If the noble Baroness will be patient, I will get on to Clauses 16 and 17 in just a second.
Going back to Clause 15, this will permit, but not mandate, authorities to disclose information to each other. It simply ensures that there is a legislative basis in place to enable information to be shared between all authorities exercising functions under Chapter 1 of Part 2 of the Bill. The clause also ensures that any disclosures must only be made in compliance with data protection legislation and cannot be made if certain prohibitions on disclosure set out in the Investigatory Powers Act 2016 apply.
Clause 16 provides a power for a local policing body—a PCC or equivalent—to request information from a specified authority, educational authority, prison or youth custody authority for the purposes of enabling or assisting the local policing body to exercise its role to assist duty holders and monitor its functions to prevent and reduce serious violence. While Clause 16 places a statutory requirement on the specified authority, education authority, prison or youth custody authority to comply with such a request, a disclosure is not required if it would contravene data protection legislation or prohibitions in specified parts of the IPA 2016. The provision does not place any mandatory requirements directly on individual professionals to disclose information they hold under the duty, be that confidential information or otherwise.
There are also a number of safeguards in relation to the information that can be required. As proposed by government Amendment 20, local policing bodies must
request only information already held by that authority. Requests must be related to the organisation or function to whom the request is made, except when functions are contracted out. Additionally, the information supplied under Clause 16 must be used by only the local policing body that receives it to enable or assist that body to assist the relevant authorities or monitor the activity it undertakes under the duty. The information received is not therefore to be used or disclosed onwards to any other bodies for other purposes, such as law enforcement.
It is against that backdrop that we need to consider the provisions in each of Clauses 9, 15 and 16 which Amendments 11, 22 and 30 seek to strike out. These provisions state that, in determining whether a disclosure would contravene the data protection legislation,
“the power conferred by this section is to be taken into account”.
This allows the power or duty to disclose to be taken into account when determining the impact of the data protection legislation. This is to preserve the effect of the data protection legislation, dealing with the logical difficulties that can arise where an information-sharing gateway, such as that proposed by these provisions, prevents disclosure in breach of the data protection legislation, but the data protection legislation allows a disclosure which is required or permitted by the enactment. This is to ensure that these provisions can be taken into account when authorities are determining the legal basis for processing data under Article 6 of the UK GDPR.
This Bill is by no means unique in including this drafting. The provisions have been used for a number of other information-sharing clauses, including most recently the Environment Act 2021 and the Forensic Science Regulator Act 2021. I know that I am not allowed props in your Lordships’ House, but if I hold up the list to myself, there are a huge number of Bills to which this pertains. This is a standard provision. I also reiterate that both Clause 15 and regulations made under Clause 9 provide for permissive gateways, meaning that they do not impose any obligation to share information. That is a crucial point.
On Amendment 25, I totally agree that any decision to disclose an individual’s personal data should not be taken lightly. The rationale for not excluding all personal data sharing under the duty is clear. Private and confidential health data has a unique status and needs special protection or trust between patients and doctors. That could be undermined, with individuals actually going as far as to avoid treatment for fear of their data being shared. However, in order for the duty to be effective, we really must still support sharing of case-specific information on individuals at risk to both safeguard them and support vital interventions; I know that the noble Baroness, Lady Meacher, agrees with that point. Decisions about whether disclosures of personal data can lawfully be made under these provisions would always need to be made on a case-by-case basis, and always in line with data protection legislation.
As I said in previous debates, we are not seeking to replace existing data-sharing agreements or protocols, including those under the Crime and Disorder Act 1998. All authorities subject to the duty should have clear processes and principles in place for sharing information and data. Any and all exchanges of data and information
under Clauses 15 and 16 or regulations made under Clause 9 must not contravene existing data protection legislation or provisions of the IPA 2016.
I turn to the amendments tabled by the noble Lord, Lord Paddick. Amendment 18 seeks to ensure that relevant authorities are obliged to comply with the serious violence duty only to the extent that it does not conflict with its other statutory duties. We do not support this amendment, as it is essential that all relevant authorities are legally required to collaborate with the specified authorities or with other education, prison or youth custody authorities in their work to prevent and reduce serious violence when requested to do so, and to carry out any actions placed on them in the strategy. There are already sufficient safeguards in place, including considering whether the request is deemed to be disproportionate to the local serious violence threat level, whether it would be incompatible with an existing statutory duty or, indeed, whether it would have an adverse effect on the exercise of the authority’s functions, or would mean that the authority incurred unreasonable cost. In determining whether any of those conditions apply, the cumulative effect of complying with duties under Clause 14 must be taken into account.
We think that this approach strikes the right balance in ensuring that institutions which are affected by serious violence, or may have a valuable contribution to make to local partnership efforts, will be drawn into the work of the local partnership without placing unnecessary burdens on those which may not. This approach is also consistent with the structures and processes in place for existing safeguarding legislation and would allow for an effective and targeted approach within both the education and prison sectors.
Amendments 24, 32 and 33 require that any information disclosed under Clauses 15 or 16 or under regulations made under Clause 9 must comply with any duty of confidence owed by the person making the disclosure, where disclosure would amount to a breach of that duty, the Human Rights Act 1998, the Equality Act 2010, the data protection legislation, the Investigatory Powers Act 2016, and any other restriction on the disclosure of information, however imposed. In addition, Amendment 33 also specifies that no regulations may be published under Clause 9(2) prior to the Secretary of State publishing an equality impact assessment, a data protection impact assessment and a description of any guidance or codes of practice.
9.30 pm
We think that the amendments are not needed, as public authorities are already required to act in compatibility with ECHR convention rights by virtue of Section 6 of the Human Rights Act 1998 and, similarly, the relevant duties in the Equality Act 2010 such as the public sector equality duty already apply. Clauses 9, 15 and 16 also already ensure that data can be disclosed only in compliance with data protection legislation, which requires a case-by-case consideration of the necessity and proportionality of disclosure, and where disclosure is not prohibited by certain provisions in the IPA. Obligations of confidence and other restrictions on disclosure are not breached—