Data Protection Bill [HL] - Report (1st Day) (Continued)

House of Lords, 11 December 2017.

Baroness Kidron (Crossbench)

Before I turn to the amendments in my name and that of the Minister, the noble Lord, Lord Stevenson, and the noble Baroness, Lady Harding, I would like to recognise the extraordinary role of children’s charities led by the NSPCC; the Duke of Cambridge Task Force; child experts John Carr and Professor Sonia Livingstone; the Children’s Commissioner; and the remarkable support of colleagues on the Communications Committee and from all sides of this House, especially the noble Lords, Lord Storey and Lord Clement-Jones. Without these powerful voices, we would not be introducing a statutory code of age-appropriate design to the Bill.

These amendments are a step towards a better digital future for children. They introduce a code that will set out the standards by which online services protect children’s data. They set standards that are directly related to a child’s age and the vulnerabilities associated with that age. They clarify the expectation on services to design data practices that put the “best interests” of the child above any other consideration, including their own commercial interest. They establish the standards by which the Information Commissioner will judge services on behalf of child users. Crucially, they connect design of services with the development needs of children, recognising that childhood is a graduated journey from dependence to autonomy.

Amendment 109 states that the Information Commissioner must consult widely on an age-appropriate design code, in particular capturing the voice of children, parents, child-development experts, child advocates and trade associations. In doing so, she will have to determine if the use of GPS location services to hold, sell or share a child’s current or predicted location is in a child’s best interest. She will have to consider if privacy settings for children should be automatically set to private. She will have to consider if the service can justify the collection of personal data, such as a child’s school or home address, their birth date, their likes, dislikes, friends or photographs, in order to facilitate a specific activity being undertaken by that child. She will have to deconstruct terms, conditions and privacy notices in order to make them understandable by, and appropriate for, children of different ages. A six year-old needs different protections and information from a 15 year-old. She will have to consider, with the development stages of childhood in mind, whether paid-for activity such as product placement and marketing is transparent to a child user and what reporting and resolution processes should be offered to children.

Responding to the concern raised by my noble friend Lord Erroll, the code will set out the duty of online services to facilitate the child’s right to erasure under the GDPR, with or without the help of an adult. Perhaps most importantly, the commissioner will—for the first time—consider strategies used to encourage extended user engagement; that is, those design features variously called sticky, reward loops, captology and enrapture technologies that have the sole purpose of making a user stay online. These will be looked at from a child development point of view. The opportunity cost, the need for a rich balance of varied online experiences as well as the need to get offline with ease will all be given weight.

Finally, the amendment invokes the UNCRC. The age-appropriate design code must incorporate all the rights of children, and the responsibilities of adults to them, as set out in the charter. The code created by the amendment will apply to all services,

“likely to be accessed by children”,

irrespective of age and of whether consent has been asked for. This particular aspect of the amendment could not have been achieved without the help of the Government. In my view it is to their great credit that they agreed to extend age-appropriate standards to all children.

Amendment 111 states that the code must be laid before Parliament as soon as practicable, but no later than 18 months from the passing of the Bill. Amendments 112 and 113 confirm the negative resolution procedure. Amendment 114 allows the commissioner to update the code. In Committee, my noble friend Lady Howe raised the question of enforcement. Although the code is not mandatory for online services, it is mandatory for the ICO to take it into account when investigating breaches and taking enforcement action.

Amendment 110 puts the age-appropriate design code into Clause 121 and, consequentially, into Clause 123. This means that online services facing a complaint of any kind, which have not complied with the age-appropriate code, risk enormous enforcement consequences, including the spectre of fines of up to €20 million or 4% of annual global turnover. In Committee, doubts were raised that it was technically possible to regulate the digital environment, so I am particularly grateful to the noble Baronesses, Lady Lane-Fox and Lady Shields, to Sky and to TalkTalk, for making it clear that there is no technological impediment to effective design; it is simply a question of corporate and legislative will.

Self-regulation has not provided a high bar of data protection for children. On the contrary, we have seen a greedy disregard of children’s needs from some sections of the tech sector in their eye-watering data collection policies. The introduction of a statutory code makes very clear what is required of them, and although data protection is crucial, it is not the only issue that confronts children in the digital environment. The principle which these amendments establishes—that a child is a child, even online—must now be established in every aspect of a child’s digital life, as a cultural and legal norm.

On this subject, I urge the Government to take one further step in the Bill: the introduction of a super-claimant procedure provided for by article 80(2) of the GDPR, and supported by the ICO. Children need advocates in all areas of life, including the digital. We will, no doubt, return to that in the new year. In the meantime, I thank the Minister, DCMS officials, the Bill team, the Minister for Digital and the Secretary of State. Along with those whom I have already mentioned, they have reason to be proud of introducing age-appropriate design standards to the Bill. Above all, it is a necessity for a 21st century child to access the digital environment knowledgably, creatively and fearlessly.

I support my noble friend Lord Clancarty, who has an amendment in this group. I look forward to hearing from the Minister of the Government’s commitment to the aspects of design that the commissioner will consider; that children’s needs will be at the heart of this code; and a clear indication that enforcement will be a priority for the commissioner and robustly applied. I beg to move.

Baroness Harding of Winscombe (Conservative)

My Lords, I remind your Lordships of my register of interests in the digital space, not least as the ex-chief executive of TalkTalk and trustee of Doteveryone. I add my thanks to those of my noble friend Lady Kidron. I also thank her for her tireless campaigning on behalf of children, and the energy, drive and commitment that she has shown in bringing all of us on this journey. We definitely would not be here today without her. I also thank my noble friend the Minister and the ministerial team both here and in the other place and the noble Lord, Lord Stevenson. This is genuinely a team effort, both within this House and, as the noble Baroness, Lady Kidron, set out, among all the charities and organisations which work tirelessly to ensure that we protect the vulnerable in the digital world—most importantly in the case we are discussing today, our children.

A code of practice for age-appropriate design for digital services is a hugely important step. Every time I speak in this House I talk about how much I believe that the digital world is a force for good and of the opportunity it presents us, particularly as an open country which embraces new technology. We have a history of not just embracing new technology but of protecting the vulnerable as we do so. This amendment is an important landmark in that journey for the digital world as we need the digital space to be civilised, every bit as civilised as the physical world, and we struggle in debating how we ensure that the physical world is civilised.

Data is at the core of digital and therefore this amendment is at the core of building a civilised digital society as it recognises that children’s data needs must be addressed and that children need to have special protections in the digital world, just as they do in the physical world. We are taking a hugely important moral as well as legal step in our digital journey. However, a code of practice will make a difference only if it changes behaviours, and, in this case, changes the behaviours of very big and very small digital service providers. Sadly, we are debating this issue because self-regulation is not working. I certainly think it is sad that that is the case. I very much hope that this amendment will start to drive the right behaviours but it will do so only if has teeth. Therefore, when my noble friend the Minister replies, I would be interested to hear his interpretation of the powers that this amendment would give the Information Commissioner. We need it to give her position teeth. We need to ensure that the ICO has sufficient resources to conduct the consultation properly in a reasonable period of time to provide commercial businesses big and small with sufficient time to enable them to implement this measure for children. A code will be effective only if tech companies subsequently change their behaviour.

I still very much hope that this debate and the amendment itself demonstrate to technology companies big and small our commitment as a country to protect our children online, and our expectation that all businesses will play their part. I still firmly believe that the free market works in most cases. I hope that simply by setting this process in train, technology companies will start to implement some of the basic protections for children that we discussed in Committee. It will be so much easier for the ICO to implement these standards if many of the basic protections are already in place but, much more importantly, our children would be safer from tomorrow rather than in 18 months’ or two years’ time. I am delighted to see this amendment supported on all sides of the House.

Baroness Howe of Idlicote (Crossbench)

My Lords, I am glad to support Amendment 7 and the related amendments in the name of my noble friend Lady Kidron. Like others, I commend her for her perseverance and commitment in ensuring that we see children flourish as they grow from the early years of digital interaction to adulthood.

In 2010, the annual Ofcom media report made no mention of tablet computers. In 2017, 21% of three year-olds have their own tablet. This is the world in which our children are growing up. We use the global term “children” easily, which under the United Nations Convention on the Rights of the Child means a person under the age of 18. As those years encompass such diverse development, the Information Commissioner has a considerable challenge ahead to identify design suitable to cover all those needs. I for one wish her well.

As I have made clear on many occasions, I am for positive use of the internet by children, and for resources which help parents raise their children in the digital age. With that preface in mind, I would like to ask some questions about these amendments to clarify the intentions and the way forward.

First, during the debates we have had on Clause 8, we have talked about children aged between 13 and 16. Amendment 109 refers to a code being developed for sites,

“which are likely to be accessed by children”.

I hope that my noble friend and the Minister will clarify which age group we are referring to, since there is no definition of children in the Bill but the terms “child” and “children” are used in the headings of Clauses 8 and 191, where the relevant age of the child is 13 and 12 respectively. As Amendment 109 refers to the UNCRC, I assume that the intention is that the age-appropriate design code of practice will cover all children up to the age of 18. However, it would be very helpful for a definition of children to be included in the relevant clauses so that there is no uncertainty.

Secondly, I hope that there will be clarification of which sites will fall within the requirements of the code. Clearly, the expectation is that the code will go beyond sites which would require the consent of children, but will it apply only to sites whose primary intention is to reach children? For instance, in the last couple of weeks, Facebook has launched a chat app for children who are not old enough to be signed up to Facebook. The new app is aimed at six to 12 year-olds. Will the new code apply just to this app or to the version of Facebook that permits access by those aged 13 and above as well?

On 23 November, this House discussed online problem gambling. A number of interventions were made by noble Lords on online gambling sites that have games involving cartoon characters which look similar to characters in children’s TV, and most certainly appeal to children. When the Times reported on these games, the chief executive of the Remote Gambling Association said that companies were not deliberately targeting children but that some nostalgic games might inadvertently be attractive to them. I hope that the position of these sites under the code, which in theory should not be accessible to children but clearly are, will also be addressed.

Thirdly, how will sites complying with the age-appropriate design be obvious to parents, especially to parents who consent to their child’s use of any data? In this context, will the new code be incorporated into the next draft of the Internet Safety Strategy? Finally, how will the code be enforced? Without some good enforcement mechanism, it is likely that it will not have as wide-reaching an impact as this House hopes that it will.

These amendments have come at a late stage in our consideration of this Bill. I look forward to hearing what my noble friend and the Minister have to say in response to my questions. I hope that the other place will continue to reflect on the proposal before us today and refine it if necessary. I hope too that it will continue to ask questions about whether the digital age of consent of 13 is the most appropriate age, and that there will be satisfactory evidence that 13 is in the best interests of our young people.

The internet puts the world at the fingertips of our children. I commend my noble friend Lady Kidron for working to ensure that children are able to make the most of this amazing resource in a way that supports child development.

Lord Arbuthnot of Edrom (Conservative)

My Lords, I thank the noble Baroness, Lady Kidron, for moving these amendments with such incredible clarity that I was able to understand what they were saying. My question follows on from the point made by the noble Baroness, Lady Howe, about how these amendments would be enforced. As the noble Baroness, Lady Jay of Paddington, said in Committee, all these issues arise in an international context. How will the international dimension work with regard to these amendments? I would be concerned if we were to impose rules in this country which might create divergence from the GDPR and hence make it more difficult to achieve the eventual accommodations with the European Union that would allow us to continue to do business with it in the longer term. There is an international dimension to all this and I do not understand how it would work with regard to these amendments.

Lord McNally (Liberal Democrat)

My Lords, not for the first time in her distinguished career in this House, the noble Baroness, Lady Howe, has asked some pertinent questions, the answers to which I look forward to. First, however, I pay tribute to the noble Baroness, Lady Kidron. It is quite often difficult for a parliamentarian to know whether they have made a difference; we all get swept up in the tide of things. However, I have looked at the Bill as it has moved through both the other place and here, and without her intervention, her perseverance and her articulate exposition of the case, we would not be where we are today. She should take great credit for that.

In some respects, there is a sense of déjà vu. I am glad to see the noble Lord, Lord Puttnam, in his place; I was on his committee 15 years ago which looked at the Communications Act and the implications of what were then new technologies. However, looking back, the truth is that we had only an inkling of the tsunami of technology that was about to hit us and how we would control it. There are some things that we might have done during the passage of that Bill to anticipate some problems that we did not do. However, it is always difficult to know the future. Indeed, of all the things I have had a bit to do with, the creation of Ofcom is one that I take great pride in. For all its problems, Ofcom has proved itself a most effective regulator, and these days it seems that it is asked to do more and more.

That brings us to what is being suggested with the ICO. It is extremely important that the ICO is given the resources, the teeth and the political support to carry out the robust tasks that we are now charging it with. That was not thought of for the ICO when it was first created. We are therefore creating new responsibilities, and we have to will the ends in that respect.

One of the good things about the amendments in the name of the noble Baroness, Lady Kidron, is that this is beginning slightly to impinge on the tech companies—they cannot exist in a kind of Wild West, where anything goes. I think I said at an earlier stage that when I hear people say, “Oh well, the internet is beyond political control and the rule of law”, every fibre of my being as a parliamentarian says, “Oh no it’s not, and we’ll show you that it’s not”. This is a step towards making it clear to the tech companies that they have to step up to the plate and start developing a sense of corporate social responsibility, particularly in the area of the care of children.

I share with the noble Baroness, Lady Harding, the confidence that with these new technologies we have an enormous potential for good. However, the jury is still out on whether we will create a civilised space or not. It would depend on how we legislate, what powers we give to the regulator, which we give teeth to, and on how smart the tech companies are in responding to this genuine public concern. If they do not understand that people are concerned, and that once they get concerned they will get angry, they will diminish their opportunities to play a constructive role in what can be a quite transforming technological revolution, which we are about to experience.

Lord Puttnam (Labour)

My Lords, I add my voice in congratulating the noble Baroness, Lady Kidron, on her amendment and on the way it was presented. I will try to add additional value to the discussion. I, along with the noble Baronesses, Lady Harding, Lady Shields, and Lady Lane-Fox, have spent a lot of the time—in my case, 20 years—defending and promoting the tech industry. I believe in the tech industry and in its educational capacity and many of the developments it can produce. I also have many friends in the tech industry, which makes it doubly difficult. That is why I find it so difficult to understand why they are not part of this.

One reason, which is important but which has not been mentioned, is that these are the UK subsidiaries of major global businesses. When well-meaning people in the UK look at this problem and would probably like to address it, they get barked at down the phone by someone who has no conception of the strength of feeling in this House or in the UK and Europe, and so they do not get a sympathetic hearing. By passing this amendment, this House can send a message back to the west coast of the United States to say, “I’m very sorry—your values do not prevail here. We’re looking for something different: a tech industry that supports, enhances and encourages the type of society that we all want to be part of”. It is important to get that message back.

It is not just us saying that. David Brooks, the eminent journalist for the New York Times, ended his piece on 20 November by saying:

“Tech will have few defenders on the national scene. Obviously, the smart play would be for the tech industry to get out in front and clean up its own pollution”.

That is the intelligent view. The tech industry I have promoted and believe in will get out in front and understand the signal that is being sent from this House, and will begin to do something about it. It will be quite surprising what they can do, because in a sense we may well be helping the senior executives in Europe to get their message back to the west coast of the United States. That is one important reason why I support the amendment.

Earl of Erroll (Crossbench)

My Lords, I cannot add much to what the noble Baroness, Lady Kidron, said when she took us on her concise comprehensive canter through her amendments, but I will mention two things.

The first is in response to the noble Lord, Lord Arbuthnot, who is right to say that enforcement is essential, particularly because it is international—the internet is international. We faced this with Part 3 of the Digital Economy Act in trying to prevent children getting pornography. One of the things that became apparent is that the payment services providers are good on this sort of thing, and if it looks right and the community agrees it, they will withdraw payment services from people who do not comply. As most websites are out there to make money, if they cannot get the money in, they quickly come into line. So there may be some enforcement possibilities in that area, as it ends up being international.

The other thing we noticed is that the world is watching us in Britain because we are leading on a lot of these things. If we can make this effective, I think other countries will start to roll it out, which makes it much easier to make it effective. It is a big question because at the end of the day we are trying to balance the well-meaning desire of the developers and those producing these apps, who want to deliver a ubiquitous, useful utility everywhere, with the protection of the young. That is a difficult thing to do, which is why this has to remain flexible. We have to leave it up to someone who is very wise to get us there. If we get it right, this could be a very good step forward.

Lord Best (Crossbench)

My Lords, I rise in support of these amendments, as if any further support were needed. I speak as the Member of yours Lordships’ House who chaired your Communications Committee when we produced our report, Growing Up With the Internet. My noble friend Lady Kidron was a most distinguished member of the committee and greatly helped us in formulating our recommendations. Alongside support for parents and schools and other measures, the committee sought government intervention in curbing the poor practices of the organisations providing content and delivering the internet’s services to children, especially through social media. This group of amendments takes forward that central theme from the committee’s report, and I thank my noble friend and congratulate her on her foresight and tenacity in pursuing this. I also thank the Minister, backed by his Secretary of State, for supporting these amendments today.

The underlying significance of the amendments is that they establish a process for government—for society—to intervene in determining the behaviour of those responsible for internet services that can have such a huge impact on the lives of our children. In particular, the new process will cover the activities of huge global companies such as Facebook and Google, among the most prosperous and profitable organisations on the planet, which have the power, if only they would use it, to ensure the safety and well-being of children online. The process set in train by these amendments involves empowering the Information Commissioner to set the standards that all the key players will be expected to adopt or face significant sanctions. The amendments mark a necessary shift away from depending on good will and purely voluntary self-regulation. They represent a breakthrough in holding to account those mighty corporations based far away in Silicon Valley, to which the noble Lord, Lord Puttnam, made reference, and others closer to home. It is good to see major organisation such as Sky and TalkTalk supporting such a change, alongside the major charities such as the NSPCC.

Your Lordships’ Communications Committee and the whole House owe a huge debt of gratitude to my noble friend Lady Kidron for so diligently taking forward the arguments that have led to the significant change which these amendments herald. I know that the committee, as well as all those concerned with the safety and well-being of the nation’s children, will greatly welcome this big step towards ensuring better behaviour from all the relevant commercial enterprises. I suggest that this is a major step in protecting not just children in the UK but children around the world as the value of this kind of intervention becomes recognised, as the noble Earl, Lord Erroll, mentioned. The amendments get my fulsome support.

Earl of Clancarty (Crossbench)

My Lords, I will speak to Amendment 117 in my name, but before I do I warmly congratulate my noble friend Lady Kidron on obtaining this important code of practice for children. I apologise for not having spoken in the debate on this Bill previously, but Amendment 117 is significant and is also a children’s rights issue.

If there is to be—correctly—a sensitivity concerning age-appropriate understanding by children in relation to information services, the same should be no less true in the school setting, where personal data given out ranges from a new maths app to data collected by the DfE for the national pupil database. A code of practice needs to be introduced that centres on the rights of the child—children are currently disempowered in relation to their own personal data in schools. Although not explicitly referred to in this amendment, such a code ought to reflect the child’s right to be heard as set out in Article 12 of the UN Convention on the Rights of the Child. Among other things, it would allow children, parents, school staff and systems administrators to build trust together in safe, fair and transparent practice.

The situation is complicated in part by the fact that it is parents who make decisions on behalf of children up to the age of 18; although that in itself makes it even more necessary that children are made aware of the data about themselves that is collected and every use to which that data may be put, including the handing on to third-party users, as well as the justification for so doing. The current reality is that children may well go through life without knowing that data on a named basis is held permanently by the DfE, let alone passed on to others. There may, of course, be very good research reasons why data is collected, but such reasons should not override children’s rights, even as an exemption.

It is because there is no clear code of practice for a culture of increased data gathering in the school setting that we now have the current situation of growing controversy, enforcement and misuse. It is important, for instance, that both parents and children, in their capacity to understand, are made aware—as schools should be—of what data can be provided optionally. However, when nationality and place of birth were introduced by the DfE last year, many schools demanded that passports be brought into the classroom. In effect, the DfE operated an opt-out system. The introduction of nationality and place of birth data also raises the question of the relevance of data to improving education and its ultimate use. Many parents do not believe that such data has anything to do with the improvement of education. Last week, Against Borders for Children, supported by Liberty, launched an action against the Government on this basis.

There is now also considerable concern about the further expansion of the census data in January next year to include alternative provision data on mental health, pregnancy and other sensitive information without consent from parents or children, with no commitment to children’s confidentiality and without ceasing the use of identifying data for third-party use.

It was only after FOI requests and questions from Caroline Lucas that we discovered that the DfE had passed on individual records to the Home Office for particular immigration purposes. As defenddigitalme said, such action,

“impinges on fundamental rights to privacy and the basic data protection principles of purposes limitation and fairness”.

I appreciate that as the Bill stands such purposes are an exemption, but teachers are not border guards.

In 2013, a large number of records were passed to the Daily Telegraph by the DfE. In an Answer given on 31 October this year by Nick Gibb to a Question by Darren Jones, he incorrectly said that individuals could not be identified. There is no suggestion that there was any sinister intent, but many parents and schoolchildren would be appalled that a newspaper had possession of this data or that such a transfer of information was possible. Moreover, in the same Answer he said that he did not know how many datasets had been passed on. This is unacceptable. There needs to be a proper auditing process, as data needs to be safe. It is wrong too that a company may have more access to a pupil’s data than the pupil themselves, or indeed have such data corrected if wrong.

It is clear that from the Government’s point of view, one reason for having a good code of practice is to restore confidence in the Government, but this should not be the main reason. In September, Schools Week reported that the Information Commissioner’s Office was critical of the current DfE guidance, which is aimed at schools rather than parents or children and is, in the main, procedural. It said that rights were not given enough prominence. Both children and parents need to be properly informed of these rights and the use to which data is put at every stage throughout a child’s school life and, where applicable, beyond.

Lord Clement-Jones (Liberal Democrat)

My Lords, I add my very strong welcome for this amendment to the very strong welcome from these Benches. I endorse everything that my noble friend Lord McNally said about the noble Baroness, Lady Kidron, and her energy and efforts. In fact, I believe that she was far too modest in her introduction of the amendment. I agree with the noble Lord, Lord Best, that, quite honestly, this is essentially a game-changer in the online world for children. As he said, the process of setting standards could be much wider than simply the UK. As the noble Lord, Lord Puttnam, said, these major tech companies need to wake up and understand that they have to behave in an ethical fashion. Having been exposed to some of the issues in recent weeks, it is obvious to me that as technology becomes ever more autonomous, the way tech companies adopt ethical forms of behaviour becomes ever more important. This is the start of something important in this field. Otherwise, the public will turn away and will not understand why all this is happening. That will inevitably be the consequence.

Perhaps I may add something to what the noble Baroness, Lady Kidron, said. As I said, she is too modest. I have read her report, Digital Childhood—Addressing Childhood Development Milestones in the Digital Environment, which contains lessons the Government should take on board for their internet safety strategy. I hope the Minister will read it himself. There is a useful passage which states:

“We cannot solely rely on the digital resilience of children. Industry and government must adapt the digital environment to make it fit for children by acting above and beyond commercial consideration”.

That is exactly what the amendment does. However, it is applicable also to many other aspects of the internet safety strategy. Many other points are made in the report: that the Government should use childhood development milestones to determine their policy-making process, that industry should commit to delivering an age-appropriate digital agency to children even when it challenges its own commercial interests, and so on.

The noble Baroness is far too modest. I read the report with huge admiration for the work that has gone into it and the principles enunciated in it, which can inform a future digital safety strategy. I hope it is required reading for anyone within the DDCMS who is charged with taking forward the digital safety strategy.

On Amendment 117, tabled by the noble Earl, Lord Clancarty, I come rather late to the party. However, he made a strong case—there is a crucial case to answer. I know that 20 organisations have written to the Prime Minister on this issue today. The new national data collection in the alternative provision census comes into effect in January, with new labels being added to children’s records and the national pupil database. This database is currently in use. Apparently more than 1,000 requests for the use of confidential pupil records in the database have been approved by the Department for Education since March 2012. It is not a theoretical database and the Department for Education has to take responsibility for it. The points made by the noble Earl need answering—if not by the Minister then certainly by the Department for Education.

Lord Stevenson of Balmacara (Labour)

My Lords, we have had a good discussion this evening about topics raised in Committee, where the strength of feeling and expertise displayed was highly instrumental in persuading Ministers to think again about the approach they were taking towards the regulatory process for children’s data being transferred into the internet. It shows that well-argued cases can get through even the most impervious armour put on by Ministers when they start battling on their Bills. I am delighted to see it.

The noble Lord, Lord Clement-Jones, commented on Amendment 117, tabled by the noble Earl, Lord Clancarty. I wondered why that amendment had been included in the group because it seemed to point in a different direction. It deals with data collected and used by the Government, having cleared what would presumably be the highest standards of propriety in relation to it. However, the story that emerged, endorsed by the noble Lord, Lord Clement-Jones, is shocking and I hope that the Minister will be able to help us chart a path through this issue. Several things seem to be going wrong. The issues were raised by my noble friend Lord Knight in Committee, but this amendment and the paperwork supplied with it give me a chill. The logic behind the amendment’s being in this group is that this is the end-product of the collection of children’s data—admittedly by others who are providing it for them in this case—and it shows the kinds of dangers that are about. I hope that point will be answered well by the Minister when he comes to respond.

I turn to the substantive amendment; it is an honour to have been invited to sign up to it. I have watched with admiration—as have many others—the skilful way in which the noble Baronesses, Lady Kidron and Lady Harding, and others have put together a case, then an argument and then evidence that has persuaded all of us that something can be done, should be done and now will be done to make sure that our children and grandchildren will have a safe environment in which they can explore and learn from the internet.

When historic moments such as this come along you do not often notice them. However, tonight we are laying down a complete change in the way in which individuals relate to the services that have now been provided on such a huge scale, as has been described. I welcome that—it is an important point—and we want to use it, savour it and build on it as we go forward.

I first sensed that we were on the right path here when I addressed an industry group of data-processing professionals recently. Although I wowed them with my knowledge of the automatic processing of data and biometric arguments—I even strayed into de-anonymisation, and got the word right as I spoke in my cups—they did not want anything to do with that: they only wanted to talk about what we were going to do to support the noble Baroness, Lady Kidron, and her amendments. When the operators in industry are picking up these debates and realising that this is something that they had always really wanted but did not know how to do—and now it is happening and they are supporting it all they can—we are in the right place.

The noble Baroness, Lady Harding, said something interesting about it being quite clear now that self-regulation does not work—she obviously has not read Adam Smith recently; I could have told her that she might have picked that up from earlier studies. She also said, to redeem herself, that good regulation has a chance to change behaviour and to inculcate a self-regulatory approach, where those who are regulated recognise the strength of the regulations coming forward and then use it to develop a proper approach to the issue and more. In that sense she is incredibly up to date. Your Lordships’ House discussed this only last week in a debate promoted by the noble Baroness, Lady Neville-Rolfe, on what good regulation meant and how it could be applied. We on these Benches are on all fours with her on this. It is exactly the way to go. Regulation for regulation’s sake does not work. Stripping away regulation because you think it is red tape does not work. Good regulation or even better regulation works, and that is where we want to go.

There are only three points I want to pick out of the contribution made by the noble Baroness, Lady Kidron, when she introduced the amendment. First, it is good that the problem we saw at the start of the process about how we were going to get this code applied to all children has been dealt with by the Government in taking on the amendment and bringing it back in a different way. As the noble Baroness admits, their knowledge and insight was instrumental in getting this in the Bill. I think that answers some of the questions that the noble Baroness, Lady Howe, was correctly asking. How do the recommendations and the derogation in the Bill reducing the age from 16 to 13 work in relation to the child? They do so because the amendment is framed in such a way that all children, however they access the internet, will be caught by it, and that is terrific.

The second point I want to make picks up on a concern also raised by the noble Baroness, Lady Harding. While we are probably not going to get a timescale today, the Bill sets a good end-stop for when the code is going to be implemented. However, one hopes that when the Minister comes to respond, he will be able to give us a little more hope than having to wait for 18 months. The amendment does say,

“as soon as reasonably practicable”,

but that is usually code for “not quite soon”. I hope that we will not have to wait too long for the code because it is really important. The noble Baroness, Lady Harding, pointed out that if the message goes out clearly and the descriptions of what we intend to do are right, the industry will want to move before then anyway.

Thirdly, I turn to the important question of how the code will be put into force in such a way that it makes sure that those who do not follow it will be at risk. Yes, there will be fines, and I hope that the Minister is able to confirm what the noble Baroness asked him when introducing her amendment. I would also like to pick up the point about the need to ensure that we encourage the Government to think again about the derogation of article 82. I notice in a document recently distributed by the Information Commissioner that she is concerned about this, particularly in relation to vulnerable people and children, who might not be expected to know whether and how they can exercise their rights under data protection law. It is clear that very young people will not be able to do that. If they cannot or do not understand the situation they are in, how is enforcement going to take place? Surely the right thing to do is to make sure that the bodies which have been working with the noble Baroness, Lady Kidron, which know and understand the issues at stake here, are able to raise what are known as super complaint-type procedures on behalf of the many children to whom damage might be being done but who do not have a way of exercising their rights.

If we can have a response to that when we come to it later in the Bill, and in the interim get answers to some of the questions I have set out, we will be at the historic moment of being able to bless on its way a fantastic approach to how those who are the most vulnerable but who often get so much out of the internet can be protected. I am delighted to be able to support the amendment.

Lord Ashton of Hyde (Conservative)

My Lords, first, like other noble Lords, I pay tribute to the noble Baroness, Lady Kidron, for her months—indeed, years—of work to ensure that the rights and safety of children are protected online. I commend her efforts to ensure that the Bill properly secures those rights. She has convinced us that it is absolutely right that children deserve their own protections in the Bill. The Government agree that these amendments do just that for the processing of a child’s personal data.

Amendment 109 would require the Information Commissioner to produce a code of practice on age-appropriate design of online services. The code will carry the force of statutory guidance and set out the standards expected of data controllers to comply with the principles and obligations on data processors as set out by the GDPR and the Bill. I am happy to undertake that the Secretary of State will work in close consultation with the Information Commissioner and the noble Baroness, Lady Kidron, to ensure that this code is robust, practical and, most importantly, meets the development needs of children in relation to the gathering, sharing, storing and commoditising of their data. I have also taken on board the recommendations of the noble Lord, Lord Clement-Jones, on the internet safety strategy. We have work to do on that and I will take his views back to the department.

The Government will support the code by providing the Information Commissioner with a list of minimum standards to be taken into account when designing it. These are similar to the standards proposed by the noble Baroness in Committee. They include default privacy settings, data minimisation standards, the presentation and language of terms and conditions and privacy notices, uses of geolocation technology, automated and semi-automated profiling, transparency of paid-for activity such as product placement and marketing, the sharing and resale of data, the strategies used to encourage extended user engagement, user reporting and resolution processes and systems, the ability to understand and activate a child’s right to erasure, rectification and restriction, the ability to access advice from independent, specialist advocates on all data rights, and any other aspect of design that the commissioner considers relevant.

The new age-appropriate design code interlocks with the existing data protection enforcement mechanism found in the Bill and the GDPR. The data protection principles apply equally to children and are applied by data controllers on the basis of guidance provided by the commissioner. The GDPR makes clear that children merit specific protection with regard to their personal data as they may be less aware of the risks and consequences. The code will establish the standards required of data controllers to meet this obligation. The status of a statutory code means that any organisation that ignores it is taking a significant legal risk.

The Information Commissioner considers many factors in every regulatory decision, but non-compliance with this code will weigh particularly heavily for a non-compliant website or app maker. Organisations that wish to minimise their risk of being penalised up to £18 million or 4% of global turnover will apply the code; it would be foolhardy not to do so. I hope the noble Lords, Lord McNally and Lord Puttnam, can take some comfort from that. The new code on age-appropriate design will have the same proven enforceability as our codes on direct marketing and data sharing, issues we take extremely seriously. My noble friends Lady Harding and Lord Arbuthnot, the noble Lord, Lord Puttnam, and the noble Baroness, Lady Howe, along with many other noble Lords, have asked in effect whether the codes have teeth. We say that they do.

The principle-based regulatory approach sets few rules so the ICO produces guidance as to how those principles must be observed. Organisations may find alternative ways of meeting the requirements, but will need to demonstrate compliance. If they do nothing, they risk breaking the law. While all ICO guidance has teeth, statutory codes have sharper teeth. They can be used in evidence in any legal proceedings, not only data protection proceedings. In determining a question arising from proceedings, courts and tribunals must take into account any part of the code that appears to them relevant to that question. In carrying out her functions, the Information Commissioner must also take the code into account. When investigating a breach of data protection law, the commissioner has to decide whether the data controller acted reasonably. In conducting this balancing test, the failure to comply with a statutory code will weigh heavily against the controller. In areas where there is competing guidance such as that produced by self-regulators—for example, the Institute of Fundraising, IPSO and so on—statutory guidance takes precedence.

It is proven to work. The new age-appropriate design code will be the commissioner’s third statutory code. The first was the data sharing code, which was originally provided for in the Coroners and Justice Act 2009 and will be re-enacted by Clause 119 of the Bill. This is a key tool to ensure that data controllers comply with the law. The commissioner asked for her guidance on direct marketing to be given the status of a statutory code to enable tough enforcement. The Government delivered the statutory code in the Digital Economy Act 2017 and it will be re-enacted by Clause 120 of this Bill.

Amendment 111 makes clear that the new code will be laid as soon as possible and no more than 18 months after the passing of the Bill. I have noted the comments of the noble Lord, Lord Stevenson, and I have said that it will be laid as soon as possible. The Information Commissioner, working with the Government, the noble Baroness, Lady Kidron, and a range of concerned stakeholders, will use that time to get it right and to ensure that they are the best possible rules to protect children while allowing them to continue to enjoy the benefits of the internet and be full citizens of the digital age. I hope the House can see that this position has been developed with a concern to ensure that children in the UK are granted a robust data regime so that they can access online services in a way that meets their age and development needs. This is and will remain a top priority for the Government. Again, I thank the noble Baroness for her amendments and, much more importantly in some ways, her leadership on this matter.

Before I leave this, the noble Baroness, Lady Kidron, and the noble Lord, Lord Stevenson, mentioned article 80(2) on representation of data subjects. This is coming up. Our view is that the Data Protection Bill provides sufficient recourse for data subjects by enabling them to give consent to non-profit organisations to represent their interests in the event that their rights have been infringed. As I said, I am sure we will have a chance to debate that on the third day of Report.

While we are very pleased to support the noble Baroness’s Amendments 109, 111, 112 and 114, we also have a number of government amendments in this group. Amendments 110, 113, 115 and 116 are technical amendments to ensure that the noble Baroness’s amendments are correctly stitched into the framework for creating and enforcing codes of practice, consistent with other statutory codes that the commissioner must produce. I will move those amendments.

Finally, we believe that Amendment 117 in the name of the noble Earl, Lord Clancarty, is unnecessary. The sharing of individual-level pupil data is already highly regulated in law, specifically in Section 537A of the Education Act 1996. The Department for Education takes its data protection responsibilities seriously. To comply with the law, it has developed a rigorous process around data sharing of individual records. It does not share data simply because it is lawful to do so; it shares data only where it is both lawful and ethical to do so. As part of the approvals process, officials, including legal experts and senior civil servants with data expertise, assess the application for public benefit, proportionality—ensuring the minimum amount of data is used to meet the purpose—and legal underpinning, and so that the strict information security standards we enforce have been satisfied.

The Department for Education goes to great lengths to be transparent and accountable in data sharing. Since December 2013, it has provided summary information about data sharing requests that have been approved through the existing NPD Data Management Advisory Panel, providing public transparency about the sharing of individual pupil-level data.

In preparation for the GDPR coming into force, the department is actively reviewing its data-sharing processes with third parties to ensure greater security, consistency, accountability and transparency around data sharing. Before May 2018, the department will review its existing arrangements and processes for sharing sensitive personal data to date to ensure they are compliant with the incoming regulations, and review them regularly thereafter. As part of that work and to ensure citizens have even greater oversight of the department’s data, on 14 December the department is publishing an oversight of all DfE external personal-level data sharing to date and will continue to update this publication regularly. In view of this reassurance, I would be grateful if the noble Earl did not press his amendment.

Baroness Kidron (Crossbench)

My thanks to the noble Lord the Minister. The wonderful thing about having the Minister’s name to your amendments is that he has answered all the difficult questions. I thank everyone who spoke for their very kind words, not on my behalf, but on behalf of all the people who work to protect children, online and offline. I accept noble Lords’ thanks. It is very moving.

I would like to say three things. I was overwhelmed this weekend when the news broke that we had come to terms on the amendment. I received many emails from other parts of the world. To those who said in the debate that this may be a first step not just for us, but for the world—or at least in Europe—all indications are in that direction. I also reassure everyone that this amendment in no way threatened adequacy. Officials and I have been through this issue at great length. We had the kind and generous advice of Jonathan Swift QC, who is a great expert in this matter. We are quite sure of adequacy. On the question of enforcement globally, this is a challenge not for this amendment alone, but one for the Bill as a whole.

In the meantime, I look forward to working with the Government and others to make sure this is a meaningful first step to creating a digital world in which children can thrive. I beg leave to withdraw Amendment 7, and note that the other amendments will be moved as they appear.

Amendment 7 withdrawn.

Clause 9: Special categories of personal data and criminal convictions etc data

Lord Clement-Jones (Liberal Democrat)

My Lords, in moving Amendment 8 I will speak to Amendment 21. I will be a little longer than perhaps those waiting on their dinner would like. I apologise for that, but this is an important set of amendments for those wishing to make use of new technologies using biometrics.

In Committee the Minister focused on the use of biometrics in a clear context, such as using a fingerprint to unlock a mobile device. In that context he may be correct to say that the enabling of this security feature by the user constitutes consent—although without a record of the consent it would still fall short of GDPR requirements. However, the contexts I was aiming to cover are those where the biometric data processing is an integral part of a service or feature, and the service or feature simply will not function without it.

Other contexts I was looking to cover include where banks decide to use biometric technology as extra security when you phone up or access your account online. Some banks offer this as an option, but it is not hard to envisage this becoming a requirement as banks are expected to do more to protect account access. If it is a mandatory requirement, consent is not appropriate—nor would it be valid. HMRC has begun to use voice recognition so that people will not have to go through all the usual security questions. If HMRC does this after 25 May 2018 it could be unlawful.

This is certainly the case with biometric access systems at employment premises. It is also the case where biometrics are used in schools and nurseries, such as for access controls and identifying who is picking up a child. In schools, biometrics are sometimes used to determine entitlements, such as free meals, in a way that does not identify or risk stigmatising those who receive them, and avoids children having to remember swipe cards or carry money.

In these contexts, providing an alternative system that does not use biometrics would probably undermine the security and other reasons for having biometrics in the first place. Without any specific lawful basis for biometric data, organisations will rely entirely on the Government, the ICO and the courts, accepting that their uses fall within the fraud prevention/substantial public interest lawful bases and within the definition of “scientific research”.

The amendments are designed to meet all these objections. In particular, the research elements of the amendments replicate the research exemption in Section 33 the Data Protection Act 1998. The effect of this exemption is that organisations processing personal data for research purposes are exempt from certain provisions of the Act, provided that they meet certain conditions. The key conditions are that the data is not used to support measures or decisions about specific individuals and that there is no substantial damage or distress caused by the processing.

In this context—I am afraid this is the reason for taking rather longer than I had hoped—it is important to place on the record a response to a number of points made in the Minister’s letter of 5 December to me about biometric data. First, he said:

“As you are aware, the General Data Protection Regulation … regards biometric data as a ‘special category’ of data due to its sensitivity”.

This is precisely why the amendment is needed. The change in status risks current lawful processing becoming unlawful. This type of data is being processed now using conditions for processing that will no longer be available once it becomes sensitive data.

Secondly, the Minister said:

“In order to process such data, a controller must satisfy a processing condition in Article 9 of the GDPR. The most straightforward route to ensure that processing of such data was lawful would be to seek the explicit consent of the data subject”.

But consent is not the most straightforward route. Consent under GDPR has to meet certain conditions to be valid, which sets the bar high. It is valid only where it is a genuine choice, and many aspects of business processing are not a choice for individuals.

Thirdly, the Minister said:

“You explained that many businesses, such as banks, already make use of biometric identification verification mechanisms. Some devices, such as computers and smartphones, allow users to access the service using fingerprint recognition, for example”.

This statement confuses two things: the use of fingerprint or other biometrics as a way to access devices such as smartphones or laptops, which is an optional feature provided by the manufacturer; and the use of biometrics by service providers such as banks to allow customers to access their accounts.

Some service providers piggyback on the smartphone or laptop functionality to offer this as an option to customers if they have already enabled it for access to the device. However, banks use biometrics, such as voice recognition, for account access over the phone so that their customer services team can authenticate you, which is unrelated to biometrics used to access a device.

Fourthly, the Minister said:

“Generally speaking, such mechanisms are offered as an alternative to more conventional forms of access, such as use of passwords, and service providers should therefore have no difficulty in seeking the data subjects’ GDPR-compliant consent”.

This is the case as long as you believe that service providers can continue to make it optional. We are already seeing a move to replace passwords with biometrics, given their weakness and the increase in the number of data hacks that compromise passwords. The more user names and passwords are compromised, the more we will demand that banks do more to prevent unauthorised access, so it would seem sensible to future-proof data protection law so that banks can seamlessly move to a system where biometric access for certain services or transactions is mandatory.

Fifthly, the Minister said:

“However, you explained that problems may arise for example when employers or schools decide to secure access to their premises with ID verification mechanisms and employees and pupils do not have real choice about whether to use the devices”—

I am sorry. I am just finding the right place in my notes.

Lord Ashton of Hyde (Conservative)

Keep going.

Lord Clement-Jones (Liberal Democrat)

I may have to add later to what I have said, which I think the Minister will find totally unpalatable. I will try to move on.

The Minister also said:

“You are concerned that if consent is not a genuine option in these situations and there are no specific processing conditions in the Bill to cover this on grounds of substantial public interest. Processing in these circumstances would be unlawful. To make their consent GDPR compliant, an employer or school must provide a reasonable alternative that achieves the same ends, for example, offering ‘manual’ entry by way of a reception desk”.

Consent is rarely valid in an employment context. If an employer believes that certain premises require higher levels of security, and that biometric access controls are a necessary and proportionate solution, it cannot be optional with alternative mechanisms that are less secure, as that undermines the security reasons for needing the higher levels of security in the first place: for example, where an employer secures a specific office or where the staff are working on highly sensitive or confidential matters, or where the employer secures a specific room in an office, such as a server room, where only a small number of people can have access and the access needs to be more secure.

Biometrics are unique to each person. A pass card can easily be lost or passed to someone else. It is not feasible or practical to insist that organisations employ extra staff for each secure office or secure room to act as security guards to manually let people in.

The Minister further stated:

“You also queried whether researchers involved in improving the reliability or ID verification mechanisms would be permitted to carry on their work under the GDPR and the Bill. Article 89(1) of the GDPR provides that processing of special categories of data is permitted for scientific research purposes, providing that appropriate technical and organisational safeguards are put in place to keep the data safe. Article 89(1) is supplemented by the safeguards of clause 18 of the Bill. For the purposes of GDPR, ‘scientific research’ has a broad meaning. When taken together with the obvious possibility of consent-based research, we are confident that the Bill allows for the general type of testing you have described”.

It is good to hear that the Government interpret the research provisions as being broad enough to accommodate the research and development described. However, for organisations to use these provisions with confidence, they need to know whether the ICO and courts will take the same broad view.

There are other amendments which would broaden the understanding of the research definition, which no doubt the Minister will speak to and which the Government could support to leave no room for doubt for organisations. However, it is inaccurate to assume that all R&D will be consent based; in fact, very little of it will be. Given the need for consent to be a genuine choice to be valid, organisations can rarely rely on this as they need a minimum amount of reliable data for R&D that presents a representative sample for whatever they are doing. That is undermined by allowing individuals to opt in and out whenever they choose. In particular, for machine learning and AI, there is a danger of discrimination and bias if R&D has incomplete datasets and data that does not accurately represent the population. There have already been cases of poor facial recognition programmes in other parts of the world that do not recognise certain races because the input data did not contain sufficient samples of that particular ethnicity with which to train the model.

This is even more the case where the biometric data for research and development is for the purpose of improving systems to improve security. Those employing security and fraud prevention measures have constantly to evaluate and improve their systems to stay one step ahead of those with malicious intent. The data required for this needs to be guaranteed and not left to chance by allowing individuals to choose. The research and development to improve the system is an integral aspect of providing the system in the first place.

I hope that the Minister recognises some of those statements that he made in his letter and will be able, at least to some degree, to respond to the points that I have made. There has been some toing and froing, so I think that he is pretty well aware of the points being raised. Even if he cannot accept these amendments, I hope that he can at least indicate that biometrics is the subject of live attention within his department and that work will be ongoing to find a solution to some of the issues that I have raised. I beg to move.

Baroness Hamwee (Liberal Democrat)

My Lords, I wonder whether I might use this opportunity to ask a very short question regarding the definition of biometric data and, in doing so, support my noble friend. The definition in Clause 188 is the same as in the GDPR and includes reference to “behavioural characteristics”. It states that,

“‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of an individual, which allows or confirms the unique identification of that individual, such as facial images or dactyloscopic data”.

Well:

“There’s no art

To find the mind’s construction in the face”.

How do behavioural characteristics work in this context? The Minister may not want to reply to that now, but I would be grateful for an answer at some point.

Lord Ashton of Hyde (Conservative)

My Lords, I thank the noble Lord, Lord Clement-Jones, for engaging constructively on this subject since we discussed it in Committee. I know that he is keen for data controllers to have clarity on the circumstances in which the processing of biometric data would be lawful. I recognise that the points he makes are of the moment: my department is aware of these issues and will keep an eye on them, even though we do not want to accept his amendments today.

To reiterate some of the points I made in my letter so generously quoted by the noble Lord, the GDPR regards biometric data as a “special category” of data due to its sensitivity. In order to process such data, a data controller must satisfy a processing condition in Article 9 of the GDPR. The most straightforward route to ensure that processing of such data is lawful is to seek the explicit consent of the data subject. However, the GDPR acknowledges that there might be occasions where consent is not possible. Schedule 1 to the Bill makes provision for a range of issues of substantial public interest: for example, paragraph 8, which permits processing such as the prevention or detection of an unlawful act. My letter to noble Lords following day two in Committee went into more detail on this point.

The noble Lord covered much of what I am going to say about businesses such as banks making use of biometric identification verification mechanisms. Generally speaking, such mechanisms are offered as an alternative to more conventional forms of access, such as use of passwords, and service providers should have no difficulty in seeking the data subject’s free and informed consent, but I take the point that obtaining proper, GDPR-compliant consent is more difficult when, for example, the controller is the data subject’s employer. I have considered this issue carefully following our discussion in Committee, but I remain of the view that there is not yet a compelling case to add new exemptions for controllers who wish to process sensitive biometric data without the consent of data subjects. The Bill and the GDPR make consent pre-eminent wherever possible. If that means employers who wish to install biometric systems have to ensure that they also offer a reasonable alternative to those who do not want their biometric data to be held on file, then so be it.

There is legislative precedent for this principle. Section 26 of the Protection of Freedoms Act 2012 requires state schools to seek parental consent before processing biometric data and to provide a reasonable alternative mechanism if consent is not given or is withdrawn. I might refer the noble Lord to any number of speeches given by members of his own party—the noble Baroness, Lady Hamwee, for example—on the importance of those provisions. After all, imposing a legislative requirement for consent was a 2010 Liberal Democrat manifesto commitment. The GDPR merely extends that principle to bodies other than schools. The noble Lord might respond that his amendment’s proposed subsection (1) is intended to permit processing only in a tight set of circumstances where processing of biometric data is undertaken out of necessity. To which I would ask: when is it genuinely necessary to secure premises or authenticate individuals using biometrics, rather than just cheaper or more convenient?

We also have very significant concerns with the noble Lord’s subsections (4) and (5), which seek to drive a coach and horses through fundamental provisions of the GDPR—purpose limitation and storage limitation, in particular. The GDPR does not in fact allow member states to derogate from article 5(1)(e), so subsection (5) would represent a clear breach of European law.

For completeness, I should also mention concerns raised about whether researchers involved in improving the reliability of ID verification mechanisms would be permitted to carry on their work under the GDPR and the Bill. I reassure noble Lords, as I did in Committee, that article 89(1) of the GDPR provides that processing of special categories of data is permitted for scientific research purposes, providing appropriate technical and organisational safeguards are put in place to keep the data safe. Article 89(1) is supplemented by the safeguards in Clause 18 of the Bill. Whatever your opinion of recitals and their ultimate resting place, recital 159 is clear that the term “scientific research” should be interpreted,

“in a broad manner including for example technological development and demonstration”.

This is a fast-moving area where the use of such technology is likely to increase over the next few years, so I take the point of the noble Lord, Lord Clement-Jones, that this is an area that needs to be watched. That is partly why Clause 9(6) provides a delegated power to add further processing conditions in the substantial public interest if new technologies, or applications of existing technologies, emerge. That would allow us to make any changes that are needed in the future, following further consultation with the parties that are likely to be affected by the proposals, both data controllers and, importantly, data subjects whose sensitive personal data is at stake. For those reasons, I hope the noble Lord is persuaded that there are good reasons for not proceeding with his amendment at the moment.

The noble Baroness, Lady Hamwee, asked about behavioural issues. I had hoped that I might get some inspiration, but I fear I have not, so I will get back to her and explain all about behavioural characteristics.

Lord Clement-Jones (Liberal Democrat)

My Lords, I realise that, ahead of the dinner break business, the House is agog at details of the Data Protection Bill, so I will not prolong the matter. The Minister said that things are fast-moving, but I do not think the Government are moving at the pace of the slowest in the convoy on this issue. We are already here. The Minister says it is right that we should have alternatives, but for a lab that wants facial recognition techniques, having alternatives is just not practical. The Government are going to have to rethink this, particularly in the employment area. As more and more banks require it as part of their identification techniques, it will become of great importance.

We are just around the corner from these things, so I urge the Minister, during the passage of the Bill, to look again at whether there are at least some obvious issues that could be dealt with. I accept that some areas may be equivocal at this point, only we are not really talking about the future but the present. I understand what the Minister says and I will read his remarks very carefully, as no doubt will the industry that increasingly uses and wants to use biometrics. In the meantime, I beg leave to withdraw the amendment.

Amendment 8 withdrawn.

Consideration on Report adjourned until not before 8.48 pm.

Baroness Chisholm of Owlpen (Conservative)

My Lords, before I launch myself into the detail of these many amendments, I will express our thanks and gratitude for the detailed report of the Delegated Powers and Regulatory Reform Committee. We are also grateful for the extensive and informative discussions in Committee, and we have reflected on the views expressed by all noble Lords during the debates. We have carefully and comprehensively considered each of the committee’s recommendations, and none of our decisions have been reached lightly. A theme that noble Lords have heard me express previously is the extraordinary pace of change in the digital and data economy. I am very conscious that the Bill needs to provide a framework for the constant evolutions and developments in how we use and apply data. It must support rather than stifle innovation and growth and, primarily for this reason, in some areas we have deviated from the committee’s full recommendations.

I will speak to the key points. In its report, the committee raised concerns about the Henry VIII powers in Clauses 9(6), 33(6) and 84(3), which enable the Government to make regulations to “add to, vary or omit” the processing conditions and safeguards for sensitive data set out in Schedules 1, 8 and 10 respectively. Amendments 9, 90, and 99 respond to these concerns and narrow the regulation-making powers in these clauses. Amendment 9 removes the Government’s power to omit processing conditions and safeguards in Schedule 1. Amendments 90 and 99 remove the Government’s ability to vary or omit processing conditions in Schedules 8 and 10 respectively. We reflected at length as to whether we could go further than this but, on balance, considered it necessary to maintain the powers to add new processing conditions and to vary those in Schedule 1.

Many of these powers are not new. The 1998 Act already provides a power to add to the conditions for sensitive processing. In addition, many of the provisions in Schedule 1 in respect of which these powers will apply are currently set out in secondary legislation. This means that they can currently be added to, varied or omitted through other secondary legislation. Our experience under the 1998 Act and, indeed, in Committee, has highlighted the frequency with which scenarios can arise which require new processing conditions for sensitive data. Accepting the Committee’s recommendations in full would leave the Government unable to accommodate developments in data processing and the changing requirements of certain sectors. This in turn could render the UK at a disadvantage internationally if, for example, we were unable to make appropriate future provision for sectors, including those such as insurance, where the UK is a world leader, to reflect advances and changes in their approach to data processing.

The committee also raised concerns about Clause 15 of the Bill, which enables the Government by regulation to add to, vary or repeal the exemptions from certain specified data protection principles and data subject rights set out in Schedules 2, 3 and 4. Clause 111 contains a similar power to add, vary or repeal the list of exemptions in Schedule 11. The Government listened carefully to the debate in Committee, where the noble Lords, Lord Stevenson and Lord McNally, recognised the challenge of future-proofing the legislation to take account of changing technology. The noble Lord, Lord Stevenson, further suggested that,

“the most egregious issue here is when the Government seek to omit legislation which has been passed as primary legislation by secondary legislation”.—[Official Report, 6/11/17; col. 1639.]

I am hopeful that our amendments will set the noble Lord’s mind at rest.

Government Amendments 67 and 68 will remove the Government’s power in Clause 15 to omit provisions in Schedules 2, 3, and 4. It also removes Clause 15(1)(d) in its entirety. Amendment 103 removes the corresponding power in Clause 111(2) to vary or omit the existing provisions in Schedule 11. I am aware that there are some who would like us to go further than this, but it would not be a good idea for a number of reasons. First, a number of the provisions in Schedules 2 to 4 have been added to the Bill to address specific requirements arising from the new regime and have not yet been tested in operation. Others have been carried over from secondary legislation, where they can at present be added to, varied or removed. The Government therefore consider it prudent to retain the ability to amend Schedules 2 to 4 if it proves necessary. There is also a technical issue here. Schedules 3 and 4 contain a large number of references to subordinate legislation. The power to make and amend the instruments referred to does not always include the power to make consequential amendments to primary legislation. This provides a further, technical reason to retain the power in Clause 15 to vary these provisions.

Government Amendment 71 provides that any regulations made under Clause 17 will now be subject to the affirmative rather than negative resolution procedure. In cases of urgency, there is provision for the “made affirmative” procedure to be used if accompanied by an urgency statement. There is precedent for such an approach; for example, in the Legal Aid, Sentencing and Punishment of Offenders Act 2012. Amendments 168, 169, 170 and 184 make consequential provision later in the Bill.

I turn now turn to Amendments 130, 133, 134 and 136, which respond to the Committee’s concerns that the powers in Clauses 142 and 148 were too broad and gave the Government unlimited powers to determine types of additional failure that could attract the Information Commissioner’s enforcement powers, including unlimited penalties. Clearly, this was never the Government’s intention, and these amendments make it clear that any additional failures must be failures to comply with data protection legislation. They clarify also that the regulations making provision about the penalty for an additional failure will provide for the penalty to be either the standard maximum amount or the higher maximum amount referred to in Clause 150.

Amendment 144 provides that the Information Commissioner’s guidance about regulatory action will be subject to the negative resolution procedure when first produced. Generally, the Government believe that guidance of this kind should not be subject to parliamentary procedure. However, exceptionally in this instance, and in recognition of the large and ever-growing number of organisations for which this guidance will be relevant, on reflection the Government agree with the Committee that the negative resolution procedure would be appropriate. Amendments 139, 140, 141, 142 and 143 make consequential provision to ensure that the relevant clause functions as intended.

Amendment 166 reflects the concerns raised by noble Lords in Committee that regulations made under the Bill should be subject to consultation, not only with the Information Commissioner but also with consumer organisations and others who represent data subjects. Accordingly, we are including a requirement in Clause 169 that when the Secretary of State makes regulations under the Bill, she must consult “such other persons” as she considers appropriate. This will apply to all regulations save for those listed in new subsection (2A). We have also tabled consequential Amendments 126, 131, 135 and 138 to remove the equivalent requirement from Clauses 133(1), 142(9), 148(6) and 152(3) to avoid unnecessary duplication in the light of the new general requirement in Clause 169.

Finally, Amendment 171 narrows the regulation-making power in Clause 170 which provides for the Government to update the relevant parts of the Bill once the negotiations are completed on the revised convention 108 to only those parts of the Bill which the Government consider may require amendment. The Government always considered this part to be time limited and Amendment 172 introduces, in line with the committee’s recommendation, a sunset clause so that the regulation-making power in Clause 170 expires three years after Royal Assent.

I again express my gratitude to the committee for its detailed report and recommendations. They gave us much food for thought and I hope noble Lords will agree that we have adopted its recommendations where it was possible to do so. I thank all noble Lords for listening to me for what seems to have been forever.

On Amendment 10 in the name of the noble Lord, Lord Clement-Jones, I shall listen with interest to what he and other noble Lords have to say before responding. For now, noble Lords will be relieved to hear me say that I beg to move.

Lord Clement-Jones (Liberal Democrat)

My Lords, the noble Baroness having sat through my last speech, I am in no position to judge. That was a skilful summary of the memorandum put to the Delegated Powers and Regulatory Reform Committee and it is useful to have it on the parliamentary record.

I remind the House that the amendments we have brought forward do not take the ultra position, if you like. They are about having an appropriate level of parliamentary control over delegated legislation in a field where these are important matters—rights which are inextricably linked to human rights. To boil down a long memorandum, the Minister’s arguments are about flexibility and future proofing. However, the horse has bolted. In previous legislation such regulations were permitted to be made by government and therefore we should roll over and put them into the next bit of legislation.

The one essence that I take away is that the consultation duty is enshrined. I accept that it is a considerable improvement that the Secretary of State must consult the commissioner and such other persons as the Secretary of State considers appropriate. It would be useful at this stage at least to have on the record the kinds of bodies the Minister thinks are appropriate in these circumstances.

The real issue and the reason why we have tabled our amendments—I am not saying they are perfect but they allow for a parliamentary process in which there is an ability to suggest amendments and to have a full consultation on regulation changes—is the controversy about “omission”, “addition” and “varying”. The Government have clearly come to the view that omitting provisions is permissible in certain circumstances but they are relying on adding or varying. They say that varying is a light-touch aspect but why, in certain circumstances, is it permissible to omit provisions added by regulations? Is this a kind of second thoughts aspect, whereby regulations are brought forward under this Bill and then the Government think they want to omit some of them? I do not quite understand the rationale behind that.

I accept that in some of the crucial cases they are limiting themselves to “adding” or “varying”. However, variation can be extremely broad and virtually equivalent to omitting. It seems that one can vary a right all the way down to a minuscule situation which can impinge on the human rights of an individual, even though it is not technically an omission where a safeguarded is provided. These are very broad rights. They are broad powers to create new exemptions to data protection rules as they affect a data subject and they can add exemptions to safeguards for processing sensitive personal data. These matters could have a powerful effect on individuals.

I should remind the Minister of a sad aspect, which is that in its procedures, the Delegated Powers and Regulatory Reform Committee does not seem to have a second bite of the cherry—something I am sure the Minister approves of entirely. But for those of us who relied on the very useful original DPRRC report, it is unfortunate that the committee has not come back and said what it thinks of the ministerial memorandum. In the original report the committee went as far as to say:

“We consider that clause 9(6) is inappropriately wide and recommend its removal from the Bill”.

That is pretty heavy stuff, even for this useful committee. It had even more to say about Clause 15:

“We regard this is an insufficient and unconvincing explanation for such an important power”.

I must put on the record that we on these Benches do not think that the Government have discharged the onus of proof, showing why they need these extraordinary powers under the Bill, and we hope that they will further reduce their regulation-making powers.

Lord Kennedy of Southwark (Labour)

My Lords, this group of overwhelmingly government amendments seeks to address issues raised by the Delegated Powers and Regulatory Reform Committee in its sixth report, published on 24 October this year, the only addition being Amendments 10 and 69 in the names of the noble Lords, Lord Clement-Jones and Lord Paddick. As we have heard, the Delegated Powers and Regulatory Reform Committee is widely respected in the House and I am pleased that the government amendments address the concerns raised by the committee. But as we have heard from the noble Baroness, Lady Chisholm of Owlpen, those concerns have not been accepted in full, and she has given the reasons for that.

I was particularly pleased to see government Amendments 9, 67 and 68, among others, which would limit the powers to amend the processing conditions and exemptions found in various schedules to the Bill. I am equally pleased to see the Government act in respect of the powers to make regulations. This will be done using the affirmative rather the negative procedure, starting with government Amendment 71. It gives Parliament the right level of scrutiny and the ability to reject or express regret about a particular decision, and allows for a proper level of scrutiny, a debate having to take place in both Houses.

In respect of Clauses 9 and 15, Amendments 10 and 69 seek to change the scrutiny procedure from the affirmative, as presently in the Bill, to the super-affirmative. I am not convinced that this is necessary as we have the tools at our disposal to scrutinise the proposals using the affirmative procedure. Starting with government Amendment 130, we have a series of amendments relating to the enforcement powers of the ICO, and again these are to be welcomed.

As I say, in general I welcome the government amendments and the explanation given by the noble Baroness.

Baroness Chisholm of Owlpen (Conservative)

I thank the noble Lord for those kind words. The noble Lord, Lord Clement-Jones, asked who would be consulted. While it is clearly impossible to be specific, the Secretary of State might consider it appropriate to consult, for example, representatives of data subjects or trade bodies, depending on the circumstances and regulations in question. I hope that that answers his question.

On why it is permissible to admit provisions added by regulations, we believe it is qualitatively different from admitting those added during the extensive parliamentary debate and scrutiny afforded to primary legislation. As I said, many other powers are not new. The 1998 Act already provides a power to add to conditions for sensitive processing. We feel it is prudent to retain the ability to amend Schedules 2 to 4 if necessary. As I said, this is a fast-moving area. We want to make sure that the Bill provides a framework for the constant evolution and developments in how we use and apply data, but it must be supportive rather than stifle innovation and growth.

Lord Clement-Jones (Liberal Democrat)

With the greatest respect, the point I was making was whether the right to vary was not omission by the backdoor. Perhaps I was not clear enough.

Baroness Chisholm of Owlpen (Conservative)

No, we do not believe it is omission by the backdoor.

Amendment 9 agreed.

Amendment 10 not moved.

Schedule 1: Special categories of personal data and criminal convictions etc data

Lord Ashton of Hyde (Conservative)

My Lords, in Committee the noble Earl, Lord Kinnoull—I am very grateful to him for his help and that of the industry bodies that I have now met—told us that the language in the Bill enabling the processing of sensitive data relating to employment might be interpreted more narrowly than the similar wording in paragraph 2 of Schedule 3 to the Data Protection Act 1998. This was never the Government’s intention and I thank the noble Earl and the noble Lord, Lord Clement-Jones, for bringing the issue to the Government’s attention. Amendments 11 and 12 to address these concerns by reverting to the wording used in the 1998 Act, thereby removing any doubts as to their proper interpretation. I will sit down and wait for the noble Earl to propose his amendments and reply to them after. I beg to move.

Earl of Kinnoull (Crossbench)

My Lords, I am very grateful to the Minister for that news on those government amendments. It is very helpful and will prevent a lot of insurers having to redo their administrative systems. I shall speak to Amendments 25 and 26, which are another pair of insurance amendments. I declare my interests as set out in the register of the House, particular those in respect of the insurance industry.

I thank the noble Lord, Lord Clement-Jones, who has been very helpful. He brings great clarity at all times of day to our discussions. Although he is the chairman of the Artificial Intelligence Select Committee, his intelligence is far from artificial and is most helpful. Also, I see the Bill team over there. They have been excellent. Given the amount of fire coming in they are very calm, collected and user-friendly. I thank them for everything they have done so far on the Bill.

The Lloyd’s Market Association, the British Insurance Brokers’ Association and the Association of British Insurers, among other insurance associations, have helped in the preparations of some of these remarks. The insurance industry is trying to deliver products in the public interest. Indeed, some major classes of insurance, such as motor insurance and employers’ liability insurance, are compulsory. There is a long list of other insurances that are quasi-compulsory. For instance, one cannot get a mortgage without buying household insurance. It is greatly to society’s benefit that a wide choice of good products is available at a reasonable price.

The amendments seek broadly to achieve two things. The first is to amend the Bill so that the ordinary person and the ordinary small business can continue to have the best access to a choice of good insurance at a good price, while being consistent with the GDPR, and the second is to ask the Information Commissioner, who works for Parliament, to provide the insurance sector with the specific guidance necessary in this area and not guidance on a one-size-fits-all basis, which does not provide sufficient clarity.

The root of the issue is that the threshold for valid consent under the GDPR will now be much higher, which impacts the handling of special-category personal data. For insurers and reinsurers, the two most common types of special-category personal data are information relating to health and information relating to criminal convictions. Being able to consider health and criminal conviction data is hugely important for insurers uniformly and throughout the world both in taking policies on and in handling claims. As I remarked previously, the ABI estimates that the ability to process such data helped in detecting around £1.3 billion in fraudulent claims in 2015 alone. The LMA estimates the size of the Lloyd’s market alone where health data are required at £2.3 billion of premiums annually.

The ICO draft guidance suggests that consent as a precondition of accessing a service, as would be the case for a proposal for an insurance contract, would not be a legitimate basis for processing special-category personal data. This gives rise to a chicken-and-egg problem for insurance. In Committee, I gave several examples of undesirable results, which I do not propose to revisit.

There are many examples where ordinary citizens and small businesses would have problems were the Bill to be unamended. Where society asks for insurance to be bought, be it the compulsory classes of motor insurance or employers’ liability insurance, or the quasi-compulsory classes, of which there are many—household insurance with a mortgage in place is one—there is a substantial public interest in allowing heavily regulated insurers to process special-category personal data.

As I have said before, trying to shoehorn insurance business into the GDPR consent environment under article 9.2(a) is far from being in the public interest and the public would be best served to use the derogation under article 9.2(g)—that is,

“processing is necessary for reasons of substantial public interest”.

The amendments set out one way in which the issues might be tackled while being wholly consistent with the GDPR. While our detailed and highly constructive discussions continue, the eventual solution may or may not look like them, but I hope that it will have the same effect. Under Amendment 25, the new “insurance” paragraph would continue to sit within the “Substantial Public Interest Conditions” sub-heading in Schedule 1, Part 2, as do the current paragraphs 14 and 15, but the substantial public interest derogation for processing special-category personal data would be used rather than the consent derogation. Further, it makes it clear that special-category personal data can be used only for “necessary … purposes” and not, let us say, for a marketing drive. Sitting over the top will be the ICO and FCA, which I have no doubt will patrol matters with their usual thoroughness.

The other amendment would ask the ICO to prepare insurance-specific guidance and in doing so to consult. In its September response to the consultation on consent, the ICO noted the differing worries of various sectors but said that it did not intend to give any sector-specific guidance. The amendment asks them to do so. Given that the sectors named by the ICO included health and social care, education and charities as well as insurance, it is right that Parliament should ask its Information Commissioner to be as helpful as possible to all sectors. The case for that has grown strongly in the many days of debate that we have had on this Bill, and again today and tonight. I therefore ask the Minister to confirm that these issues will be brought back at Third Reading.

Lord Clement-Jones (Liberal Democrat)

My Lords, it is a pleasure to follow the noble Earl, Lord Kinnoull, who has very impressively pursued these issues with considerable care and determination. He has said pretty much everything that needs to be said. Processing special category data, including health data and criminal convictions is, as he said, fundamental to calculating levels of risk and underwriting. I hardly need to say that to the Minister. His amendments are welcome, but of course the essence of the noble Earl’s amendments is to get from the Minister a progress report on how things are moving on in terms of enabling the continued processing of special category and criminal conviction data and whether we can get something along the right lines that allows a derogation for processing of special category and criminal conviction data where it is necessary in relation to insurance policies and claims. That would prevent disruption to consumers in the way the noble Earl mentioned. Then, of course, there is the guidance produced by Amendment 26; this is what you might call a sprat to catch a mackerel and I hope that the Minister will deliver the mackerel.

Lord Kennedy of Southwark (Labour)

My Lords, I welcome government Amendments 11 and 12. As we have heard, they address some of the concerns that were raised in Committee. The Government have said that they never intended to have a narrow interpretation and they have put back the words of the 1998 Act, which is very welcome. As was said earlier, the noble Earl, Lord Kinnoull, has laid out in great detail the issues addressed in his Amendments 25 and 26. He makes a very important and clear case and raised some important issues. I hope that the noble Lord, Lord Ashton of Hyde, will respond to those. I certainly think that there is a case for bringing these things back at Third Reading to address the points the noble Earl has raised.

Lord Ashton of Hyde (Conservative)

My Lords, I am grateful to everyone who has spoken in this debate. As we have just heard, Amendment 25 would replace the existing processing conditions:

“Insurance and data concerning health of relatives of insured person”,

and:

“Third party data processing insurance policies and insurance on the life of another”,

with a broader insurance processing condition. Amendment 26 would require the Information Commissioner to produce sector-specific guidance for the insurance sector. These processing conditions are made under article 9(2)(g), the substantial public interest derogation. When setting out the grounds for such a derogation, the Government are limited by the need to meet this substantial public interest test. We are also required to provide appropriate safeguards for data subjects.

The Government recognise the importance of insurance products, in particular compulsory classes and the protection afforded by third-party liability. As the noble Earl mentioned, engagement between the insurance sector and government officials has continued since this matter was discussed in Committee and, indeed, since I met him and representatives of the insurance industry after Committee. There is still some work to do on the precise drafting of the relevant provisions, but I am grateful for the opportunity to place on record the Government’s intention to table an amendment addressing this issue at Third Reading, if we can finalise the drafting in time and the House is content for us to do so. At the moment I am not aware of any insuperable problems in that regard, but noble Lords will recognise that this is a complex issue and one that we want to get absolutely right.

As for the Information Commissioner producing sector-specific guidance, as proposed by Amendment 26, I will certainly take that back and pass it on to the department. With that reinsurance, or rather reassurance—“reinsurance” was a bit of a Freudian slip there—I respectfully invite the noble Earl not to move his amendments this evening. I beg to move.

Amendment 11 agreed.

Lord Brown of Eaton-under-Heywood (Judge)

My Lords, this group of amendments in my name, prompted by House officials, covers a number of issues concerning parliamentary privilege. The Bill in its present form contains some exemptions to its application to Parliament, but these are considered rather too narrow in scope. The group relates to four areas which have been raised by officials—that is, counsel and clerks of both Houses—as giving rise to concerns about how the Bill as drafted risks infringing parliamentary privilege. These concerns have been discussed extensively with the Bill team and the Leader’s office at official level, and drawn to the attention of the Senior Deputy Speaker, who is of course chairman of the Committee for Privileges and Conduct of this House. I say at once that these discussions have been most helpful and constructive. I pay tribute to the Bill team for its co-operation throughout.

Happily, the Bill team is now, as I understand it and as I expect the Minister shortly to confirm, satisfied that amendments to the Bill in all four areas of concern are appropriate, so that those will be forthcoming before Third Reading in the new year. I recognise and accept that those amendments may not follow the precise wording suggested in the present proposals but, provided they address the substance of these various specific concerns, we shall obviously be disposed to accept them.

In these circumstances, and given that we shall obviously not divide the House at this stage, it is unnecessary to outline the detailed nature of each of these proposed amendments. It is, I hope, sufficient to indicate that they include, for example, meeting concerns lest the Information Commissioner take enforcement action against Members or the corporate officers of either House—here, the Clerk of the Parliaments—in respect of the processing of personal data in parliamentary proceedings. Such action could lead to very substantial administrative penalties amounting to millions of pounds. There are concerns, too, about the liability of both corporate officers to prosecution for certain specified offences for things done on behalf of the two Houses of Parliament. I hope that that is sufficient, and at this stage I beg to move Amendment 16 and ask that the eight other amendments be accepted.

Baroness Hamwee (Liberal Democrat)

My Lords, from these Benches I support the noble and learned Lord, who is absolutely the right person to pursue this matter. If I might simply add to what he said, it is important that we bear in mind that in the same way as legal professional privilege is the privilege of the client, these provisions would be for the benefit of the public, the running of good democracy, good scrutiny and holding the Government to account. It is not a personal benefit that is proposed here and I hope—I trust, because this is very important—that the Government can find a way through this. I look forward to hearing from them, as the noble and learned Lord said, early in the new year.

Baroness Chisholm of Owlpen (Conservative)

My Lords, I am grateful to the noble and learned Lord, Lord Brown, for raising these amendments and for the words of the noble Baroness, Lady Hamwee. His amendments address concerns about the interaction of the Bill with parliamentary privilege. I agree wholeheartedly with him that parliamentary privilege should continue to be safeguarded and maintained for future generations, as it has been for centuries past. As I said in Committee, the Government’s view is that the Bill contains adequate protections to ensure that this is the case. However, we recognise the concerns that, in some areas, these protections could be enhanced and clarified, and we will bring forward amendments at Third Reading to address some of the points that the noble and learned Lord has raised in his amendments.

With that in mind, I will now turn briefly to the amendments themselves, starting with Amendments 16, 17 and 185. The Government recognise the concerns raised in these amendments about the way the conditions for processing sensitive personal data apply in respect of parliamentary proceedings, and liability under Clause 193(5). I am happy to reassure noble Lords that the Government intend to bring forward amendments to address these points at Third Reading.

Amendment 47 would create an exemption for personal data breaches which occur in the context of parliamentary proceedings from the requirement in article 34 of the GDPR. This article requires the data controller to notify data subjects about breaches of their personal data if the breach is likely to result in a high risk to their rights and freedoms. I understand the concerns raised by the noble and learned Lord, Lord Brown, which my officials have discussed with the House authorities. Having reflected on this further, the Government have decided to table an amendment to this effect at Third Reading.

Amendments 128, 129, 132 and 137 would preclude the Information Commissioner from exercising any of her enforcement functions in respect of personal data that is being processed for the purposes of proceedings in either House of Parliament. It is worth highlighting two points to noble Lords. First, the commissioner has all of these enforcement functions under the 1998 Act. While the scale of the penalties that can be levied under the GDPR will increase, there is no fundamental change to the nature of the commissioner’s enforcement functions. Secondly, the protections afforded for parliamentary privilege in the 1998 Act have been broadly mirrored and, where appropriate, developed in the Bill. There is no absence of protection where it was previously provided. To the extent possible, the Bill maintains the status quo for parliamentary privilege. However, we recognise the concerns that the enhanced scale of penalties that the commissioner will be able to apply under the GDPR may inadvertently have a chilling effect on freedom of expression in either House. While the Government cannot accept Amendments 128, 129, 132 and 137 in their current form, given the stringent requirements of the GDPR, the Government will work with the House authorities and look to bring forward an amendment which speaks to these concerns at Third Reading.

I hope that I have reassured the noble and learned Lord and the noble Baroness, Lady Hamwee, that the Government understand the concerns raised through these amendments and will undertake to work with the House authorities to, where appropriate, bring forward amendments to address them at Third Reading.

Lord Stevenson of Balmacara (Labour)

Before the Minister sits down, I put it to her that, in the considerations that will take place between now and the return in January, one thing that changes between 1998 and today in terms of the Act is something we have not looked at specifically, although it comes up in the Bill. It is the need to ring-fence the Information Commissioner from any involvement with Parliament or the Government. She is answerable to Parliament, but she should not be in that sense exposed to considerations that might adversely affect her. I hope that might be taken into account as well.

Baroness Chisholm of Owlpen (Conservative)

I agree with the noble Lord, and we will take that into account.

Lord Brown of Eaton-under-Heywood (Judge)

My Lords, I am most grateful for the reassurance given to us by the Minister. On the basis that all these matters will be brought back in some shape or form at Third Reading, I beg leave to withdraw the amendment.

Amendment 16 withdrawn.

Amendment 17 not moved.

Baroness Neville-Jones (Conservative)

My Lords, I introduced the same amendment in Committee and do not intend to repeat what I said then. I am glad to say that, since I put down that amendment, there has been a very helpful meeting between DCMS officials, the Genetic Alliance UK and UNIQUE. I very much hope that that meeting will form the basis of a solution on which we can build for Third Reading. I thank my noble friend the Minister for his personal contribution to the progress that we have made.

My understanding is that at that meeting it was accepted that an amendment would have to be brought forward to ensure the legality of the work of patient support groups. My understanding also is that the Government would prefer to do this by their own amendment, and I am certainly very happy to accept that. I also hope that it will be possible to agree such an amendment before Third Reading.

My noble friend has said that he is concerned about defining the scope of the amendment. I certainly accept that that is a legitimate issue. The family of patient support groups is quite large, but I accept that it is right to prevent any amendment becoming a loophole for evasion of the Bill’s provisions. I am conscious of that issue. However, the purpose of the amendment is not controversial and I am happy to look to finding words and drafting that will both safeguard the points that we want to make and provide the right scope for the amendment. It would be highly desirable to be able to deal with this matter in our House.

I hope and trust that my noble friend will be able to confirm that he shares my understanding of the point that we have now reached and that he will be able to give me an assurance at least of best endeavours to present a government amendment at Third Reading. I might say that Genetic Alliance and other patient support groups stand ready to help in any way that they can to meet this deadline.

Lord Clement-Jones (Liberal Democrat)

My Lords, I will speak briefly to support the noble Baroness, Lady Neville-Jones, in her amendment. Clearly, this is of great importance to patient groups. I very much hope that the Minister will carry on the good work and come back at Third Reading with something substantive for the benefit of patient organisations that collect vital health information from their members, so that they will not be required to destroy or anonymise data. Without amendment, the Data Protection Bill has the potential to seriously damage the work of these patient support groups and hinder the work of certain public agencies, too, such as Public Health England and NICE—so I very much support the noble Baroness.

Earl of Erroll (Crossbench)

My Lords, I will say a couple of things on this in full support of the proposition made by the noble Baroness, Lady Neville-Jones. These issues are very complicated. We tend to try to brush them aside and hope that they will be dealt with by the person who is enforcing and regulating. But that can be dangerous, because they will find it very difficult as well, and sometimes, if you do not have the intention in the Bill, it may just not happen.

This is important because, while I fully support the intention and objectives of the GDPR in the Data Protection Bill in front of us, which is there for all the right reasons, we have to be careful not to throw out the baby with the bathwater. This is one of those instances where, in trying overzealously to introduce a rules-based system in a complex world and a complex society, you find unexpected consequences. Some of them cannot be defined terribly easily in regulation, but I think it would be wise to put this in an amendment.

We in this House tend to think in principle much more than another place. To try to deal with this in another place when it gets there may be unwise in case they run out of time. It would be good to put something in the Bill in this House at Third Reading, if the Minister were so minded, and I would wholeheartedly support that.

Lord Patel (Crossbench)

My Lords, I have already spoken on this at length and I do not intend to repeat myself, but I support the amendment from the noble Baroness, Lady Neville-Jones. This is a very important database. It is not just national but international, and it is difficult to collect. That is why I am glad that an accommodation has been made to support the amendment.

Lord Stevenson of Balmacara (Labour)

My Lords, I add my voice in support of the noble Baroness’s amendment and wish it well. I suspect she has run into the logjam that constitutes the waiting list to see the Bill team and the Ministers, who have been worked so hard in the last few months. But I hope it will be possible, given that there is a bit of time now before Third Reading, for this matter to be resolved quickly and expeditiously before then.

Lord Ashton of Hyde (Conservative)

My noble friend Lady Neville-Jones explained in Committee that Unique plays a hugely important role in providing advice and support to sufferers of rare chromosomal disorders and their carers. Some of these charities have large databases dating back many years, so we understand their desire to maintain these when the GDPR comes into force without necessarily obtaining fresh consent to GDPR standards for each data subject included on the database. When families are providing support to their loved ones, some of whom may need round-the-clock care, filling in a new consent form may not be high on their agenda.

However, they may still value the support and services that patient support groups provide and would be concerned if they were removed from the charities’ databases. If charities such as Unique had to stop processing or delete records because consent could not be obtained, they worry that this would impede the work they do to put patients and their families in touch with others suffering from rare genetic conditions, help clinicians to deliver diagnoses and facilitate research projects. We recognise that this could be particularly damaging when there is barely any knowledge of the condition other than what they may hold on their database.

Let me be clear: if there is a grey area in the Bill that puts this work at risk, the Government are fully prepared to amend it. Legislating in this area is not straightforward and I am keen that the policy and legal teams in the department are able to continue with the constructive discussions they have been having with Unique and the UK Genetic Alliance to ensure that the legislation adequately covers the specific processing activities they are concerned about, while providing adequate safeguards for data subjects. I assure noble Lords that we will use our best endeavours to work on this legislative solution as quickly as possible. If it is not ready by Third Reading, and I am afraid I cannot promise it will be, the Government will endeavour to introduce any necessary provisions at the next possible amending stage of the Bill. I will of course ensure that my noble friend gets the credit she deserves for her persistent efforts on this subject when that time comes.

Government Amendments 72 to 77 are the products of detailed discussion with the noble Lord, Lord Patel, the noble Baroness, Lady Manningham-Buller, and representatives of the Wellcome Trust. I thank them very much for those constructive and helpful discussions. In Committee we discussed the operation of the safeguards in Clause 18 and the potentially damaging impact they would have on pioneering medical research. As I explained at the time, it was never the Government’s intention to undermine such important work, so it is with great pleasure that I table these amendments today.

Noble Lords will recall that the greatest concern stemmed from the safeguard in what is currently Clause 18(2)(a). That paragraph was designed to prevent researchers using personal data to make measures and decisions in respect of particular data subjects but, as the noble Lord explained, there are certain types of medical research where this is inevitable. In the context of a clinical trial, for example, a data subject might willingly agree to participate, but in the course of the trial researchers might need to make decisions about whether the treatment should continue or stop, with respect to some or all data subjects. Government Amendment 77 addresses this concern by making it clear that the safeguard is automatically met where processing is necessary for the purposes of approved medical research. Approved medical research is defined in the new clause and includes, for example, research approved by an ethics committee established by the Health Research Authority or relevant NHS body. Importantly, the new clause also contains an order-making power so that the definition of approved research can be kept up to date.

We have also taken the opportunity to make a small change to the safeguard in Clause 18(2)(b), which currently states that processing for research purposes should not occur if it causes substantial damage or distress to “an individual”. The Wellcome Trust and others pointed out that this language is different from that used in the Data Protection Act 1998, which talked about damage or distress caused to “a data subject”—namely those participating in the research. We did not set out to alter this safeguard, nor to jeopardise research that might conceivably offend far removed from the actual activity. Amendment 76 therefore reverts to the tried and tested language of the 1998 Act.

The amendments have been developed in close liaison with the Wellcome Trust and I am grateful to it for its help. On that note, I hope my noble friend feels able to withdraw her amendment and that all noble Lords feel able to support the government amendments in the group.

Lord Patel (Crossbench)

Before the Minister sits down, I thank him and his team immensely for taking on board the concerns that I and others expressed about the interventional medical research that the government amendments will now allow. It cannot be overstated: this will now allow important research, including clinical trials, to be undertaken that will advance medical research in the United Kingdom, making it an attractive place to do such research. I thank him immensely; I am most grateful.

Baroness Neville-Jones (Conservative)

My Lords, I am extraordinarily grateful to noble Lords who have spoken in support of my amendment, and for the comprehension that the Minister has shown for the work of the patient support groups. They will have greatly appreciated hearing how much the Government support what they do.

I very much hope that we can work on an amendment that will both meet the Government’s concerns and effectively cover the work of those organisations, which, as I think the Minister understands, work in difficult circumstances. They stand ready to participate with the Government in getting language that will both cover their concerns and ensure that we do not open the door to those for whom it is not intended. On that basis, I beg leave to withdraw the amendment.

Amendment 24 withdrawn.

Amendments 25 and 26 not moved.

Lord Kennedy of Southwark (Labour)

My Lords, I tabled this amendment to keep the issue that I raised in Committee on the agenda. I spoke about it at some length in Committee. I think it is better determined by your Lordships’ House, rather than going off to the other place. I know the Minister has kindly agreed to a meeting. We have not had a chance to have it yet, but we will later this week.

I know that the noble Lord, Lord Hayward, who sits on the Government Benches, fully supports this issue being debated. He, like me, hopes it can be sorted out here by Third Reading, rather than going to the other place. The basic problem is that provisions in the Bill potentially conflict with legislation in respect of elections and other matters already on the statute book. I went through those in Committee. I am sure we do not want to pass legislation that conflicts with existing legislation, but we risk doing that here. That cannot be right. What political parties, campaigners and politicians need—and certainly what the regulators need—is crystal clear legislation and regulation that they can apply. To pass something that is in direct conflict with the Representation of the People Act would be unwise. We need to have our meeting later this week and I hope we can bring something back at Third Reading. These are important issues that we need to get right to ensure that all legislation is working together. I beg to move.

Baroness Hamwee (Liberal Democrat)

My Lords, I am very glad that the noble Lord is keeping this on the agenda. I had a note to ask what was happening about the meeting to which lots of people were invited at the previous stage. I do not believe that we have heard anything about it. This is not a whinge but a suggestion that it is important to discuss this very widely.

I find this paragraph in Schedule 1 very difficult. One of the criteria is that the processing is necessary for the purposes of political activities. I honestly find that really hard to understand. Necessary clearly means more than desirable, but you can campaign, which is one of the activities, without processing personal data. What does this mean in practice? I have a list of questions, by no means exhaustive, one of which comes from outside, asking what is meant by political opinion. That is not voting intention. Political opinion could mean a number of things across quite a wide spectrum. We heard at the previous stage that the Electoral Commission had not been involved in this, and a number of noble Lords urged that it should be. It did not respond when asked initially, but that does not mean it should be kept out of the picture altogether. After all, it will have to respond to quite a lot of what goes on. It might not be completely its bag, but it is certainly not a long way from it.

We support pinning down the detail of this. I do not actually agree with the noble Lord’s amendment as drafted, but I thank him for finding a mechanism to raise the issue again.

Lord Ashton of Hyde (Conservative)

I am grateful to the noble Lord, Lord Kennedy, for raising this issue, and to the noble Baroness for her comments. These issues are vital to our system of government, and we agree with that.

Amendment 27 seeks to expand the umbrella term “political activities” to include any additional activities determined to be appropriate by the Electoral Commission. Noble Lords will agree that engaging and interacting with the electorate is crucial in a democratic society, and we must therefore ensure that all activity to facilitate this is done in a lawful manner. Although paragraph 18(4) includes campaigning, fundraising, political surveys and case work as illustrative examples of political activities, it should not be taken to represent an exhaustive list.

Noble Lords will be aware that the Electoral Commission’s main areas of expertise concern the regulation of political funding and spending, and we are of the opinion that much, if not all the activities they regulate will be captured under the heading “political activity”. As I have just set out, fundraising is included as an illustrative example, which ought to provide some reassurance on this point. Moreover, the greater the number of activities denoted by the Electoral Commission, the less likely it is that any other activity would be considered by a court to be a political activity by dint of its omission. The commission, a body which as far as I am aware claims no expertise in data protection matters, would find itself in an endless spiral of denoting new activities as being permissible under the GDPR. Nevertheless, in recognition of the importance of such processing to the democratic process, the Government are continuing to consider the broader issues at stake and may well return to them in the second House. In this vein, the noble Lord made a number of good points, and I look forward to meeting him with the Minister for Digital, my right honourable friend Matt Hancock, on Thursday this week to discuss the matter in more detail than the parameters of this debate allow. We will see what the noble Lord feels about the timing of that after the meeting.

As for the noble Baroness, Lady Hamwee, we talked about having bigger meetings, and I am sure the time will come. This is just a preliminary meeting to decide on timings and to give the noble Lord, Lord Kennedy, the chance to discuss this with the Minister for Digital. I envisage that further meetings will include the noble Baroness.

I appreciate the sentiment behind the noble Lord’s amendment. In the light of our forthcoming discussions, I hope he feels able to withdraw it.

Lord Kennedy of Southwark (Labour)

I thank the Minister for his response. I tabled the amendment to keep the issue live and to illustrate the problem we have here. In his response, he talked about the responsibilities of the commission and data protection responsibilities and how they may conflict, belonging to different bodies. That begins to highlight the problem that we potentially have here. You could have different regulators trying to enforce different bits of legislation, all on the statute book at the same time and equally legitimate. We have got a real problem here.

I look forward to the meeting on Thursday. It is very important that we have a meeting after that, though, with a much wider group of people from different parties and campaigns. It is a genuine problem that affects every political party represented in this House and the other place and those that are not in either House. There is no advantage here—it is a question of getting a procedure in place that allows political parties to campaign and do their job properly and fairly. Equally, it protects the volunteers so that they understand what they can and cannot do so that they do not unintentionally get themselves in difficulty. I look forward to the meeting, but there are one or two things to sort out before then. I hope that it can get done by Thursday but, if it cannot, we have the other place. But it would be much better to sort it out at this end rather than the other end. I beg leave to withdraw the amendment.

Amendment 27 withdrawn.

Lord Brown of Eaton-under-Heywood (Judge)

My Lords, this pair of amendments, like the earlier group that I proposed, promoted by House officials, concerns another aspect of parliamentary privilege. Unlike the earlier group, these amendments have failed thus far to attract the support of the Bill team and government. Also unlike the earlier group, they relate only to this House, and not the House of Commons. But I shall have to address the issue at a marginally greater length than previously.

As will readily be apparent from the text of the two amendments, they propose that, with regard to a particular aspect of the processing of sensitive personal data, a Member of this House should be treated in the same way as a Member of the other House—or, for that matter, as Members of every other elected body in the country down to the smallest local authorities. There are really compelling reasons why in this context we should be treated on the same basis as elected representatives.

I begin with two acknowledgements. First, I readily concede that, unlike all the other representatives in public life, Members of this House are not elected. I put aside the Minister’s observation in Committee that he speaks as an elected Member,

“albeit with a fairly small electorate”.—[Official Report, 13/11/17; col. 1818.]

Secondly, I recognise that the Bill as drafted would essentially continue the position that has existed for the past 15 years, established under the Data Protection Act 1998 by secondary legislation in a ministerial order which followed in 2002.

The benefit of the particular provisions in Schedule 1 to the Bill which we are now seeking to amend by our proposed inclusion of Members of this House is that it would better enable elected representatives by dispensing in certain limited circumstances with the need for the express consent of the data subject to campaign on behalf of individuals.

Of course, Members of your Lordships’ House do not have constituency casework in quite the same way as Members of Parliament do. However, it surely cannot be doubted that many Members of this House—the noble Baroness, Lady Hamwee, whose name has been attached to this group, is obviously one such—do champion individual cases and causes on behalf of a variety of interest groups.

Since the ministerial order of 15 years ago, passed in the wake of the 1999 reform, by which we became a House largely of life Peers, an increasing number of the appointed Members have previously been elected representatives in one body or another, such as the House of Commons, devolved Parliaments and Assemblies, the European Parliament or local authorities. Doubtless, at least partially because of that background, they have been more inclined to pursue various causes.

Consistent with this, an increasing number of Members over the last 15 years have been undertaking activities in support of pressure groups and action groups, including the advancing of individual cases. The Government surely do not now want to inhibit these activities or to discourage or dissuade Members from pursuing these cases. I therefore urge the Government to reflect and, indeed, welcome this new reality and put Members of this House, in this strictly limited context, on the same footing as elected representatives so that they are not henceforth disadvantaged in the discharge of these duties.

Finally, unlike the earlier group of amendments concerning parliamentary privilege, this group relates exclusively to the work of your Lordships’ House. Although the Bill eventually goes from here to the House of Commons, that House will perhaps have little interest in this issue—so, par excellence, the question should be considered here. Even if the Minister will not give ground today—I recognise that he may be under clear instructions not to—I hope he will recognise that there is sufficient force and merit in these arguments to agree at least to have another look at this issue before Third Reading. In that case, I suspect that we will not be pushing it further at this stage.

Baroness Hamwee (Liberal Democrat)

My Lords, I have put my name to this amendment. I stumbled on the omission of Members of this House during debate in Committee, when I asked what I thought was an innocent question. I was asked to appear on the BBC’s “Question Time” after the list of Peers of which I was one was announced but before I actually arrived here. It was a fairly difficult occasion, which I remembered when I was thinking about this issue at lunchtime today. When I referred, during the discussion, to Members of Parliament, Nicholas Ridley said, “You are a Member of Parliament”. We are all Members of Parliament. We happen to be Members of the House of Lords; those who are normally called MPs are Members of the House of Commons. I regard myself as being in a representative position, even though I am not elected.

I disagree with one comment of the noble and learned Lord, which was about the amount of casework that I do. I am so conscious of the problems of getting it wrong, particularly in the area of immigration, that I try not to do that work. However, it is notable how the number of requests to Peers to intervene in individual cases has grown over the last few years. I suppose that reflects the fact that MPs are taking on more and more of what a few years ago one might have called social work. There are not the same demarcation lines as perhaps there used to be.

The casework, among other things, informs our general response to policy issues and specific proposals put before us, so we cannot exclude ourselves from all this. Ten days or so ago, in response to a request to pursue a particular case, I made the point that the individual should approach her own MP. The answer came back, through an intermediary, “She’s an asylum seeker. She doesn’t have an MP. We’re looking for anyone who can help”.

In Committee, questions on this issue were asked round the House. I recall that the noble Lord, Lord Lucas, took up the point after I had asked a question. I am very grateful to the noble and learned Lord for pursuing this matter. I hope that the Minister will accept his suggestion that this should be considered further between now and Third Reading, and that it should be dealt with at this end. I hope that the Minister will this evening assure us that it will remain on the agenda and that we can return to it at the next stage of the Bill in this House.

Lord Stevenson of Balmacara (Labour)

My Lords, we do not need to think very hard about this issue in terms of providing evidence that might be helpful to Ministers given that at Oral Questions today, at which I think the Minister and the noble Baroness were present, a case was raised by a Peer on our side of the House, in a Question to the DWP Minister, which verged on picking up a particular case. It was very useful in terms of making a broader political point. Are we saying that that will not be possible in future, as it raises significant questions? Secondly, as the noble Baroness, Lady Hamwee, said, irrespective of whether we have been an MP or a Member of the other House, we receive letters and emails almost daily offering individual data and information which, if we used it, would, I think, fall into the category mentioned by the noble and learned Lord.

At the weekend, I had the privilege of seeing the RSC perform the “Imperium” plays, adapted from the books of Robert Harris. These deal with a well-known orator, Cicero. Noble Lords will not be surprised to learn that he recommends to his clients—at one stage, he gives a tutorial to fellow citizens of Rome who intend to seek high office—that it is always helpful, and always catches the attention of an audience, if you give the specifics of an individual case and rise from that to the general. So if there is a possibility of placing a constraint on the ability of Members of this House to raise cases in an effort to improve the quality of life for citizens to whom we owe a duty of care and responsibility, that must be wrong. I hope that the Minister will take this away and work with the noble and learned Lord, Lord Brown, to bring something forward at Third Reading.

Baroness Chisholm of Owlpen (Conservative)

My Lords, Amendments 28 and 29 create a new processing condition for Members of this House. The Government’s view is that the provisions in paragraphs 19 and 21 of Schedule 1 are intended to reflect the unique and special nature of the relationship between an elected representative and their constituent.

Like the noble Baroness, Lady Hamwee, and the noble and learned Lord, Lord Brown, I am very aware of the important and valuable work that many noble Lords carry out on behalf of members of the public, advocating for their rights, taking up their cases with government departments and representing their interests in any number of scenarios. However, this relationship between a Peer and a member of the public is of a different nature and order from that conferred on an elected representative by their constituents. Elected representatives have particular rights and duties to act on behalf of the citizens they represent. The Government therefore consider it appropriate for them to be able to deal with urgent situations where they could not reasonably be expected to obtain consent; for example, in the case of an individual facing imminent deportation. There is no such need for Peers to be exempted from the provisions on consent. I stress again that nothing in the Bill or the GDPR prevents Peers undertaking casework if they first obtain the consent of the individual concerned.

I emphasise that these provisions are not new. The position under the 1998 Act is very similar and, in answer to the point made by the noble Lord, Lord Stevenson, it has not prevented Peers who are interested in undertaking casework doing so. Indeed, I have not found difficulty in this respect; I have just obtained consent first.

I hope I have reassured the noble and learned Lord that the Government understand the concerns raised, and that in this instance he will withdraw his amendment.

Lord Brown of Eaton-under-Heywood (Judge)

I confess to being disappointed by the Minister’s response to this. I dealt with the fact that things have changed over the 15 years since the 2002 order. Of course there will continue to be circumstances in which it is possible to get, without inhibiting problems, the express consent of the person concerned. However, it will not always be possible, and to that extent it will inhibit the future ability of Members to discharge a function they have been discharging. Of course I will not divide the House at this stage; nevertheless, I urge the Government to reread the arguments and submissions that the noble Baroness and I have advanced today and see whether they cannot bring themselves to recognise that there is a substantial point here. Although there is a natural reluctance to treat us as elected Members, they should for this limited purpose do so; that is justified in the narrow circumstances in which this point arises.

Baroness Hamwee (Liberal Democrat)

Before the noble and learned Lord finishes, if the House permits me, I will raise something with the Minister. A number of individual cases are brought to us through other organisations, which may have the consent of the individuals. We would want to pursue a matter in the way the noble Lord, Lord Stevenson, just mentioned—I was not at Question Time today but I can imagine the kind of situation. It would add considerably to the difficulty of doing that if the consent obtained by the organisation was thought not to extend to a Peer taking up the matter. I do not know how we would deal with that. It would be a considerable barrier to our doing what I regard as our job.

Lord Brown of Eaton-under-Heywood (Judge)

I am grateful to the noble Baroness, who puts forward a dimension to the problem that she is much more alive to than I am. However, there it is. I urge the Minister to reread these speeches and, in the meantime, I have no option but to beg leave to withdraw the amendment.

Amendment 28 withdrawn.

Amendment 29 not moved.