write to him, and copy other noble Lords. I thank him for not requiring a considered answer tonight.

Amendments 38 and 39 address the condition in paragraph 8 which permits the processing of data where this is,

“necessary for the purposes of the prevention or detection of an unlawful act”.

Amendment 38 would make it clear that the condition was available only if the unlawful act in question was “serious”. I can understand the rationale behind the amendment but the Government consider that it might nevertheless be in the substantial public interest for an organisation to process data for the prevention or detection of an unlawful act that was not obviously “serious”. An offence such as driving without a licence or insurance may not be the most serious in terms of the maximum penalty available, but it could still be in the substantial public interest for it to be reported by the data controller. Paragraph 8 ensures that data controllers are empowered to make that call and be accountable for their decision.

Amendment 39 would make the condition available only,

“under circumstances in which it is reasonably clear that a data subject is unlikely to give consent”.

While similar provision is made in other conditions where required, the Government consider that it would not be appropriate in this case, given that the purpose is to process data in circumstances where seeking consent risks prejudicing the prevention or detection of an unlawful act.

Amendment 40 would remove the word “dishonesty” from paragraph 9(2)(a) so that an organisation could rely on this provision only if it were processing sensitive categories of personal data to protect the public from malpractice, other seriously improper conduct or the other listed behaviours. The Government consider that there might be situations where an organisation would also need to process data to protect the public from dishonesty that does not necessarily amount to malpractice or improper conduct. It is therefore right that the paragraph covers the full gamut. This processing condition is not new; a similarly worded provision already exists under the current Data Protection Act.

The noble Lord, Lord Griffiths, suggested that there was a need for a further definition of “dishonesty”. I am afraid we do not agree. The word has a plain English meaning, defined in the dictionary. Furthermore, to define it here would cause confusion as it is used throughout UK legislation.

Amendment 41 would extend the scope of the same processing condition so that it could also be used to protect bodies and associations, rather than just the general public, from dishonesty, malpractice and improper conduct. It is one thing to allow the processing of an individual’s personal data for the purposes of protecting the general public—that is, other individuals; there is a neat symmetry there—but quite another to suggest that it could be processed to protect organisations from reputational harm. On that basis, I cannot agree to include it.

Amendments 43 and 44 address the processing condition in paragraph 12 which allows organisations such as banks to make disclosures “in good faith” under the Terrorism Act 2000 and the Proceeds of Crime Act 2002 about third parties who are suspected of terrorist-financing offences or money laundering. This processing condition is intended to protect organisations that disclose data on the basis of a genuine suspicion, even if it turns out later not to have been well founded. Noble Lords will recall that this condition was debated and agreed to as part of the Criminal Finances Bill earlier this year. The condition is tied to the improvement of a specific statutory regime—known as the suspicious activity reports regime—and is designed to give legal clarity to encourage the sharing of information to prevent serious crime and terrorism. I know there are some in the financial sector who have suggested that these provisions should go further to permit screening by private companies for the purposes of checking against non-UK laws on terrorist financing and money laundering. As noble Lords may be aware, the relevant provisions in the Criminal Finances Act were commenced only at the end of last month. We are not convinced that there is a need to amend them at such an early stage.

Amendment 45 would amend the processing condition relating to,

“confidential counselling, advice or support”,

in paragraph 13. It would add “guidance” to the list of processing activities which are permitted under this provision. This paragraph is not new; the relevant wording is drawn directly from existing legislation. But I am happy to put on the record the Government’s view that guidance is already covered by this provision and thus there is no need to amend it.

Amendments 45A and 64 in the name of my noble friend Lady Neville-Jones seek to clarify the legal status of processing by patient support groups. The Government strongly support the varied and important work of patient support groups and I am grateful for my noble friend’s time in meeting me recently. It is important to reiterate that groups such as Unique will have access to a number of provisions already in the Bill, even in cases where consent cannot be obtained, or reobtained, from the data subject.

We discussed the provisions for scientific research last week. In addition, paragraph 13 of Schedule 1 makes provision for confidential counselling, advice and support. Taken together, the provisions I have mentioned—for consent, scientific research, and confidential counselling, advice and support—seem to cover a great deal of the vital work undertaken by patient support groups. But the Government retain an open mind on this and I will read my noble friend’s contribution in Hansard carefully.

Amendment 52 would amend the processing condition relating to occupational pensions contained in paragraph 16. At the moment, processing in relation to occupational pensions forms part of a processing condition in relation to insurance. In drafting the Bill, the Government have simply decided, in the interests of clarity, to give it a processing condition in its own right.

I turn now to Amendments 35, 67 and 68, which concern the requirement for data controllers to have an appropriate policy document in place when processing special categories of personal data and criminal convictions data in certain circumstances. The requirement for an appropriate policy document is new; there is no such requirement in the current Data Protection Act. It further enhances the Bill’s commitment on transparency and the protection of individuals’ data. Paragraph 31 requires that the data controller make the policy document available to the Information Commissioner on request and without charge. We consider that the Information Commissioner is best placed to consider whether the policy document meets the technical requirements and can take any further appropriate action, if required.

In considering whether there is value in extending a similar right to data subjects, as Amendment 35 does, it is worth noting that controllers will be obliged to provide data subjects with clear and comprehensive information on how their personal data will be processed as well as on their associated rights as data subjects. This obligation attaches to all data controllers, not just those required by the Bill to maintain an appropriate policy document. If, on the basis of the information provided, a data subject believed that there had been a breach of the law, they would be able to raise their concerns with the Information Commissioner who has powers under the Bill to investigate and take action in respect of breaches of data protection law.

Finally, I turn to recent Amendments 21A and 66A tabled by the noble Lords, Lord Clement-Jones and Lord Paddick. As we have heard, article 9(1) of the GDPR prohibits the processing of sensitive categories of data, including biometric data which can be used to identify someone, unless the conditions in article 9(2) can be satisfied. As the noble Lord, Lord Clement-Jones, explained, article 9(4) allows the UK to introduce further conditions with regard to the processing of biometric data. These amendments propose to do that by creating a new part in Schedule 1 dealing with the processing of biometric data to make it clear that biometric data can be processed where it is used as a security feature to access a service that the data subject has chosen to use. As the noble Lord explained, many of us are familiar with the verification devices on mobile phones and computers which allow the user to access the service using fingerprint recognition.

Lord Maxton (Labour)

I have fingerprint identification on my mini iPad, but I also have a password. Sometimes the fingerprint will not work, and you have to use the password.

Lord Ashton of Hyde (Conservative)

I agree. I have the same. You have to put in your numerical password every so often just to check that you have still got the same finger. Technically, you might not have.

The amendments also seek to permit the processing of such data when biometric identification devices are installed by employers to allow employees to gain access to work premises or when the controller is using the data for internal purposes to improve ID verification mechanisms. I am grateful to the noble Lord for raising this important issue because the use of biometric verification devices is likely only to increase in the coming years. At the moment, our initial view is that, given the current range of processing conditions provided in Schedule 1 to the Bill, no further provision is needed to facilitate the activities to which the noble Lord referred. However, this is a technical issue and so I am happy to write to the noble Lord to set out our reasoning on that point. Of course, this may not be the case in relation to the application of future technology, and we have already discussed the need for delegated powers in the Bill to ensure that the law can keep pace. I think we will discuss that again in a later group.

On this basis, I hope I have tackled the noble Lord’s concerns, and I would be grateful if he will withdraw the amendment.

Lord Clement-Jones (Liberal Democrat)

My Lords, as usual the noble Lord, Lord Maxton, has put his finger on the problem. If we have iris recognition, he will keep his eye on the matter.

I thank the Minister for his explanation of the multifarious amendments and welcome the maiden speech from the Front Bench by the noble Lord, Lord Griffiths. I do not think I can better my noble friend Lord McNally’s description of his ascent to greatness in this matter. I suspect that in essence it means that the noble Lord, Lord Griffiths, like me, picks up all the worst technical amendments which are the most difficult to explain in a short speech.

I thought the Minister rather short-changed some of the amendments, but I will rely on Hansard at a later date, and I am sure the Opposition Front Bench will do the same when we come to it. The particular area where he was disappointing was on what you might call the Thomson Reuters perspective, and I am sure that we will want to examine very carefully what the Minister had to say because it could be of considerable significance if there is no suitable exemption to allow that kind of fraud prevention to take place. Although he said he had an open mind, I was rather surprised by his approach to Amendments 45A and 64 which were tabled by the noble Baroness, Lady Neville-Jones. One will have to unpick carefully what he said.

The bulk of what I want to respond to is what the Minister said about biometrics. I took quite a lot of comfort from what he said because he did not start quoting chapter and verse at me, which I think means that nobody has quite yet worked out where this biometric data fits and where there might be suitable exemptions. There is a general feeling that somewhere in the Bill or the schedules we will find something that will cover it. I think that may be an overoptimistic view, but I look forward to receiving the Minister’s letter. In the meantime, I beg leave to withdraw the amendment.

Amendment 21A withdrawn.

Lord Stevenson of Balmacara (Labour)

My Lords, I rise to speak to another rather wide-ranging group, in terms of numbers, although I think we will find the amendments are a theme and variation on an issue that will run through not just this Bill but a number of Bills to come. I refer to secondary legislation and powers in the future when it is necessary for the Government of the day to try to change that which has been set down in primary legislation in the past.

Amendment 22, which kicks this off, is taken very largely from the report of the Delegated Powers and Regulatory Reform Committee. I make no apology for that. I think it is a very good report, as always, from that committee which does a fantastic job on what we are doing. I think I am probably interposing in a dialogue that may be carrying on out of our direct ken since normally in this matter one would get a memorandum, which I think we have seen, and I thank the Minister and the Bill team for that. The first response from the Delegated Powers and Regulatory Reform Committee will make some comments and I think it likely that the Minister and his colleagues will respond to that. We are only in the early stages, so I suspect we are a bit previous on this point.

However, this is an issue of some substance that may well be in all the Brexit-related Bills soon to arrive in your Lordships’ House, which suggests that we might just have a quick canter around it at the moment.

In preparing for this particular area, I had thought that we would just stick with Clause 9, but I was drawn into also putting in Clause 15, because there is an interesting point here that I wanted to raise with Ministers. The noble Lord, Lord Whitty, the noble Baroness, Lady Jones, and the noble Lords, Lord Clement-Jones and Lord Paddick, have had less restraint, and therefore we are covering quite a large number of the issues raised by the DPRRC. I look forward to hearing the response and to the wider contributions from those who have tabled amendments in this group.

The main theme that seems to run through this is what the committee says in paragraph 20 of its recent report, that,

“we take the view that the memorandum does not adequately justify the breadth of the power in clause 9(6) of the Bill, and that it is inappropriate for Ministers to be given carte blanche to rewrite any or all of the conditions and safeguards in Schedule 1 by regulations in order ‘to deal with changing circumstances’ instead of bringing forward a Bill”.

The committee then slightly changes its position by recognising that currently this is under the affirmative procedure, quite a strong measure to have in play in legislation, and suggesting an alternative approach:

“It may be appropriate … for Ministers to have a more focused power enabling them to update specific paragraphs”.

Maybe that is a line the Government will take. The essence of this is Henry VIII powers—how egregious they are and how bad it would be in future to come across them. At the same time we have to balance that against the obvious need, particularly in this Bill—as we have already discussed we are talking about fast-moving technology, although it applies in other areas—for some flexibility on the part of the Government of the day to bring forward amendments and changes as and when required. It is a balance and has to be struck properly, but the first shots in this have tended to be that Ministers are too aggressive. We await further discussions, but that is the ground which we will be traipsing around.

Amendment 106A relates to Clause 15(1)(b), at line 44 on page 8, which talks about,

“the power in Article 23(1) to make a legislative measure restricting the scope of the obligations and rights mentioned in that Article where necessary and proportionate to safeguard certain objectives of general public interest.”

I take this to be a quote from the GDPR. It is therefore couched in language which I think would be unexceptional if we were transposing the GDPR into the Bill, but of course we are not, and we are not allowed to amend it. The question really is what a legislative measure is. This is not a rhetorical question, because I would like an answer. In our system, as I understand it, Secretaries of State bring forward legislation in the form of a Bill. If they are not doing that, they bring it forward in secondary regulations. But a legislative measure has no apparent meaning in terms of the work we do—maybe the Minister will confirm that this is perfectly right. But for the moment, this probing amendment not only underlines the point made by the DPRRC in relation to the power in Clause 15 but is also about the particularity of the language used. I beg to move.

Lord Faulkner of Worcester (Labour)

I remind the Committee that if this amendment were to be agreed, I would be unable to call Amendment 22A for reason of pre-emption.

Baroness Jones of Moulsecoomb (Green)

My Lords, I regret I was not able to speak to the Bill at Second Reading, but I take great delight in speaking to it this evening, on Amendments 22, 23, 107, 138 and Clauses 15 and 111. I am well aware that the Bill is extremely important. The digital age brings all sorts of opportunities for us but also lots of challenges, and it is absolutely right to keep up to date and make sure that we have legislation in place for the big questions of privacy in such rapidly changing times. When the current data protection legislation came in, most people were still getting to grips with email, and sending a text message on your mobile phone was a really fancy way of communicating. It is time that the legislation was updated.

The sheer volume and depth of personal data that are now floating around online would have been unimaginable then. We share the deepest and most personal details of ourselves quite freely these days, or at least some of us do. The Bill seeks to set important new standards for the protection of people’s data and give them more rights over how their data are used. So far, so good—for example it would allow some of us to ask the social media companies to delete any stupid comments we made a decade or so ago, which might help some MPs currently.

My problem with the Bill is twofold. Large parts of it are not about protecting people’s data or granting new rights. Significant parts of the Bill are focused on removing or reducing people’s data rights which are otherwise granted by the general data protection regulation. The noble Lord, Lord Stevenson, used the word “aggressive”, which is a very good word to use for some of these clauses. The Government are also trying to exercise too many derogations and opt-outs in the Bill. We should be aiming to protect people’s data as much as possible and restricting data rights only where absolutely necessary. This is the purpose of the amendments that I have tabled or signed.

The second problem is that this is such a power grab by the Government. We will hear a lot about this over the next few weeks and months, but the bypassing of Parliament like this by giving excessive delegated powers to Ministers is unacceptable. I can see, possibly, the need for the very occasional use of Henry VIII powers, but overall far too much power is being put into them. The Select Committee put it much better than I can:

“We draw attention to the number and breadth of the delegated powers in this Bill. This is an increasingly common feature of legislation which, as we have repeatedly stated, causes considerable concern. The Government’s desire to future-proof legislation, both in light of Brexit and the rapidly changing nature of digital technologies, must be balanced against the need for Parliament to scrutinise and, where necessary, constrain executive power”.

The privacy rights at stake in the Bill are so important that they absolutely must be properly approved by Parliament and parliamentarians. Changing these rights with delegated legislation is a nonsense. It is particularly important that Parliament remains responsible for deciding these rights, since so much of it applies to the Government’s use of personal data. We cannot allow the Government to decide what the Government are allowed. That is not a democracy; it is a dictatorship.

Amendment 22 relates to Clause 9(6). Article 9 of the GDPR has strict rules about processing particularly sensitive personal data, such as data,

“revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation”.

Processing that sensitive data is prohibited, except in a very limited set of circumstances set out in the GDPR or in legislation passed by Parliament. Schedule 1 to the Bill sets out 28 circumstances where the sensitive data is allowed to be processed, supposedly with relevant safeguards. Clause 9(6) is the Henry VIII power which allows the Secretary of State just too much power, to,

“amend … by adding, varying or omitting conditions or safeguards, and … make consequential amendment of this section”.

The Delegated Powers and Regulatory Reform Committee also concludes that Clause 9(6) is “inappropriately wide” and should be removed from the Bill. We all understand that there will be negotiations on the Bill. It is important to get it passed, but it is also important that it is passed right, and I very much hope this is one area where the Government will see sense and take out these sweeping powers. Personally, I think we must resist, with everything we have, any attempt by the Government to wrestle power over which of these rights are protected and which are not.

Clause 9(7) is a tidying-up provision; if Clause 9(6) is removed then subsection (7) has nothing to apply to, so it should also be removed.

In Clause 15, I put my name to Amendment 107 but I should have signed Amendment 108 as well. The super-affirmative resolution procedure would be much better than the affirmative resolution procedure as it would force the Government to have regard to the opinion of Parliament, but it would still be far from perfect. We would be much better off not having these broad delegated powers in the first place.

Amendment 130 in Clause 33 is about removing the power to amend Schedule 8 using delegated legislation. That is the same as in Clause 9, and the same applies to my amendment in Clause 84. In opposing Clause 111, I would like to remove the power to make further exemptions in relation to national security.

I look forward to seeing the Bill becoming something that we can all perhaps sign up to, but at the moment the Government are being far too aggressive and greedy for power.

Lord Arbuthnot of Edrom (Conservative)

My Lords, like the noble Baroness, Lady Jones, I understand the issues of fast-changing technology and the fact that it is very hard for primary legislation to keep up. My noble friend Lady Neville-Rolfe has asked me to express her sadness that she is unable to be here today due to a family funeral. I shall speak to the amendments in our name which, like Amendment 24, propose the super-affirmative resolution procedure.

The report by the Delegated Powers Committee speaks eloquently for itself. The arguments have been made already by the noble Lord, Lord Stevenson, and the noble Baroness, Lady Jones, and I shall not repeat them. Our amendments would do two extra things: they would put the super-affirmative resolution process in the Bill, which would make it a bit clearer—that seems more helpful—and would add a requirement for an updated impact assessment for industry, charities and public authorities. The reason for that is that the Executive could make changes under these powers, including adding a whole new technology to the data protection regime—so an impact assessment, according to my suggestion, would be essential. My noble friend Lady Neville-Rolfe and I would support any call for discussions with the Minister so that we can identify where the super-affirmative procedure should apply.

Lord Whitty (Labour)

My Lords, I have two sets of amendments in this group. The first ones are actually amendments to that of the noble Lord, Lord Arbuthnot, because, like him, I think it would be useful, given the range of delegated powers within the Bill, if we wrote the super-affirmative resolution into the Bill. If we do not succeed in greatly reducing the amount of delegated legislation that is permitted under the Bill—although I hope my noble friend Lord Stevenson and others do—we need to treat that delegated legislation when it is brought forward in a way that is more intensive, consultative and engaging than our normal simple affirmative resolutions.

So I support the principle of the amendment of the noble Lord, Lord Arbuthnot, and the noble Baroness, Lady Neville-Rolfe. My Amendments 182A to 182C would simply add an additional dimension. As I read the amendment at the moment, it is emphatic on getting the Government to identify the impact on industry, charities and public bodies. The main point that we are all concerned about is actually the impact on individuals, the data subjects, yet they are not explicitly referred to in the draft of the amendment before us. My three amendments would therefore effectively do two things: first, they would require the Minister to consult data subjects or organisations representing them, such as consumer organisations, as well as those stipulated in the amendment as it stands; and, secondly, they would ensure that the impact assessments related to the impact on individuals as well as on organisations. I hope that the noble Lord would agree to my amendments at whatever point he and the noble Baroness propose to put this to the vote, in which case I could fully support their amendment.

My Amendment 22A is a specific example of the themes that my noble friend Lord Stevenson and the noble Baroness, Lady Jones, have already spelled out. I will not repeat everything they said but it is a particularly egregious form in that it allows the Minister—the noble Baroness, Lady Jones, has already referred to this—to add, vary or omit any safeguard that is in Schedule 1. I particularly object to “omit”. That does not simply mean modifying or tinkering in order to keep up with the technology; rather, it means omitting a serious safeguard that has been put in the Bill during its passage through Parliament.

Since Schedule 1 is pretty wide ranging, this could include issues that related to legal proceedings, crime, taxation, insurance, banking, immigration, public health or indeed any aspect of the public interest. That is a huge range of potential removal of safeguards that would not be subject to the approval of this House through primary legislation. If the safeguards persist and are maintained through the Bill when it eventually emerges, the ability of Ministers to vary them so drastically should be curtailed. I understand that my amendment would be pre-empted if my noble friend Lord Stevenson’s amendments were carried—but if they are not we definitely need to alter that clause.

This is a complex Bill because of the technology and because of the juxtaposition between European legislation and the position we are currently in with regard to it. The Bill is also an exemplar of what we are going to go through in Brexit-related legislation in a much wider sense. We must get right how we deal with delegated legislation post Brexit, and we need to ensure that the Bill is an example and does not concede powers to Henry VIII or indeed to the Minister that we might regret when his successors made use of them later.

Lord Clement-Jones (Liberal Democrat)

My Lords, I can be very brief. I have not yet quite got through the concept of the Minister as Henry VIII. There is a clear common theme coming through every speech in the House today. The issue is whether the Government’s arguments for the use of the powers contained in the various clauses that have been mentioned—my amendments from these Benches, Amendments 24 and 107, relate to Clauses 9 and 15, but there is a broader issue—are credible and whether their desire for flexibility is convincing. As many noble Lords have mentioned, the Delegated Powers Committee did not find them particularly credible and stated:

“We regard this is an insufficient and unconvincing explanation for such an important power”.

That applies to Clause 15, but we on these Benches believe that the power in Clause 9 should not be there in its present form, either.

We have tried to be constructive. We have put forward a suggestion, as has the noble Lord, Lord Arbuthnot, for the use of the super-affirmative power. That is extremely well known and is enshrined in legislation—so, unlike the noble Lord, we did not feel the need to spell out exactly what the procedure was because it is already contained in a piece of legislation that I will no doubt come across in my notes at some suitable moment. It is now an extremely common and useful way of giving the Government flexibility, while allowing sufficient consultation before any regulations come to the House by affirmative resolution. We recognise that this could be fast moving, so it may be appropriate that the Government have those powers, provided that they are governed by super-affirmative resolution.

I expect that the BMA has made its views known to the Government. It is particularly concerned, in the context of Clause 15, that the Bill could give the Government an inappropriate fast-track power, for instance, to change the law on how confidential health data are shared, with little scrutiny or oversight. That is but one example of why we believe that amendments should be made.

I suppose that it depends on how the parties come together after Committee to agree on the best form of action in response to these Henry VIII powers—but I suspect that, on Report, there will be a deal of contention on the matter.

Lord McNally (Liberal Democrat)

I can imagine how it was when the legislative programme was discussed in the Cabinet Office, or even at No. 10: how on earth do we get all this through? I am sure that the Civil Service advice was—or at least one adviser said—“Well, you could try by Henry VIII powers and lots of secondary legislation. Looking at the present rules, that is the only way that we think you could get it through in that timetable”. And so the process started.

I know that the big problem for Ministers in this House is that there will be great impatience in No. 10 and down the Corridor at any delays or defeats—but, as has been said a number of times, they are going about it the wrong way. We are heading for a constitutional car crash unless there is intervention at the very highest level to look at this problem. It is a twin problem: how do you give flexibility to make legislation fool-proof in a rapidly changing technological situation, which is one of the central problems for the Bill; and how do you deal with Brexit legislation in such a tight timetable?

I know what cannot happen. It would be the irony of ironies if an exercise that was supposed to return sovereignty to this Parliament ended up with this Parliament accepting a whole range of precedents that diminished its sovereignty. Therefore, although it is unfair on each Minister, this debate will continue take place, and I hope that when we get to Divisions we will put a halt to this solution, so that some really hard thinking will be done about how to achieve the end of the Government getting their business through without sacrificing parliamentary sovereignty.

Baroness Chisholm of Owlpen (Conservative)

My Lords, I welcome this opportunity to set out the Government’s position on various delegated powers contained in the Bill, which have been the subject of recommendations by the Delegated Powers and Regulatory Reform Committee. The Government are very grateful to the committee for its usual thoroughness in examining the delegated powers in the Bill, but I should begin my remarks by saying that the committee’s report, which ran to some 20 pages, was published only on 24 October, so we are still considering its conclusions and recommendations. The range of views expressed in tonight’s debate will be further input into that process.

The current Data Protection Act has stood firm for almost 20 years. This one will be in danger of lasting barely two if we start striking out the delegated powers contained within it. As the noble Lord, Lord Stevenson, and the noble Baroness, Lady Jones, said, such is the pace of change in this area that we need to keep up with what is going on. Furthermore, new forms of data processing not yet dreamed of will have been designed, developed and deployed even before the Bill reaches Royal Assent. It is essential that the law can keep up.

It is also worth reminding ourselves that the Government have taken the opportunity to include directly in the relevant schedules numerous provisions which had previously been included only in secondary legislation. The noble Lord, Lord Stevenson, has been extremely busy, and has taken the opportunity to table more than a dozen amendments to Schedule 1 alone. We will of course turn to those shortly.

That said, the Government recognise that there is tension between the need to provide for appropriate future-proofing of legislation, such provided for in Clauses 9, 15, 33, 84 and 111, and the need to ensure proper parliamentary scrutiny of the resultant delegated powers. It follows that we are open to constructive suggestions as to how provisions in the Bill can be improved and, obviously, that includes its regulation-making powers.

I have listened with care and interest to the case put forward by my noble friend Lord Arbuthnot, the noble Lord, Lord Clement-Jones, and the noble Baroness, Lady Jones, for the application of the super-affirmative procedure. I am also grateful to the noble Lord, Lord Whitty, for reminding us that data subjects, not just data controllers, have an interest in the proper application of these powers.

I am sure that noble Lords will agree that the amendments before us should be considered in the context of the broader recommendations of the Delegated Powers and Regulatory Reform Committee report. As I said earlier, the process of considering these issues is still ongoing, but I am more than confident that it will conclude in time for the Bill’s next stage.

Before I conclude, I think that the noble Lord, Lord Stevenson, asked what was meant by “legislative measure”. Clause 15(1)(b) uses the term “legislative measure” to reflect the wording used in Article 23 of the GDPR. Recital 41 makes clear that a legislative measure would include an Act or statutory instrument. I hope that that answers the question.

I therefore humbly invite the noble Lord to withdraw his amendment on the understanding that we return to this important issue on Report.

Lord Stevenson of Balmacara (Labour)

I thank all noble Lords for their contributions; we have had a very good go at this, which has raised all the big issues. The Minister made a positive response, with a sideswipe at me for being too active on the amendment front; but that is what we do, and we expect you to be able to deal with them without too much worry. We are enjoying this debate and will have lots of things to come back to on Report because of the interesting points being made.

However, on this issue, we are slightly narrower. The Government have got themselves into a bit of a hole here. I appreciate the wider context, and the point has been very well made. It seems to me that there are three options. They can tough it out and just say to the DPRRC that it has stepped too far from where they want to be and this is the only way forward. They can follow the DPRRC and find amendments that they can bring back at Report—I think the Minister was talking about Report; later than that would be too late. We are talking here about narrower powers to define down the areas within which discretion is operated. Or, to follow the point made by the noble Baroness, Lady Neville-Jones, and the noble Lord, Lord Arbuthnot—I think this is my noble friend Lord Whitty’s concern and is shared widely around the House—the most egregious issue here is when the Government seek to omit legislation which has been passed as primary legislation by secondary legislation, or legislative measures, as we now call them.

The helpful suggestion, backed up by the noble Lord, Lord Clement-Jones—that we should have a super-affirmative measure when matters are almost of the status of requiring there to be primary legislation, but for which flexibility requires a lesser measure—seems to be the way forward. A very little research shows that “super-affirmative” has many meanings. That chosen by the noble Lord and the noble Baroness, Lady Neville-Jones, is one of about seven or eight. The Public Bill Office has published a table which noble Lords can pore over at leisure and find themselves completely confused at the end about the best route forward. I am sure the clerks will guide us as we go forward down that route. However, the best seems to be the one that provides for amendments to be made to the measure that is being considered before the vote. That is the sensibility which is being assembled around the Committee, and I hope that the Government will take it away and do it.

The noble Lord, Lord McNally, is right: there is a possibility here of a constitutional car crash. It is not restricted to this Bill, and no noble Lords who have spoken in this debate would want it to be taken, sui generis, to this Bill. It has to be taken more widely, because it is a much bigger issue. On the other hand, this provides an opportunity to go forward. In the meantime, I beg leave to withdraw the amendment.

Amendment 22 withdrawn.

Amendments 22A to 24 not moved.

Clause 9 agreed.

Schedule 1: Special categories of personal data and criminal convictions etc data

Lord Kennedy of Southwark (Labour)

My Lords, the amendments in this group are largely in my name and that of my noble friend Lord Stevenson of Balmacara and are probing in nature. We look forward to the Minister’s response, as we seek to test the provisions before the Committee.

The GDPR generally prohibits the processing of special category data, with article 9(2) of the GDPR providing for circumstances in which, on the processing of special category data, article 9(1) may not apply. Paragraph 1 of Schedule 1 states that it may not apply if,

“the processing is necessary for the purposes of performing or exercising obligations or rights of the controller or the data subject under employment law, social security law or the law relating to social protection”.

Amendment 25 would delete paragraph 1(1)(a) on page 112 of the Bill, and I hope the Minister will be able to explain to the Committee why the provision, in the form it is written in the schedule, is necessary.

Amendment 25A in the name of the noble Earl, Lord Kinnoull, and the noble Lord, Lord Clement-Jones, changes the emphasis by deleting the word “under” and replacing it with the words “in connection with”. That probably widens the scope, but it will be useful to hear the noble Lords speak to that amendment and the Minister’s response.

Amendments 27 and 28 in my name and that of my noble friend Lord Stevenson move on to the question of health and social care purposes. Specifically, these amendments delete two conditions concerning,

“the working capacity of an employee”,

and,

“the management of health care systems or services or social care systems or services”.

When the Minister responds, will he specifically address why paragraph 2(2)(b) of Schedule 1 is deemed necessary? Will he give the Committee some examples of the data on the working capacity of an employee that would be collected under this provision of the assessment? It would also be helpful to understand why paragraph 2(2)(f) of Schedule 1 is necessary and why it would not be covered under paragraphs 2(2)(d) and 2(2)(e).

Amendment 29 would delete paragraph 3(a). We have tabled the amendment simply to enable the Minister to state clearly and to put on the record why this sub-paragraph is necessary. Amendment 31 would strengthen the sub-paragraph by putting the words,

“who owes a duty of confidentiality”,

after “health professional”. Those words are used in paragraph 3(b)(ii) and we can see no reason why they are not used in 3(b)(i). If the Minister thinks that they are not necessary then will he say so clearly for the record and explain his reasoning carefully? Amendment 70 puts the words in the same context on the face of the Bill.

Amendments 31 and 32 concern paragraph 4 of Schedule 1. They would sharpen up and widen the definition in the Bill and make it clearer that “archiving” includes collections of physical and digital materials. The wording in the Bill at the moment is a big weakness and these amendments, and Amendments 33 and 34, help improve it.

The final amendment in this group would add to Clause 15 a subsection which puts into the Bill a clear restriction that if there is a common law duty of confidentiality it cannot be overridden by regulations under the Act. That is an important safeguard that belongs on the face of the Bill. There is a lot here for the Committee to debate. I beg to move.

Countess of Mar (Crossbench)

If this amendment is agreed, I cannot call Amendments 25A or 26 because of pre-emption.

Earl of Kinnoull (Crossbench)

I speak to Amendment 25A and declare my interests as set out in the register, particularly those in respect of the insurance industry. I thank the noble Lord, Lord Kennedy of Southwark, for a clear introduction to his thinking. I am also looking forward to hearing what the Minister says later on.

Amendment 25A is essentially a probing amendment relating to another problem of unintended consequences of the Bill’s far-reaching provisions. The impact assessment, in its section entitled “policy objectives and intended effects”, talks of setting new standards in accordance with the GDPR,

“whilst preserving existing tailored exemptions from the Data Protection Act”.

Later on, the assessment talks about ensuring that,

“the burden on business is kept minimal”.

Amendment 25A is designed to avert just such an unintended consequence which, although small in words, would be substantial in effect for insurers and therefore affect people who want to take out policies. Without this amendment, the Bill would affect insurers’ ability to process data in relation to obligations in connection with employment law. In short, they will have to redesign all their processes in what is a substantial and important area. The amendment changes the wording back to that in paragraph 2(1) of Schedule 3 to the Data Protection Act 1998, so that insurers can continue to use existing procedures. It is entirely consistent with the GDPR, in particular with article 9(2)(b), which is the bit which affects this and calls for safeguards. I can think of no better watchdogs than the Information Commissioner’s Office and the FCA. I therefore feel that this amendment should be uncontroversial and look forward to hearing the Minister’s reasoning on it. I would welcome discussions outside the Chamber should he want further detail.

Lord Kakkar (Crossbench)

My Lords, I support Amendment 108A and remind noble Lords of my entry in the register regarding my duties as a doctor and medical researcher.

The overriding duty in common law to protect medical confidentiality is vital to contemporary clinical practice. There are considerable concerns that Clause 15 might provide an opportunity for that duty to be overridden through the application of future regulations. It is important for Her Majesty’s Government to establish that that is not possible and could not be the case in the future. The provisions in common law regarding medical confidentiality provide further safeguards for healthcare data beyond those provided in current data protection regulation and statute. It would be a retrograde step if provision were made that destroyed those safeguards. That might be manifested in a greater reluctance for individual patients to share their confidential information with healthcare professionals. This may result in a poorer ability for the public interest to be satisfied and safeguarded in terms of collecting data on important public health issues. It may also result in greater reluctance for individuals to participate in medical research or to provide their data for fear that it may be shared in the wrong way. Can the Minister provide reassurance that the application of Clause 15, as drafted, would not result in undermining this common law duty, and therefore have serious unintended consequences in the future? If Her Majesty’s Government are not able to provide that reassurance, how would they go about dealing with Clause 15? Would they include in the Bill a measure such as that proposed in Amendment 108A, or what other mechanism would they provide to ensure that this vital common law duty is in no way affected in the future?

Lord Lucas (Conservative)

My Lords, I offer a slight contrast to that. I hope that this clause will help with a couple of sorts of problems that I have come across over the last 20 or 30 years. One concerns children at university who become suicidal and their parents are never told because everybody believes they have a duty of confidentiality and cannot communicate with the parents. A friend of mine got very close to going over the edge but fortunately one of his friends told his parents and then everything got sorted out. Suddenly regarding parents as aliens when someone is 18 and in severe psychological difficulty is an uncomfortable effect of the way that current regulations are perceived. I hope that this provision might loosen things up.

Another aspect is dealing with schoolchildren with eating disorders. Many aspects of eating disorders present as social interactions with other children. However, if there is an absolute prohibition on discussing someone’s condition with other children, even the children who share a bedroom with them in boarding school, that seems to me destructive of the interests of the child. Therefore, I would like to see—and I hoped that I was seeing—a slight broadening of the current regulations which might lead to arrangements which allowed the best interests of the patient to come into effect rather than a strict adherence to the dogma of, “We can’t tell anybody”.

Lord Lester of Herne Hill (Liberal Democrat)

My Lords, the Minister rightly signed on the face of the Bill his statement of its compatibility with the European Convention on Human Rights. I wonder whether the answer to the question of the noble Lord, Lord Kakkar, is not provided by the Human Rights Act itself, which says that all legislation, old and new, must be read—and given effect, if possible—compatibly with the convention rights. One of those convention rights is the right to privacy. The right to privacy embraces the equitable duty of confidentiality referred to by the noble Lord, Lord Kakkar. Therefore, the reassurance is given by the Human Rights Act rather than by anything else. The relevant provisions of this Bill would have to be read compatibly with that. However, I may be speaking out of turn.

Lord Patel (Crossbench)

My Lords, if I have understood the noble Lord, Lord Lucas, wrongly, I am sure that he will correct me. However, the impression he gave was that the confidentiality between a doctor and a patient forbids the doctor to inform a family member if the patient is likely to suffer harm, even self-inflicted harm. That is not the case. The doctor is bound to respect confidentiality, but if that is likely to result in not informing the family of the harm that may be caused to a patient, or distress to the family, it is not true that confidentiality will still hold.

Lord Lucas (Conservative)

My Lords, I am glad to know that. I have not dealt directly with a doctor on this at all but rather with university and school authorities. In those cases—not steadily and not, thank goodness, frequently—I have encountered a complete unwillingness to risk telling anybody anything for reasons of confidentiality. I hope that principle is misunderstood, but this certainly happens. In cases where there is a very clear principle of confidentiality, the circumstances under which it can reasonably be interpreted as being in the best interests of the patient to breach it need to be better understood by people who are not medically trained so that they feel confident in passing the information back. I am not trying to create law in an extremely difficult area. I hoped that the Bill might lead over time to universities feeling that parents were part of the solution, and to schools feeling that other children were part of the solution, and feeling confident that guidelines had been evolved which allowed them to seek support for these children beyond just their own tight resources. I am delighted to hear what the noble Lord said but that is not what gets through once it has been through the filter of university, at least on the occasions that I have dealt with it. I probably see the cases that go wrong. If something has worked out right, there is no reason why it should come to me.

Lord Ashton of Hyde (Conservative)

My Lords, I am grateful to noble Lords who have spoken and for the opportunity to set out the purposes of various conditions included in Part 1 of Schedule 1.

It is worth recalling that, in order for special categories of data to be processed lawfully, controllers must demonstrate that their processing meets one of a defined list of processing conditions set out in article 9 of the GDPR. Many controllers will meet this requirement by seeking the explicit consent of the data subject but the reality is there will be circumstances where it would not be appropriate, or indeed possible, for a controller to seek consent. In these cases, alternative conditions include processing which is necessary for the purposes of employment and social security; for the provision of health or social care; for public health; and for archiving and research. But for UK controllers to take advantage of these particular processing conditions, the UK must make suitable provision in UK law. That is what the conditions set out in Part 1 of Schedule 1 seek to do.

Paragraph 1 of that schedule, referenced in Amendment 25, refers to the processing of sensitive personal data where necessary for exercising obligations under employment law, social security law or the law relating to social protection. This is a specific category under article 9(2)(b) of the GDPR, and paragraph 1 gives it legislative effect.

It is true that the 1998 Act did not refer to social security and social protection law, but the GDPR gives them specific emphasis in recognition of the reality that processing of special categories of data may be necessary for the purposes of calculating social security benefits or arranging interventions by social services when people are in need of support. In practice, it may not be possible to obtain consent to every measure or decision which is taken about a person when arranging benefit payments or care provisions. Amendment 25 would remove paragraph 1(1)(a) from Schedule 1, making this clause ineffective and closing off a potentially valuable processing condition to social services and other care providers.

The noble Earl, Lord Kinnoull, and the noble Lord, Lord Clement-Jones, suggested in Amendment 25A that “under” employment law should be replaced with “in connection with” employment law. I appreciate the sentiment behind the amendment, which is to ensure that the provision does not operate too restrictively. However, the Government are satisfied the term is sufficiently broad to cover processing that would have been permitted for these purposes under the Data Protection Act, while operating within the limits of the derogation provided for by the GDPR. The new condition, which permits processing that is,

“necessary for the purposes of performing or exercising obligations or rights of the controller or the data subject under employment law”,

would have the same meaning as the Data Protection Act wording, which referred to, processing necessary for the purposes of,

“exercising or performing any right or obligation which is conferred or imposed by law on the data controller in connection with employment”.

I therefore hope the noble Lords will accept my reassurances in that regard.

Earl of Kinnoull (Crossbench)

I raise a simple point—that pretty big businesses look after the employment law insurance issues, and they are so incredibly important that they are often compulsory types of insurance because we feel that every business should have them. These huge businesses will have massive change in the way this operates because there is this change. We have just heard that it is not a change, but I hope that the Minister will accept that the insurance businesses—I had a sensitive briefing from the ABI—are worried about that. Accordingly, will he at least be prepared to have a meeting to go through that, otherwise there will be a lot of expense, fuss and bother and maybe some unintended damage to the process of an important type of insurance?

Lord Ashton of Hyde (Conservative)

I said that we believe that the term is sufficiently broad to cover processing that would have been permitted hitherto, which the noble Earl refers to. However, of course, if we have got it wrong and if the insurance industry has a point it wants to bring up, it would be sensible and I would be delighted to meet him and the industry to discuss that. As I said before, we have an open mind, so I will certainly do that.

On the provisions in paragraphs 2 and 3 of Schedule 1 on health and social care, and public health respectively, which are the focus of Amendments 27 to 29, it is fair to say that the drafting here has moved on slightly from the approach taken in Schedule 3 to the 1998 Act. However, article 9(2)(h) of the GDPR refers specifically to processing which is necessary for,

“the assessment of the working capacity of an employee”,

and,

“the management of health … care systems”.

Article 9(2)(i) refers specifically to processing which is,

“necessary for reasons of public interest in the area of public health”.

The purpose of paragraphs 2 and 3 of Schedule 1 is to give these GDPR provisions legislative effect. To remove these terms from the clause by virtue of Amendments 27 to 29 would mean that healthcare providers might have no lawful basis to process special categories of data for such purposes after 25 May. I am sure that noble Lords would agree that that would be unwelcome.

The noble Lord, Lord Kennedy, asked some questions on paragraph 2 and asked for an example of data processed under paragraph 2(b). An example would be occupational health. The wording of paragraph 2(2)(f) of Schedule 1 is imported from article 9(2)(h), and I refer the noble Lord—I am sure that he has remembered it—to the exposition given in recital 53.

Paragraph 4—the focus of Amendments 32 to 34—provides for the processing of special categories of data for purposes relating to archiving and research. The outcome of these amendments would be to name specific areas of research and types of records. The terms “scientific research” and “archiving” cover a wide range of activities. Recital 157 to the GDPR specifically refers to “social science” in the context of scientific research, and recital 159 makes it clear that,

“scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research”.

The Government are not aware of anything in the GDPR or the Bill which casts doubt on the application of these terms to social science research or digital archiving.

Finally, on the important issue of confidentiality, Amendments 31 and 70 are unnecessary, because all health professionals are subject to the common-law duty of confidentiality. The duty is generally understood to mean that, if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent. However, beyond relying on the common-law duty of confidentiality, health professionals and social work professionals are bound by the requirements in their employee contract to uphold rules on confidentiality, whether that information is held on paper, computer, visually or audio recorded, or even held in the memory of the professional. Health professionals and social work professionals as defined in Clause 183 are all regulated professionals.

I can therefore reassure the noble Lord, Lord Kakkar—I am also grateful to the noble Lord, Lord Lester, for his support with regard to the Human Rights Act—that the Government strongly agree on the importance of the common-law duty of medical confidentiality but also recognise that it is not absolute. For example, there already are, and will continue to be, instances where disclosure of personal data by a medical professional is necessary for important public interest purposes, such as certain crime prevention purposes or pursuant to a court order. I therefore cannot agree to Amendment 108A, although, as we have already said, the Government are committed to looking at the issue of delegated powers in the round. I will certainly include that in that discussion. Therefore, with that reassurance, I ask the noble Lord to withdraw his amendment.

Lord Lucas (Conservative)

My Lords, might I beg a meeting of the Minister to discuss the matter of suicidal students at university and how that will be handled under the new legislation as it is developed? This need not necessarily fit within the timescale of the Bill, but I would very much like to be able to understand policy on it and to involve universities in moving from the current unsatisfactory position.

Lord Ashton of Hyde (Conservative)

It is always a pleasure to meet my noble friend, and I am happy to do that.

Lord Kennedy of Southwark (Labour)

My Lords, I thank all noble Lords who have spoken in the debate this evening. We have touched on a number of important topics, which I hope the noble Lord, Lord Ashton of Hyde, will reflect on as we move through the Bill and look at these issues again. I make it clear that my amendments were all probing amendments to get from the Government their position on things. I was particularly pleased that the noble Earl, Lord Kinnoull, raised the issue about the insurance industry and that the Minister will meet him and representatives of the industry.

I noticed when the Minister replied to the debate that on more than one occasion he made references to recitals. He, I and the House know that the recitals will not form part of British law, so to keep relying on them is, I contend, a little weak on the Government’s part. They will have to find something a bit stronger and more solid as we move on, because, as I said, these will not form part of British law. That is an important point for the Minister to think of when he responds to amendments. For him to keep relying on them highlights the position the Government are in, which is not very good at the moment. Having said that, I beg leave to withdraw the amendment.

Amendment 25 withdrawn.

Amendment 25A not moved.

House resumed. Committee to begin again not before 8.39 pm.

Lord Tope (Liberal Democrat)

My Lords, it is a pleasure at last to move Amendment 26. I do not think that I will detain the Committee for very long on this relatively straightforward amendment. I was alerted to concerns about this matter by London Councils, which represents the 32 London borough councils and the City of London. London Councils operates services on behalf of the London boroughs on a non-statutory basis. It is concerned about the present wording of the Bill, particularly Schedule 1 and the part to which my amendment applies, which fails to consider non-statutory services in relation to the conditions that must be satisfied to meet the exemptions set out in Schedule 1.

In particular, London Councils provides the Taxicard service, which is a non-statutory subsidised mobility service for people with severe sight and/or mobility impairments. The service currently provides around 70,000 disabled, and in many cases vulnerable, Londoners with subsidised transport, for which eligibility is determined at borough level.

When applying for the service, applicants provide special categories of data to demonstrate their eligibility. London Councils is therefore data controller and processor of such data. The Taxicard service falls within the definition of social protection and is a social protection scheme as set out in EU regulation 458/2007—however, it is delivered on a non-statutory basis. The current wording of the Bill is ambiguous as to whether services such as Taxicard would comply with the exemptions set out in the Bill. Despite fulfilling the definition of “social protection” set out in EU law it is a non-statutory service in respect of UK law. As the Bill refers to,

“the law relating to social protection”,

there are concerns about the extent to which organisations such as London Councils can rely on the exemption.

Were the exemption not to apply to the scheme, London Councils would have to take measures to comply with the provisions of the GDPR. These would include periodically writing to all 70,000 members to ask their explicit consent to process their special categories of data. Given the particular cohort of members of Taxicard, it is likely that some will not understand or be sufficiently informed of the GDPR to know why they are being written to or, probably, not sufficiently capable or motivated to respond, given their underlying health conditions. In taking such measures there is a real risk that many disabled Londoners who currently benefit from the scheme would no longer be able to do so, because anyone who did not respond would have to be deemed to have withheld their consent. In such cases, London Councils would have to stop providing the Taxicard service.

I am quite certain that it is not the intention of the Government that that should happen; still less that the Bill should be the means by which it happens. I understand that London Councils met officials at the department some three weeks ago, so I hope that the Minister will be able to say, preferably, that he accepts my amendment this evening—victory is always pleasant, if unusual—but if he cannot, that he can at least give some comfort that the Government are cognisant of the problem, that they are working on it and that appropriate amendments will be made to this schedule to ensure that there is no question of any ambiguity. I beg to move.

Baroness Chisholm of Owlpen (Conservative)

My Lords, as the Minister said in responding to the previous group of amendments, in order for special categories of personal data, for example, data concerning health, to be processed, controllers must demonstrate that the processing meets one of the conditions for processing set out in Article 9. Article 9(2)(b) permits processing without the consent of the data subject where necessary for purposes of employment law, social security law and social protection law, provided that a legal basis is set out in UK law. Paragraph 1 of Schedule 1 therefore introduces the necessary processing condition.

The noble Lord queried whether the reference to “social protection law” could be removed in favour of a more general provision on social protection. I am aware that some local councils have raised concerns about whether some of the services they provide would be covered by the current wording. We are somewhat restricted by the wording of Article 9, which specifically refers to “social protection law”, so limited change is allowed. Nevertheless, I can reassure the noble Lord that the term has a broad interpretation. This is because paragraph 1(3) of Schedule 1 provides that “social protection” would include any intervention described in Article 2(b) of Regulation (EC) 458/2007 of the European Parliament. I am sure all here read the regs every night, but for those who are not familiar with that regulation, Article 2(b) covers interventions that are needed to support people who may be suffering difficulties in relation to healthcare or sickness; disability; old age; survivorship; family and children; unemployment; housing; and social exclusion. Given the breadth of issues covered, I think it would be fair to say that the current wording of the clause would cover a wide range of social services interventions.

It is worth adding that social protection law is a new ground for processing special categories of data in the Bill. It was not included in the Data Protection Act 1998 as a specific category. From that point of view, it should be more helpful to social service providers than the previous provisions in the Data Protection Act 1998 on which they currently rely.

I recognise the concern that Taxicard is a non-statutory service and therefore may not be able to use the derogation in Part 1 of Schedule 1, which uses the term,

“law relating to social protection”.

As I have already illustrated, the Government’s intention is to apply this derogation broadly. There is no desire to see vital services, which are often a lifeline to their clients, stopped. I am happy to take away the specific issue the noble Lord raised and to work with the Information Commissioner and her office to consider it further. I hope that reassures the noble Lord, Lord Tope, and I respectfully invite him to withdraw his amendment.

Lord Tope (Liberal Democrat)

My Lords, I am most grateful to the Minister for setting that out so fully and clearly. As I think I said when moving the amendment, I am quite sure it is not the intention of the Government that the Bill should have this effect, but at this stage of any legislation we always have to be particularly concerned about any unintended consequences. I will seek advice from those better able to determine such matters than I am. I am grateful to hear from the Minister that the Government are cognisant of the issue and are considering it. If necessary we can return to it at a later stage of the Bill with appropriate amendments. I beg leave to withdraw the amendment.

Amendment 26 withdrawn.

Amendments 27 to 29 not moved.

Lord Stevenson of Balmacara (Labour)

My Lords, at Second Reading I touched on the question of whether the Bill might be used as a vehicle for rehearsing some of the arguments that we have heard in your Lordships’ House about the issues raised by Sir Brian Leveson in his report. I opined at the time, and am still of the belief, that this would not be the right place to put forward those amendments again, because I would favour an initiative from the other side of the House which tried to build on some of the work that was done in the run-up to the work that was done after the Leveson report was first published, which saw all party groups coming together to try and find a way forward. It seemed that we were beginning to get ourselves into a cul-de-sac on many of these issues. Although there were strong passions and strong beliefs, and good intellectual and other reasons for taking forward some of these issues, the times had changed and the climate had moved on. It was therefore important to try and think again about what would happen.

However, I also said that maybe others would take a different view of that and come forward with amendments on these and related issues. I expressed the view that, if they did, Her Majesty’s Loyal Opposition would look at them on their merits and respond to them as and when they came up. This explains why we have not signed up to some of the amendments that are before your Lordships’ House today.

I also said that our main concern going into Committee would be to make sure that the arrangements under which we currently operated, which were largely set out in the Data Protection Act 1998, were continued. It was very important that all concerned had confidence that the transposition between 1998 and today, and going forward to 25 May 2018, was adequate and sufficient, in terms of how we approached them in relation to that Bill. I am therefore introducing Amendment 42, which is largely a probing amendment aimed at getting Ministers on the record as to whether or not they feel that the transposition has been made fairly and effectively. To the extent that there is an addition to the existing law, as I understand that to be the case, it is in response to a particular aspect of the current regime which does not seem to work well in practice. The Information Commissioner’s Office has made it clear that it feels that it could do with an additional power, which I think is provided for in the Bill, to assist with the ability to reimburse those who have been affected by actions arising from a complaint they have taken forward in relation to the press. If that is the case, I would be happy to have that confirmed. That is the reason for Amendment 42, and I look forward to hearing from Ministers how they respond to that.

In pursuit of a perfectly normal and natural wish to scrutinise the Bill as it is before us, we have two other amendments in this group. Amendment 87B was offered to us by the NUJ, and is on a question which comes up a lot when talking about intellectual property issues relating to photography—not that this is actually about that, but journalism has a common-sense meaning which is often used in language other than that of Bills to reflect all aspects of journalism, including photojournalism. But of course it is not the totality of what photographers do, so this amendment is an attempt to get on the record what Ministers believe to be the sense on page 136, in Part 5, where paragraph 24(2) states that GDPR provisions do not apply,

“to personal data that is being processed only for the special purposes to the extent that … the personal data is being processed with a view to the publication by a person of journalistic, academic, artistic or literary material”.

Given the absence of the term “photography” or “photographer”, I have a slightly rhetorical question, but one to which I am looking for an answer. Can I assume that the sense of that paragraph is that this would catch photographers?

If that is the case, since photography is often done in a way that would not always result in publication, could we have clarity about the situation if the photographers were to rely on this provision in relation to material? Say, for instance, they were taking a number of photographs of a demonstration, some of which would be used but a lot would not be, and then it was felt that there was some other purpose that those photographs could be used for—that was an example given to us by the NUJ. It was concerned that the photographer should not be discriminated against, in the sense that the work of building up a personal archive of photographs taken on the job that did not result in specific publication might not necessarily fit particularly well with that. This is just a probing amendment to see what the response to that is.

The other amendment in our name in this group is Amendment 87E, relating to an issue that has been raised by others in this group. There is what I think is meant to be a transposition from the Data Protection Act 1998 to refer to the question of whether or not the public interest is engaged, and various rules and regulations around that. The notion behind our amendment is that we are not sure it is helpful nowadays for the legislation to refer in specifics to a list of codes and practices, particularly because one of those—I reference paragraph 24(5)(c)—is not correctly described. I think others will speak to this as well. Obviously there is a code of practice that editors of major newspapers have contributed to and which works reasonably well in practice, but the danger about that as an example is that it cuts out a lot of other codes of practice that could easily be mentioned there. Having them there does not seem to advance the argument, which is that the controller must have regard to appropriate codes of practice or guidelines that exist. In the event that any question is raised by the Information Commissioner or others, it is more appropriate for that to be left more general than specific. With that, I look forward to the responses. I beg to move.

Baroness Hollins (Crossbench)

My Lords, I will speak to the amendment in my name. I am grateful to the noble Earl, Lord Attlee, who has added his name in support. I will also speak in support of the amendment in the name of my noble friend Lord Skidelsky.

First, I want to explain why the Bill in its current form does not provide an adequate balance between privacy and freedom of expression, despite claims to the contrary by some parts of the media this weekend. Freedom of expression is essential to hold power to account and to expose wrongdoing, and it must be protected. However, the public also need to be protected from those who might seek to abuse such freedoms with the primary business purpose of selling newspapers.

The need for balance was recognised by Lord Justice Leveson in his 2012 report, and these amendments seek simply to implement some of the Leveson recommendations on data protection. It is worth remembering how some newspapers exploited private data in the past. Operation Motorman was a lengthy police investigation. The Information Commissioner reported on it in 2006, detailing the kinds of information that private investigators were buying unlawfully or obtaining by deception, including bank records, medical records, tax records, benefits records, phone records—thousands of transactions obtained from just one private investigator and commissioned by journalists. The victims whose data had been illegally accessed were not celebrities or public figures being investigated for genuine public interest reasons. They were just ordinary people with tenuous connections to those in the public eye: the sister of a well-known MP’s partner; the mother of a man once linked romantically to a “Big Brother” contestant; the decorator who had once worked for a lottery winner; and the GP who was doorstepped by a Sunday newspaper in the mistaken belief that he had inherited a large sum from a former patient. All these were victims of data misuse, and we are still learning how widespread those practices were.

Some argue that that is history and that newsroom practices have changed since the Leveson report, but the economic pressures which drove newspapers to desperate practices before are even more acute now. Many of the same editors and senior executives are still in place, and many in this House will remember similar promises of reform made by newspaper editors in the wake of the Calcutt report nearly 25 years ago. Does the Minister agree that this time, it is our responsibility to act decisively to protect the public from the less scrupulous elements of the press?

There is an exemption in the Data Protection Act 1998 for journalism, and this is reproduced in the Bill, but the exemption as drafted effectively offers a blank cheque to publishers and would allow them to breach data rights with little protection for the public from abuse. The GDPR is clear: exemptions should be made only when they are necessary to reconcile the right to protection of personal data with freedom of expression. My amendments are designed to ensure that this balance is properly preserved. They have been drafted by a senior QC and are based on recommendations made by Lord Justice Leveson, himself an independent senior judge, after a public inquiry in which he heard evidence and arguments from all sides, including the newspaper industry. I should declare an interest here and remind the Committee that I gave evidence to the Leveson inquiry.

The amendments would require that a publisher which has declined to be subject to recognised independent regulation must be subject to stricter standards of data protection. Publishers which have rejected independent regulation cannot be left to breach the data rights of citizens. There must be safeguards, and the amendments bring the safeguards into line with Leveson. They offer an incentive to publications to join or establish a genuinely independent and effective self-regulator, exactly as Parliament intended in its response to Leveson and when, through royal charter, the independent Press Recognition Panel was set up. Some publishers have tried to persuade us that IPSO is an independent regulator—their supporters will doubtless make the same point today—but they are wrong: it is not independent, it is entirely owned and controlled by the newspapers themselves. As the Media Standards Trust found in an independent analysis, the publishers control IPSO’s rules, code of practice, budget and sanctions. Its independence is an illusion.

Amendment 87A is very straightforward. At the moment, the Bill would allow an exemption for personal data which is being processed solely “with a view” to publication. The amendment would reinforce privacy protection by requiring the processing of personal data to be “necessary for” publication before the exemption applied. Leveson recommended that the exemption should be strengthened precisely in this way, and I look forward to the Minister’s acceptance of that.

Amendment 87C would require that any breach of citizens’ data rights under the exemption is proportional to the public interest. The regulation specifies that a balance must be sought between free expression and privacy rights. The amendment is necessary simply to codify that balance in the exemption.

Amendment 89B and 91A would separate those publishers which have joined an independent regulator from those which have not. Those publishers which have joined an independent regulator would retain access to the full list of exemptions as originally drafted. This is because their membership of such a regulator already provides the public with protection. Those publishers which have decided not to join a recognised regulator would have access to a restricted list.

Before anyone protests, this list still guarantees freedom of the press, safeguards investigative journalism and protects confidential sources, but it limits those publishers’ ability to breach other areas of data protection law. Publishers which have rejected independent recognised regulation would lose exemptions from data protection principles 5(1)(b) and (d), which require data to be processed fairly, for legitimate purposes and to be kept accurate; article 13(1), (2) and (3), which require citizens to be notified of data obtained about them; and article 14 (1) to (4), which require information to be provided to citizens where it is acquired from a third party. The amendment, however, insists that the exemption is maintained where compliance could identify a journalistic source.

On article 15(1) to (3), which allows citizens to make subject access requests for data held on them, the amendment would retain an exemption from 15(1)(g), which allows details of a source of data to be requested, to protect journalistic sources. The publishers which had rejected independently recognised regulation would lose the exemptions under article 16, meaning newspapers would be obligated to correct any inaccurate data, and article 17(1) and (2) on the right to erasure, because a public interest exemption already exists in the article itself.

I also support Amendment 89A in the name of the noble Lord, Lord Skidelsky, to which he will speak in more detail. This would replace the code designation of IPSO’s editors’ code with any code adopted by a regulator which meets Leveson’s criteria for independence and effectiveness; in other words, as judged by the Press Recognition Panel. It is disturbing that, as written, the Bill would deprive the independent Press Recognition Panel of its role and responsibility to approve legitimate independent regulators. I trust that the Minister will confirm that it was an oversight to name IPSO in the Bill, to the detriment of any regulator approved by the Press Recognition Panel.

This amendment puts the Press Recognition Panel back in the position of approving regulators by simply de-designating the editor’ code and, instead, designating the code of any regulator which meets the Press Recognition Panel’s test for approval. Should IPSO seek recognition at any point, the code it enforces would, of course, qualify and I would urge it to take those steps. Finally, the amendments in this group show the continuing cross-party support for the Leveson inquiry recommendations. I hope the Minister will agree with me on their merit and timeliness: if not now, when?

Lord Skidelsky (Crossbench)

My Lords, Amendment 89A in my name would remove the reference on page 137, line 14, to the IPSO editors’ code—written mainly by newspaper editors and enforced by their own, industry-controlled regulator—and replace it with a reference to any code operated by a regulator which meets Leveson’s criteria for independence and effectiveness. It is wrong, in principle, to place the IPSO Editors’ Code of Practice in the Bill alongside the BBC guidelines and Ofcom code of practice, which are the approved codes of statutory bodies. Parliament has approved a procedure whereby a press regulator may apply for recognition from the Press Recognition Panel, which is an integral part of the charter system, devised by Parliament to oversee press regulation. One of the criteria set out by the panel for effective self-regulation is that the regulator,

“should be independent of the publishers it regulates”.

I do not know whether the IPSO code would pass this test, because it has never been tested; IPSO has never applied for recognition. However, I doubt it, because the code is drawn up and managed by the editors’ code committee, which is made up of nine editors and newspaper executives and three lay people, with the chairman as an ex officio member. What is more, that code could be changed by that particular committee of the newspaper industry any time it wants and there is nothing that Parliament could do about it. That means that it is quite wrong for the IPSO code to be singled out, for reasons of freedom and information, for the full range of exemptions to which the noble Baroness, Lady Hollins, referred. It would be quite wrong for it to get that status.

My amendment seeks to confine the media code of conduct to the BBC guidelines, the Ofcom code and any code recognised by the Press Recognition Panel set up by the royal charter to provide a credible balance between freedom of expression and the right to privacy. I hope that the Government and the whole House will give it sympathetic consideration. I am sorry that I did not consult more widely beforehand: I am trying to finish a book which the publishers are screaming for, but I should have done that. However, I hope that this amendment will receive consideration.

Earl Attlee (Conservative)

My Lords, I am grateful to the noble Baroness, Lady Hollins, and the noble Lord, Lord Skidelsky, for speaking to these important amendments. The noble Lord, Lord Skidelsky, need not worry about not priming the House, as it were, as we are only in Committee and this is a very early stage in the process.

I am sure the Committee will agree that data protection requires the proper balancing of rights, and the amendments in the name of the noble Baroness, Lady Hollins, address that balance in the key area of journalism. Freedom of expression must include genuine public interest journalism. It must be right that journalists and the media have special rights in respect of data protection. It is obvious that the media have a vital role in ensuring that parliamentarians and others in public life adhere to the seven principles of public service. That role would be frustrated if there was a general right for everyone, not just politicians, to know what, if anything, the media “had on them”, if I may put it that way. These amendments do no more than strike that balance correctly: to protect public interest journalism while preventing the systemic abuse of citizens’ data rights. That abuse happened at the News of the World most infamously, but it also happened on an industrial scale at Trinity Mirror titles and other newspapers.

However, these amendments would also achieve something further and equally desirable. In retaining the broader exemption for newspapers that have agreed to sign up to an independent regulator, these amendments, while protecting the public, would also encourage newspapers to sign up to a genuinely independent regulator. Your Lordships will recall that in 2013, we voted in support of implementing the Leveson recommendations to provide an incentive for newspapers to sign up to an independent regulator. This was the system the former Prime Minister, David Cameron, recommended to Parliament, which was signed up to by all major parties in Parliament at that time. That system came with incentives because Leveson was not naive enough to believe that newspapers would sacrifice control over their own regulator without those incentives, and neither was this House. It is extremely regrettable, therefore, that the Government have so far not commenced Section 40 of the Crime and Courts Act, which was passed by this House to provide the most critical of those incentives.

The former Prime Minister, Sir John Major, warned at the Leveson inquiry that there was a serious risk of one party breaking ranks on press regulation policy. Making policy sacrifices to the press is a temptation that afflicts Governments of all colours, of course. However, I hope that the Government will recognise the strength of feeling in this House. This amendment would add to the work of the incentive passed by this House in 2013: it would incentivise newspapers to sign up to an independent regulator while still protecting the public.

I turn to the amendment in the name of the noble Lord, Lord Skidelsky. The proposed designation of the editors’ code is very odd indeed, first, because the Bill names an NGO in primary legislation which might not necessarily exist even next week. Of course, I can fully understand why it would not be appropriate to have the Secretary of State designate a regulator. It would smack of state regulation of the media, which we all want to avoid. Secondly, however, it is because the Crime and Courts Act and the royal charter combined already provide a mechanism for ensuring that any press regulator is genuinely independent and effective. I therefore support the amendment in the name of the noble Lord, Lord Skidelsky, which would replace the code used by IPSO with that of any regulator which was approved by the Press Recognition Panel under the royal charter. Of course, that could include the code of IPSO, if it reformed itself to pass the modest Leveson tests for independence and effectiveness. Clearly, Parliament put the Press Recognition Panel—the independent panel free from politicians and the press—in the sole position of judging the independence and effectiveness of press regulators. The Government should not seek to override their role by specifying the editors’ code in this manner.

Finally, I make it clear that I have already written formally to my noble friend the Chief Whip, indicating that I will vote in support of these amendments on Report if there is a Division. Tonight, however, we should confine ourselves to having a thorough discussion about them.

Baroness O'Neill of Bengarve (Crossbench)

My Lords, I add my voice to those of my noble friends and the noble Earl, Lord Attlee. We sometimes forget that in talking about an approved regulator, we do not mean that the Press Recognition Panel is a regulator; it is an audit body—an auditor of self-regulating bodies. The press requires self-regulation, but which meets a standard in which members of the public can have confidence. They can have confidence if the process that we have already agreed of setting up a self-recognition panel is used. It is of course open to IPSO to apply for recognition by that process, remaining self-regulating but recognised, as it is open to other self-regulating bodies to be recognised in that way. This is a satisfactory way of accommodating the interests we all have in having media that are self-regulating but also meet standards.

Lord Black of Brentwood (Conservative)

My Lords, I declare an interest in this group of amendments as executive director of Telegraph Media Group and draw attention to my other media interests in the register.

When I saw, not with a great deal of surprise, that this group of interlocking amendments relating to press regulation had been tabled—perhaps their second or third outing in as many years—I was reminded fleetingly of that famous line of President Reagan to Jimmy Carter in a presidential debate: “There you go again”. That is what this feels like. We have another Bill—with only the most tangential link to the media—and yet another attempt to hijack it to bring about some form of statutory press control. As the Times put it last week:

“The Data Protection Bill is meant to enhance protection of personal data. It is not meant to be a press regulation bill by another name”.

But this profoundly dangerous set of amendments seeks to warp the Bill in just that way.

Can we please be crystal clear about the impetus behind these amendments? It is certainly nothing to do with data protection. It is to try, yet again, to force the British press—national papers, regional and local papers, and magazines: in other words, everything from the Guardian and the Daily Telegraph to the Birmingham Mail, the Radio Times and Country Life—into a state-sponsored regulator, with virtually no members and no prospect of any, and almost wholly funded by the anti-press campaigner Max Mosley. Indeed, it is the very same regulator which was recently brought into disrepute when an internal report found that its chief executive and two members of its board had breached internal standards by distributing tweets attacking major national newspapers and journalists. These amendments try to do that by seeking to remove vital journalistic exemptions enshrined in the GDPR from all those who will not, on grounds of principle, be bullied into a system of state-sponsored regulation. Other amendments seek to remove the protection for freedom of expression, which has worked very well in the Data Protection Act 1998, to balance convention rights and make privacy in effect a trump card.

Let us be clear: the amendments would be a body blow to investigative journalism—at a time when, as we have seen in recent days and weeks, it has never been more vital—by giving powerful claimants with something to hide the ammunition to pursue legal claims and shut down legitimate public interest investigations into their activities even before anything is published. All UK news operations, none of which will under any circumstances join Impress or any body recognised by the Press Recognition Panel, would find themselves under incessant legal challenge, with a profound impact not just on investigations but on news, features and even the keeping of archives. In my view, it is no exaggeration to say that that would overturn the principle that has underpinned free speech in Britain for two centuries: that journalists have the right to publish what they believe to be in the public interest and answer for it after publication—a right upheld by the courts here and all the way up to the European Court of Human Rights.

The protections which make investigative journalism possible would in effect be enjoyed by only a handful of hyper-local publishers which have signed up to a state-backed regulator. Are the noble Lords in whose names these amendments stand really content to see the future of investigative journalism in this country invested in The Ferret or insideMoray, rather than in the teams from the Observer, the Liverpool Echo, the Scotsman and the many others which over the years have broken story after story in the public interest? Frankly, if this were not so deadly serious, it would be funny.

If these amendments ever found their way into this legislation, it would be not just a massive blow for investigative journalism and public interest reporting but a further knock to our international reputation as a beacon for press freedom. No other country in the free world has a system such as the one proposed here, where publications are bullied by politicians into some form of state-backed regulation.

It is six years since the Leveson inquiry took place. In those six years, the world has changed—not just in terms of the commercial position of newspapers and magazines, many of which now fight daily battles simply to survive, but also in terms of strong independent regulation. It is time that we moved on too, and I am very pleased that my party has done so by committing itself to the repeal of Section 40.

This Bill is very carefully crafted to balance rights to free expression and rights to privacy, which of course are of huge importance. It recognises the vital importance of free speech in a free society at the same time as protecting individuals. It replicates a system which has worked well for 20 years and can work well for another 20. To unpick it in the way that this set of amendments tries to do, making so much public interest reporting impossible, is grossly irresponsible, and I hope that the Committee will reject it.

Earl Attlee (Conservative)

My Lords, my noble friend has made a very interesting speech, which is very helpful to the Committee, but it would also be helpful to the Committee if we could understand what it is in the requirements of the Press Recognition Panel that makes it impossible, or makes IPSO unwilling, to meet those requirements. What is so difficult about becoming an approved regulator?

Lord Black of Brentwood (Conservative)

My Lords, it is not a question of meeting the requirements of the Press Recognition Panel. It is my belief that IPSO probably would meet the requirements. It is a fundamental belief that self-regulation cannot be self-regulation if it is approved by a state-run body. The Press Recognition Panel was set up by royal charter, which is a method of state regulation in all but name, and the press will not and cannot—and in my view absolutely should not—submit itself to something that has state backing in that way.

Earl Attlee (Conservative)

My Lords, that is extremely helpful to the Committee but I still do not understand how the state and government Ministers would be able to influence the work of the Press Recognition Panel.

Lord Black of Brentwood (Conservative)

My Lords, the Press Recognition Panel was set up by royal charter, underpinned by legislation in this House, legislation to which I was fundamentally opposed. The Press Recognition Panel was set up—I forget the exact figure—with £3 million of taxpayers’ money. It is a state-run body. To have a state-run body which in some way recognising a system of self-regulation negates the whole concept of self-regulation.

Earl Attlee (Conservative)

The noble Lord, Lord Black, is being very helpful. The courts are supposed to be independent and they are, but they are funded by the state as well.

Lord Black of Brentwood (Conservative)

My Lords, I am going to give way to judicial friends who are probably waiting to speak and will be able to deal with the question about the courts better than I can.

Lord Lester of Herne Hill (Liberal Democrat)

I remember Lord Campbell of Alloway once saying to me, “Never make a serious point after the dinner hour”. I think I now understand what he meant. I am in some difficulty, because my noble friends have not moved Amendment 88. I was hoping to make a speech explaining why I profoundly disagree with Amendment 88. Even given the flexibility of the rules of procedure of the House, I am not sure that I can do that until one of them moves Amendment 88. I am going to give them the opportunity of doing so.

Lord Skidelsky (Crossbench)

The noble Lord, Lord Black, paints an incredibly rosy picture of the state of press regulation in the last 20 years. What he ignores is the background to the Leveson inquiry itself and the statutory system—the royal charter and so on—which followed it. There were years in which many newspapers grossly abused their freedom of speech. That is why this interlocking set of propositions, as he calls them, got going and produced a system which all the parties in Parliament accepted in 2013. He says that no other country in the world has a system like ours. No other country has had such an abusive press in parts, though not all the press by any means. These amendments seek to create a balance between freedom of speech and the right of privacy by setting up an auditor to determine how that balance is kept. It is an independent auditor, not part of the Government or the state. The noble Lord, Lord Black, seems to confuse the role of the state with that of an independent auditor, so the argument falls to the ground.

Lord McNally (Liberal Democrat)

My Lords, so that my noble friend Lord Lester can come in in due order, I will speak to Amendment 88. I also draw the Minister’s attention to Amendment 91, which relates to the City. It is clear from the ICO guidance that journalistic exemption was intended to apply to non-media companies, but this is not made explicit in the Bill. In addition, the Bill does not address whether material can be considered published if it is behind a paywall, or mainly addressed to corporate subscribers. That is the thinking behind Amendment 91. We were discussing earlier the concerns of some in financial services and companies such as Thomson Reuters about how the Bill affected them, and that is my probing for them.

I would like to speak to Amendment 88. I was one of the four privy counsellors who signed off the royal charter. I was in government when this went on. It was not an attempt by government to regulate the press. In fact, the coalition Government twisted and turned to try to find ways of taking this forward, as far away from state regulation as we possibly could.

I always like to hear the noble Lord, Lord Black, in full flow and we had the lot: hijacking the Bills, state-sponsored legislation, an attack on principle and bullying. As the noble Lord, Lord Skidelsky, said, Leveson did not come out of a clear blue sky. It is now more than 25 years since the then Minister, David Mellor, warned the press that they were drinking in the last-chance saloon. But it has always been the feeling of the kind of media that the noble Lord, Lord Black, represents that they just have to dig their heels in and refuse to do anything, because the fuss will die down and the politicians will lose their nerve and back off. As somebody who believes passionately in press freedom, I say to the noble Lord that that policy approach—the feeling that the press can turn back any reasonable proposal and in the end be successful—is an extremely dangerous one. Last June, had the general election campaign gone on another month, the press might have had to deal with Mr Tom Watson as Secretary of State. The idea that the press will inevitably have a Conservative Government and that that Government will do its bidding is a high-risk strategy for any sector.

One has to say it is true that the Conservative Government have reneged on the clear promise they made to see through part 2 of Leveson, which would have dealt with data. It is six years since Leveson but, my goodness, in six years the importance of data and how it is handled has grown ever more important, as this Bill illustrates.

One thing on which I agree with the noble Lord, Lord Black, is that the past few days have reminded us just how important a free press is, given the scandals around Westminster and tax avoidance. However, Leveson came out of massive violations of public trust; the noble Lord, Lord Black, and his friends seem to show no sense of remorse for or understanding of that. Here, I must pay tribute to the noble Baroness, Lady Hollins, who, over a number of years, has shown great courage and fortitude in sticking to her principles on these issues.

There is another thing that sticks in my mind. I remember when Rupert Murdoch was before the committee. He said that it was the “humblest” day of his life, which I always thought was a slightly strange choice of words—he did not say “humbling” but “humblest”. But then I understood: what really happened was that he weathered the storm, went back and, like the Bourbons, learned nothing and forgot nothing. There is no guarantee that the press will not behave as badly again. IPSO was set up in the same old sweetheart format as its predecessors. As I said, the Conservatives reneged on their promises about the second part of Leveson. Then, almost to add insult to injury, they put IPSO in this Bill rather than the recognised regulator.

I know my noble friend Lord Lester is going to say how sad he is that he cannot support us on this, but what I want is some sense from the noble Lord, Lord Black, and his friends that they have to move. This issue will not go away. The sense of outrage will not go away. The sense that they have got away with it again will not go away. The idea that the only kind of press regulation that we can have is the kind that is determined by the owners of the press is an insult to the intelligence of the British people, and an underestimate of just how appalled and outraged they were by the things that came out during the Leveson inquiry.

I therefore say to my noble friend Lord Lester, who I know has great influence in these matters: instead of always castigating us for attacking the freedom of the press, could he use some of his eloquence to persuade the noble Lord, Lord Black, and his friends to move towards what the noble Lord, Lord Stevenson, said? Influential people in all parties have been willing to put their hands to trying to find a compromise—a system that would work and have credibility, and give some satisfaction to the noble Baroness, Lady Hollins, and those who have been damaged and hurt by the abuses of the press.

Today, I had a letter from the Press Regulation Panel, which with all good organisation, I cannot find in my papers. The Press Regulation Panel stands ready to work for such a solution with all the best intentions in the world: not to have a state-regulated press, but to have something that gets that balance right between privacy and press freedom, privacy and freedom of speech. My noble friend Lord Lester has written a very good book about five freedoms. The two freedoms put side by side are privacy and freedom of speech. But as it is now, that balance has not been reached. The noble Lord, Lord Black, has not moved an inch this evening. I can only say, as I said before, that this issue will not go away; not because people want to hijack Bills, but because from the media there is no repentance, no remorse and no realisation that there is still a great public demand to see them mend their ways.

Lord Lester of Herne Hill (Liberal Democrat)

My Lords, I wonder whether it might be helpful for me to begin by trying to find what we can all agree on and then look at what we cannot agree on. Everyone here, I am sure, will agree that the right to freedom of speech and the right to freedom of the press are essential foundations of a democratic society. Everyone would agree that the proper functioning of a modern participatory society requires the media to be free, active, professional—I underline the word “professional”—and inquiring. That is why the courts recognise the cardinal importance of press freedom and the need for any restriction on that freedom to be proportionate and no more than is necessary. As a great American judge once put it, one should not burn the house down in order to roast the pig.

Everyone would also agree, including the noble Lord, Lord Black, that freedom of expression and press freedom are not absolute rights; they carry responsibilities. The fate of the News of the World and the journalists convicted of gross abuses of privacy are examples of the need for effective regulation of the press and a fair balance between competing rights and interests. The way in which the family of the noble Baroness, Lady Hollins, was treated by the press was completely disgraceful and I am not surprised that ever since, she has pursued these issues with courage and determination. That does not mean that she is necessarily right, but it does mean that we should acknowledge that she and her family are real victims of real press abuse.

My noble friend Lord McNally will remember, since he and I made the Defamation Act 2013, how that Bill was hijacked in the House of Lords in order to try to coerce the press into what is now seen as a desirable system of regulation. Members of the House will remember that the Prime Minister refused to allow progress to be made on the then Defamation Bill until it was no longer taken hostage. What happened was that a deal was done, with Oliver Letwin as the broker, I think, to try to reach a compromise between the conflicting interests of privacy and free speech. Hacked Off got into the room without the press being represented and the result was the striking of a bargain that the press was profoundly opposed to. It was profoundly opposed to it because of the swingeing penalties by way of punitive damages and arbitrary costs rules as a punishment for the press if it did not join the system that was seen to be post Leveson. The reason why the press did not follow that path was that, among other things, it was advised by the noble Lord, Lord Pannick, and by me that it would be entirely unlawful for the press to be subject to arbitrary costs rules so that even if the press won, it would be liable to pay the other side’s legal costs and punitive damages. The noble Lord, Lord Pannick, advised in particular, and I agreed with him, and these were clearly contrary to the European Convention on Human Rights.

It is not true, as my noble friend Lord McNally seems to think, that nothing then happened, because something major did happen. The press barons who had for years been negligent and I would say stupid in opposing effective press regulation through the Press Complaints Commission, which was a useless and toothless regulator, realised in the end that the writing was on the wall. They appointed Sir Alan Moses, a very independent Court of Appeal judge, to become chairman of the Independent Press Standards Organisation. IPSO tackles media abuse. Although I know that not all agree, it is the independent regulator under a very independent chair for the newspaper and magazine industry in the UK. It regulates more than 1,500 print and 1,100 online titles. It handles complaints about possible breaches of the editors’ code. It gives guidance for editors and journalists. It advises about the editors’ code and it maintains a journalists’ whistleblowing hotline. Members of its staff are available to advise the public, complainants, editors and journalists, and it monitors its members’ compliance with the editorial code. It also carries out standards investigations where it believes that there have been serious and systemic breaches of the code.

Amendment 88, spoken to by my noble friend Lord McNally, would remove the reference in Schedule 2 to the IPSO Editors’ Code of Practice as a code of practice to be taken into account in determining whether it is reasonable for the controller to believe that publication is in the public interest. It would leave reference to the BBC Editorial Guidelines and the Ofcom Broadcasting Code, but make it more difficult for a publisher governed by IPSO to defend itself by relying on IPSO’s professional code.

Amendment 89A, in the name of the noble Lord, Lord Skidelsky, like his original amendment, would in effect insert the Impress standards code. The noble Lord is a distinguished economic historian and biographer of Keynes and others, including Oswald Mosley. Impress is funded mainly by Oswald Mosley’s son, Max, and is supported by the Hacked Off celebrity movement; it is not supported by any national or regional newspapers. I should declare a professional interest, because I represented the Guardian, intervening in Max Mosley’s case in Strasbourg, where the noble Lord, Lord Pannick, failed to persuade the European Court of Human Rights of Max Mosley’s bizarre claim that the protection of personal privacy required the media to be bound to notify the victim in advance so that the victim could always get an injunction or prior restraint.

Lord Skidelsky (Crossbench)

I wonder how relevant all those last bits are to the subject we are discussing.

Lord Lester of Herne Hill (Liberal Democrat)

The relevance of what I have just said is that Max Mosley, who funds Impress, is fanatical in his desire for a privacy law that involves prior restraints. That simply indicates a complete lack of balance in his approach.

Lord Skidelsky (Crossbench)

I have one more question. I thought we were discussing the substance of the argument, not the personalities of the people who may support one side or the other.

Lord Lester of Herne Hill (Liberal Democrat)

I was not discussing personalities, but what happened in the case in Strasbourg. I was about to say that, ironically, the Strasbourg court of human rights had regard to the editors’ code in the course of giving its judgment, so it certainly regarded the old editors’ code as relevant for that purpose.

The Explanatory Notes to the Bill state:

“Article 85 of the GDPR requires Member States to provide exemptions or derogations from certain rights and obligations in the context of processing personal data for journalistic purposes or the purpose of academic, artistic or literary expression”.

The notes go on to explain how that works. Article 10 is engaged, as there is an inherent tension between data protection and the right to freedom of expression. The Government were right to recognise those inherent tensions, which are not new. Personal data is about private information. I am reliably told that those public figures who wish to keep their private information away from inquiry now, as a matter of course, use data laws to protect publication in newspapers. If the correct balance is not struck, the ability of the press to act as a watchdog will be impaired to the detriment of democracy. Investigations, such as those into sex grooming, will become more difficult to publish.

The exemptions in Part 5 of Schedule 2 to the Bill are not new. They carry forward similar provisions in the Data Protection Act 1998. There is no good reason to amend them to the detriment of IPSO titles. It would be punitive to do so. Article 88 treats the majority of the print media, regulated by IPSO, less favourably than the BBC, broadcasters regulated by Ofcom and, if the amendment of the noble Lord, Lord Skidelsky, is accepted, members of Impress. That would mean that members of IPSO would be unable to rely on their compliance with the editors’ code—to which they are bound by contract—in their defence. It is difficult to understand the justification for this form of discrimination against editors and journalists working for our national and regional newspapers.

Lord McNally (Liberal Democrat)

I do not know how many more pages my noble friend has of this. Somewhere in it must be the recognition that IPSO has not applied for recognition, which would have given it all the protections he is calling for. He does not do himself a service. One of the reasons why people get irritated by the lawyers in this House is that they think that if they make a long enough speech it must be so and only the wicked would disagree. The reason why IPSO would be under threat is that it has not sought recognition. He gave a long list of IPSO’s supposed strengths. It is a sweetheart organisation. It is run by the newspaper owners. That is what we are trying to move away from.

I have now found something on the independent overseas press regulation. David Wolfe QC has said that it is disappointing that there continue to be attempts to prevent the recognition system working and that it is frustrating that Section 40 of the Crime and Courts Act has not been commenced. I would be a lot more impressed with my noble friend if he got behind that, or at least gave his friends in IPSO some really good advice and asked them to try to find a way forward with press regulation, instead of giving them an absolute veto on seeking a solution to this matter. I have finished—for the time being.

Lord Lester of Herne Hill (Liberal Democrat)

My Lords, I have tried to explain that the objection to the post-Leveson deal was that it was punitive and unfair. That is why the press chose, as is its right, not to be part of it. It chose instead a system of self-regulation with a very independent Court of Appeal judge, who, when he took office, made it clear that he would insist upon the system working properly and independently, as he has ever since. It is true that he has had to struggle against resistance by some newspapers, but that is the system we have.

Baroness Hollins (Crossbench)

The noble Lord’s support for IPSO as being substantially better than the PCC is surprising. It has done no standards investigations, issued no fines and made no front-page corrections. I do not understand how that can be seen as regulation.

The noble Lord described Hacked Off as a movement set up to support celebrities. It was actually motivated by the Dowlers and sustained because of concerns about people like the McCanns and Christopher Jefferies. It is not about celebrities. Celebrity money has provided some of its support because they were motivated by hearing about those appalling abuses. That is what it is about.

All my amendments would do is incentivise a regulator to seek approval of its independence. Why will IPSO not seek approval and recognition of its independence? Why is it so afraid? Is it because it is not independent?

Lord Lester of Herne Hill (Liberal Democrat)

My Lords, I am not here on behalf of IPSO; I am not counsel for IPSO. I have simply tried to explain historically why we are where we are and the arguments the press made in the past that I was party to at the time, as was the noble Lord, Lord Pannick. If there are points to be made about the way in which IPSO works, no doubt they will be made by Members of the House. I stand corrected by the noble Baroness, Lady Hollins, who reminds me that it was not only celebrities who were abused, which is completely true.

What I am trying to say is that no democracy in the world has a system of press regulation that has been formulated post Leveson. It is objectionable to our national and regional newspapers. They will not change and suddenly agree to a different system because of anything which your Lordships say or do. It is a free press and the sensible thing to do is to make the system work. I believe that under Sir Alan Moses it is working, but if it is not working sufficiently, I am sure that they would be interested in any suggestions. It is hopeless if your Lordships believe that you can bully them into giving up their self-regulation in favour of the statutory system which they reject.

Earl Attlee (Conservative)

The noble Lord has been very helpful to the Committee. He told us what the disadvantages would be for a media operator if they were not signed up to an approved regulator. Can he tell the Committee what the advantages would be for a media operator if they were signed up to an approved regulator?

Lord Lester of Herne Hill (Liberal Democrat)

I do not understand the question. It depends on which regime we are talking about. Right now, there would be no advantages.

Lord Skidelsky (Crossbench)

I have never heard a more absurd argument than that we can trust IPSO because Sir Alan Moses is chairman of it. Sir Alan is an admirable person; he is personal friend. How long is he going to be chairman? Who is the next chairman going to be? What about the independence of the editors’ code? The code may be fine at the moment, but it can be changed any time the committee decides without Parliament having any say in it at all.

Lord Lester of Herne Hill (Liberal Democrat)

I have been very careful not to traduce Impress or Max Mosley, nor will I seek to defend Alan Moses. We are not concerned with individual personalities; we are concerned with a political problem.

Lord Skidelsky (Crossbench)

With great respect, we are concerned with the permanence of arrangements set up and put into primary legislation. The chairman of IPSO is not there for ever, and the code can be rewritten whenever the committee decides to do so.

Lord Keen of Elie (Conservative)

My Lords, of course, we appreciate the contributions from all sides of the Committee on this issue, but let us be clear: this Bill is about data protection—it is not about press regulation. It is not about distinguishing between journalists, nor between the regulators they may or may not belong to.

The Government are committed to defending not only hard-won liberties but the operation of a free press. That is a fundamental principle of any liberal democracy. This Bill seeks to preserve the balance found in the 1998 Act, where journalists can process personal and special categories of personal data, but only when their processing is in the public interest and the substantial public interest respectively. The Bill also seeks to ensure that journalists are exempt from compliance with certain data protection requirements where to do so would undermine the operation of a free press, a key part of a strong and effective democracy where Governments are held to account and corruption and criminal behaviour can be challenged. No one seeks to condone the past misbehaviour of individual media organisations, nor to legitimise it.

Amendment 42 is moved by the noble Lord, Lord Stevenson. As we discussed last week in reference Part 2 of Schedule 1, there is an exhaustive list of the types of processing which could be in the substantial public interest. When the Government consider that processing of a particular type will not always be in the substantial public interest, the Bill makes it a requirement that the data controller satisfies himself that any particular instance of processing is in the substantial public interest. Amendment 42 concerns the condition allowing journalists to process data in connection with unlawful acts and dishonesty, as dealt with in paragraph 10. The Bill, however, needs to balance freedom of expression with privacy and it may be that in some cases an act of dishonesty is not important enough and does not engage the substantial public interest to the extent that it justifies the processing of sensitive data by journalists. That is why the distinction is made.

To pick up on a point made by the noble Lord, Lord Stevenson, about continuity of arrangements in the 1998 Act, this processing condition is the same as that which currently appears under the existing Data Protection Act. It would appear that journalists have been dealing with that effectively and making the appropriate judgments for the last 20 years. I hope that that goes some way to explaining why we resist Amendment 42.

On Amendment 87B, I reassure the noble Lord that the specific inclusion of “photographic material” in paragraph 24(2)(a) of the schedule is unnecessary. This is because photographic material is likely to fall within one or more of the categories listed in that paragraph—for example, journalistic material or artistic material. We suggest that there is no requirement for express reference to photographic material. As for the point that was raised with the noble Lord by the NUJ, I think, about the use, the test is,

“with a view to publication”.

As long as that test is met, it does not necessarily follow that there must have been publication in order to legitimise the material in question. The position would, of course, be radically different if one had regard to one of the amendments moved by the noble Baroness, Lady Hollins.

Amendment 87E would remove the list of codes and guidelines in paragraph 24 of Schedule 2 that help controllers assess whether a publication would be in the public interest for data protection purposes and would replace it, as I understand it, with the term “appropriate codes”. I confess that I am a lawyer, to respond to a point made by the noble Lord, Lord McNally, or at least it is alleged that I am. That would certainly make it more difficult, as a matter for interpretation, for both publishers and the Information Commissioner to evaluate whether the publication of an individual’s personal data was in the public interest. Indeed, rather than the clarity of a list, one could instead be faced with years of potential litigation before an adequate body of case law was in place to establish what was appropriate. That is why we suggest it is appropriate that there should be a specific list, as reflected in the current legislation, the 1998 Act.

Amendments 88 and 89A concern the specific industry codes listed in the Bill. I start by saying that the codes currently listed in the Bill reflect those that are listed in the existing legislation. The editors’ code listed in the Bill—now enforced by IPSO rather than the Press Complaints Commission, I acknowledge —is one of these, and the Information Commissioner has already reflected this change in her current guidance on Section 32 of the existing Act. That follows from the Data Protection (Designated Codes of Practice) (No. 2) Order 2000, which set out the various codes of practice and included the editors’ code of practice. While there is a suggestion that the editors’ code of practice might change, in the light of any such change the Information Commissioner’s view and guidance as to the applicability of that code may also change. So it is not as if it is entirely without control.

Lord Clement-Jones (Liberal Democrat)

The Minister said that it could change, but the word IPSO is actually in the Bill, so I do not quite understand the point that the Minister has just made.

Lord Keen of Elie (Conservative)

Let me elaborate on the point for a moment to make it clear. IPSO did not exist in 1998; the editors’ code did and therefore the editors’ code was incorporated as such by reference to the 1998 Act and the 2000 order. The relevant editors’ code is now known as the IPSO code. It is essentially the same code, as I understand it. I see that the noble Lord, Lord Stevenson, is shaking his head on this point, but it is essentially the editors’ code that is now incorporated within the IPSO code.

Lord Stevenson of Balmacara (Labour)

I could not resist jumping up. I think the nub of the argument is the four letters IPSO. It is an editors’ code. IPSO is a separate body. I think there would be less concern if it were just simply the editors’ code because we understand what that is. That would be the right reference, but I think we will return to this later.

Lord Keen of Elie (Conservative)

The terms of the editors’ code are now referred to as the IPSO code, but I take the noble Lord’s point and I will take away and consider whether there is any material issue about using the designation of that code in the schedule. However, it is, with respect, essentially the editors’ code as it was originally recognised. As I understand it, that is reflected in the Information Commissioner’s current guidance under reference to Section 32, which is why it appears in the schedule in the form that it does.

Lord Lester of Herne Hill (Liberal Democrat)

I shall be corrected in due course if I am wrong, but it think the position is that the editors’ code was the code that was formulated under the PCC, and then when Sir Alan Moses became chair of IPSO I think the code was then amended to strengthen it—but I shall be corrected if that turns out to be mistaken.

Lord Keen of Elie (Conservative)

The noble Lord is quite right that it had its origin as the editors’ code before the PCC, but I am reflecting the fact that the Information Commissioner, being aware of the genesis of that code and its approval, has, as I understand it, under current guidance under reference to Section 32 of the existing Act acknowledged it as a relevant code. It seems to me that we may be arguing around designation rather than content, and I will give further consideration to the question of designation.

Removing that code—I will call it “that code” for present purposes—as proposed in the amendments would be a quite extraordinary step. Whatever one might think of IPSO, we should recognise that it has more than 2,500 members, including most of the major tabloids and broadsheets. Removing the code from the Bill would therefore remove protections for the vast majority of our press industry and cause significant detriment to what is a free press.

No codes adopted by a Press Recognition Panel-approved regulator are listed—and of course there is only Impress in that context. Under current legislation the Information Commissioner’s guidance on Section 32 does not include that code. That does not mean that such a code cannot be included in the future. However, before amending the list of codes, the current and proposed legislation makes clear that the Secretary of State must consult the Information Commissioner. The self-regulator Impress has applied for its standards code to be included in the schedule, and the Secretary of State is currently considering that application—but in due course, once she has considered the application, she will have to refer to the Information Commissioner and consult her about that application.

I should also emphasise that the current list of codes, allowing for the point about designation, does not represent an endorsement of any one press regulator over another. This is about ensuring that the codes listed are appropriate, having regard to the need for data protection.

It is also worth noting that the exemption the Bill provides to those processing data for special purposes will be available to all journalists where the criteria set out in paragraph 24(2) of Schedule 2 are met. Where a publication is subject to one of the listed codes of conduct, it must take that code into account when determining whether publication is in the public interest. However, although the commissioner’s current guidance emphasises that compliance with industry codes will help demonstrate compliance, those publications that are not subject to a code are not somehow excluded from qualifying under the relevant exemptions, if they meet the three-part test in paragraph 24.

I appreciate that the intention of Amendment 91 is to ensure that we interpret the notions relating to journalism broadly and, in doing so, protect the right to freedom of expression. However, there is no requirement for this amendment if one has regard to Clause 184, the relevant interpretation clause, which makes clear and underlines that material need be available only to a section of the public, and that would include those who subscribe by way of a fee for particular access to material. So these exemptions will extend to the sort of body that was referred to by the noble Lord in relation to Amendment 91. If anything, there is duplication, because we have not only paragraph 24(9), which refers to the public and a “section of the public”, but Clause 184, which defines the public by reference to, and includes, a section of the public. I believe that there was an earlier proposal to take paragraph 24(9) out in order to avoid that duplication.

I turn to the amendment tabled by the noble Baroness, Lady Hollins, and supported by my noble friend Lord Attlee. Article 85 of the GDPR requires member states to reconcile the right of protection of personal data with the right to freedom of expression and information, which is of course embraced by the European Convention on Human Rights. Although like, clearly, other Members of the Committee, I have great sympathy for the noble Baroness’s own experience, I firmly believe that the Bill strikes the right balance in reconciling these interests and aligns with the requirements of the regulation.

By contrast, the proposed amendments seek to reset that balance, so that the right to personal information privacy trumps that of the right to freedom of expression and information. This would be inconsistent with Article 85, which recognises the special importance of freedom of expression and provides a wide power to derogate from the regulation for processing for the special purposes. That point was elaborated by the noble Lord, Lord Lester of Herne Hill, when he underlined the importance of the freedom of the press in this context.

Amendment 87A seeks to amend the journalistic data protection exemption to make it available only where the processing of data is necessary for publication, rather than simply being undertaken with a view to publication. I fear that this does not reflect the realities of how journalists work and how stories, including the most sensitive and important pieces of investigative journalism, are put together and published. A journalist will not know what is necessary until the data has been gathered, reviewed and assessed.

Amendments 87C and 87D relate to what factors the controller must take into account when considering whether publication of data would be in the public interest. The amendments remove the requirement on the controller to take account of the special importance of the public interest in freedom of expression and information, and make the exemption available only where, objectively, the likely interference with privacy resulting from the processing of the data is outweighed by the public interest.

Controllers already have to consider issues of privacy when considering the public interest. But this amendment goes too far in saying that public interest can be trumped by privacy, weighting the test away from freedom of expression. This is again contrary to Article 85, which requires a reconciliation of these rights. I understand the noble Baroness’s intent here, and the harm that she seeks to prevent, but the rebalancing that she suggests goes too far.

Finally, Amendments 89B and 91A aim to narrow the exemptions for journalists who are not members of an approved regulator as defined by the Crime and Courts Act 2013. Fundamentally, these provisions are about protections that journalists should be able to legitimately rely on in going about their important work. We should view these clauses through that lens—as vital protections that give journalists the ability to inform us about the world in which we live and to effectively hold those in power to account.

The Government do not condone the past behaviour of individual media organisations, nor, as I noted earlier, do we seek to legitimise it. Equally, though, we do not think the problems that Sir Brian Leveson and others have identified can, or indeed should, be fixed through the medium of data protection law. Indeed, the Government feel strongly that these important protections for journalists should be maintained.

We must strike the right balance in reconciling the right to privacy with the right to freedom of expression and information. I hope I have gone some way towards explaining how the Bill seeks to do that. I hope I have addressed the concerns that have been expressed through the amendments, and I urge noble Lords to withdraw them.

Lord Stevenson of Balmacara (Labour)

My Lords, this has been a very interesting debate. It has lasted one hour and 25 minutes and there is a little more to go. The hour is late and I do not think one wants to rush to judgment on the many important things that have been said today. As I am sure many other noble Lords do when faced with such an intense and important debate, I want to reflect a little on it, read what it looks like in Hansard the next day and then form a view on it. However, I shall share one or two things with the Committee that come to my mind and I think we should take away from this.

Of course this is about the balance between privacy and freedom of expression. It was interesting that the noble Lord, Lord Black, was at pains to point out in his intervention that he did not think there would be any country in which the sort of systems that are discussed in some of the amendments here took place. I ask him: is there a country that he would be happy to live in that did not have a statutory protection of privacy and freedom of expression, however well balanced and proportionate that would have to be? The answer would be very interesting.

My memories from this will be of the long campaign that the noble Baroness, Lady Hollins, has fought to try to get this troubled area of our law into better shape. The perhaps reluctant speech by the noble Lord, Lord McNally, in opening up the way for the noble Lord to debate issues relating to earlier approaches to this area, struck home for me. I thought it was a powerful intervention and one we should think hard about.

My ultimate feeling about this is that we may be talking about the very narrow issue of data processing in relation to journalism, but of course it engages all the issues that arise from any decision that we make about the balance between privacy and freedom of expression. As I tried to demonstrate in the discussions on day one of Committee, if there were better protections between a right to privacy and the right to freedom of expression than there currently are in the Bill, maybe this would be an easier process, but they are not there yet. We need some movement here. The genuine offer that I made to the noble and learned Lord to try to find common ground on this and move forward, which was picked up by others, seems to have been rejected. That is sad, and we will not get very far if that is the attitude we are going to encounter.

At the end of the day, we may not have a choice on this. If Parliament is unable to act, it may well be that the privacy law we end up with will be judge-led, arising from cases that happen to come in, out of which a body of law will be built up that does not suit the noble and learned Lord and his friends. He should think very carefully about where we are at the moment, where the political power lies, where the interests of those engaging with this are coming from and how long it would be before we got to a point where we could take this forward.

I think we will come back to this on Report more than once. There are issues here that will survive the helpful comments made by the noble and learned Lord, who covered the detail of the amendments very fully. I will read what he said very carefully. I do not think we have got to the bottom of how you get the balance in law for a long time so that it works. It is not to do with definitions of which code or otherwise we are talking about; we are talking about real principles here that need to be addressed.

Baroness Hollins (Crossbench)

My Lords, I want to make a couple of comments. I take exception to the suggestion that my amendments are in some way bullying. If anything, it is the newspapers that are bullying: for example, bullying the Government not to commence Section 40 of the Crime and Courts Act 2013. This is not the wrong Bill: it is about data protection. All that my amendments would do is implement Lord Justice Leveson’s recommendations on data protection. It is a data protection Bill, and that is what they are about.

The so-called IPSO code is owned by the Regulatory Funding Company and, as I understand it, only its sub-committee can change it. IPSO then has to take it or leave it. The RFC also refused to allow IMPRESS to use it. It seems very strange to have that code named in the Bill. I will think carefully and review what needs to come back on Report, but I would welcome an opportunity to discuss this further with the noble and learned Lord to try to understand why there is such a difference of view about it.

Lord Skidelsky (Crossbench)

I should like to make just one point. The noble and learned Lord, Lord Keen, came close to admitting that to put IPSO in the Bill was a mistake—I say came close to admitting—whereas it would have been perfectly all right to have just said, “the editors’ code”. There is something there to discuss, because if you call it the IPSO editors’ code, that looks as if you are favouring a particular organisation, rather than a code. The code is owned by the newspaper publishers; it is their code; we need to take that into account. It is less obnoxious just to have “the editors’ code”, than to have an organisation named in the Bill as the effective carrier of that code. I do not know whether the noble and learned Lord is willing to consider leaving out mention of the organisation. If so, it would be interesting to discuss how best to do that. I may come back to this on Report, but thank him very much for his speech.

Lord Stevenson of Balmacara (Labour)

I beg leave to withdraw the amendment.

Amendment 42 withdrawn.

Amendments 43 to 45A not moved.

House adjourned at 10.22 pm.