My Lords, these regulations, which were laid before the House on 7 November 2023, will be made under the powers provided by the Retained EU Law (Revocation and Reform) Act 2023, known as the retained EU law Act. They are concerned with the definition of “fundamental rights and freedoms” in the data protection legislation and making sure we continue to have a meaningful definition beyond the end of the year, when the retained EU law Act takes effect.
In several areas, the data protection legislation—specifically the Data Protection Act 2018 and the UK general data protection regulation, which I will refer to as the UK GDPR from now on—requires the Government, the Information Commissioner and organisations using personal data to consider people’s “fundamental rights and freedoms” in certain situations. For example, Ministers must consider such rights and freedoms when creating new exemptions or permissions for the use of people’s special category data, and data controllers must consider them when relying on the “legitimate interests” lawful ground for processing under Article 6(1)(f) of the UK GDPR. It is vital that, in circumstances such as this, the rights of individuals continue to be carefully considered and protected.
Prior to EU exit, references to fundamental rights and freedoms in the data protection legislation were taken to mean rights described in the EU Charter of Fundamental Rights—which I will refer to as the charter. Following the European Union (Withdrawal) Act 2018, some of these rights were retained by Section 4 of that Act. Given that Section 4 of the European Union (Withdrawal) Act will be repealed at the end of 2023 by the retained EU law Act 2023, action is needed now via this statutory instrument to replace the definition of “fundamental rights and freedoms”.
Without action, there would be a lack of clarity about what these references mean. This could cause significant difficulties for organisations trying to apply the data protection legislation, risking inconsistent approaches, legal uncertainty and insufficient protection of data subjects’ rights.
That is why, through the draft regulations, the Government are clarifying that references to fundamental rights and freedoms in the data protection legislation mean rights under the European Convention on Human Rights, known as the ECHR, as defined by the Human Rights Act 1998. By doing this, the Government are ensuring that there is a clear, legally meaningful definition to rely on. This will provide consistency and certainty for organisations which are subject to data protection legislation, as well as continued protection for people’s rights. It is important to note that these regulations themselves do not remove any EU law rights; it is the European Union (Withdrawal) Act and the retained EU law Act that do that. These regulations are simply designed to replace references to EU law that would become meaningless at the end of this year.
I thank the Secondary Legislation Scrutiny Committee and European Statutory Instruments Committee for their views on these regulations. I have noted their concerns that rights protected by domestic law under the Human Rights Act might not provide the same level of protection as rights protected by EU law under the Charter of Fundamental Rights of the European Union. The matter of protection of people’s rights is of utmost importance, and I take this opportunity to reassure the Committee that the changes we are making via these regulations will not significantly affect the way the data protection framework works or indeed erode the protections it affords to people. Prior to EU exit, EU law rights protected by the charter included, for example, the right to respect for private and family life, the right to protection of personal data and the right to freedom of expression. The new definition will be based on rights protected by the ECHR, which includes the right to respect for private and family life and the right to freedom of expression.
The committee and others have raised a concern that the regulations remove reference to the specific right to data protection that was a feature of the charter. It is true that there is no such free-standing right under the ECHR. However, case law on this issue shows that data protection forms part of the protection offered by the right to respect for private and family life in Article 8 of the ECHR. It is further protected by our data protection legislation, which provides a comprehensive set of rules for organisations to follow and rights for people in relation to use of their data. The stand-alone right to protection of personal data was a feature of EU law and its removal is a result of EU exit legislation, including the retained EU law Act, rather than these regulations, which merely replace outdated terminology to recognise the new position.
I inform the Committee that we have formally consulted the Information Commissioner’s Office on the drafting of these regulations, and it recognises why the data protection legislation cannot continue to refer to rights that have been repealed. I hope that noble Lords will join me in supporting the draft regulations. I beg to move.