My Lords, the published groupings include Amendment 28CY, which should not have been tabled. I apologise to the House; it was a hangover from drafting before the Government tabled their amendments, which we have just dealt with, in response to the Delegated Powers and Regulatory Reform Committee. I will not be speaking to it and am sorry for the confusion. Similarly, Amendment 28CUA, published on the supplementary list, should not have been tabled—it was drafted a while ago but somebody panicked late on Friday afternoon and thought it had better be published.
9.15 pm
Amendment 25YYG and a number of other amendments in this group return us to the status of codes of practice. Some amendments are amendments to the Bill and some are amendments to government amendments. However, the short point is that we believe the codes are documents which should be complied with rather than documents to which regard is to be had, as “regard” seems to us insufficient. The operation of the Bill, when it is an Act, will be heavily reliant on the codes of practice.
In their reply to the DPRRC, the Government refer to handling information to the same standards as public authorities,
“including compliance with the codes of practice and the Data Protection Act”.
If the obligation is the lesser provision—that is, having regard to—it will be enough for an organisation to think about the codes of practice and then decide not to follow them. That is a little too casual for us. We consider that organisations should follow the codes, although we of course appreciate that they do not have the force of law—they are good practice. However, having regard to them, as stated in the Bill, seems to us at two removes from following them more precisely in the way that we would like to see.
As regards Amendments 28BC and three others, the Bill requires the codes of practice to be,
“consistent with the code of practice issued under section 52B (data-sharing code) of the Data Protection Act”.
We wondered whether there should not also be reference to Section 51 of the DPA, which relates to codes promoting good practice.
Digging around, as it were, on screen in preparation for today’s debate, I found the Information Commissioner’s
code of October 2016 on privacy, privacy notices, privacy information and privacy impact assessments. That code mentions when it is beneficial to go beyond legal requirements, and many matters to which reference has been made in the debate. The next little clutch of amendments, of which the first is Amendment 28BD, would require the codes to provide specifically for privacy impact assessments and privacy notices.
As regards Amendment 28BF and similar amendments, the Bill contains requirements to consult on the codes, including consultation with such other persons as the Minister thinks appropriate, which is a formula with which we will all be familiar. However, the named consultees might lead the reader to think that other persons would not extend beyond the arms of government, who are referred to specifically, apart from the ICO, which obviously is independent. There is a clear role for the third sector here and for the active, energetic and very knowledgeable organisations working in the privacy and human rights fields. We feel that to have some such reference as we are suggesting and not leave it to the normal sweeping-up provision would be appropriate and, we think, necessary. I beg to move.