My Lords, I welcome the Minister to this crowded box-office occasion—over the years it has been for aficionados, by and large.
I thank her for setting out the purpose of these regulations. Originally, they were to be approved by the negative procedure. It is to the great credit of the Secondary Legislation Scrutiny Committee that, in its 53rd report, it recommended an upgrade of the instrument to the affirmative procedure because of concerns about a potential reduction in rights protection. I heard what the Minister said in her introduction.
In its report, the committee quoted the Department for Science, Innovation and Technology, which stated that
“the impact on organisations and individuals as a result of the proposed changes was expected ‘to be minimal’”,
and that the changes
“replicate the current position ‘as far as possible’, but it was unable to rule out entirely potential differences in the rights and freedoms”.
In those circumstances, I need to thank the Minister and the Government for bringing back these draft regulations for affirmative approval—in other words, for listening to the committee.
However, our conclusion is that the regulations fail to contain damaging uncertainty and inconsistency in this area, which is exactly what concerned the SLSC. I am afraid it will be clear from our debate next week on the Data Protection and Digital Information Bill, as it was when we recently debated the Digital Government (Disclosure of Information) (Identity Verification Services) Regulations 2023, that data is a really weak spot for this Government—as if they needed any more.
I am afraid that it is clear that these regulations by themselves are insufficient to stabilise the UK’s data protection frameworks once what has been called the tsunami of legal uncertainty unleashed by the retained EU law Act—REULA—engulfs us on 31 December 2023. The Minister lightly skipped over that. When the UK stopped being subject to the EU treaties at the end of 2020, the European Union (Withdrawal) Act 2018—EUWA—saved the rights and obligations which applied in domestic law as a result of the UK’s EU membership. This meant, in essence, that the EU GDPR became the UK GDPR. The Data Protection Act 2018 remained on the statute book. The rights and obligations became part of retained EU law—the vast body of law saved from the EU legal framework on the UK’s departure. Retained EU law was to be interpreted as it had been while the UK was an EU member state. This created continuity and certainty as to what the law meant.
The Court of Justice of the European Union—CJEU—case law from before the end of 2020 was also preserved in domestic law, as was domestic case law interpreting EU rights and obligations. The general principles of EU law, which include fundamental rights and the protection of personal data, were retained as an aid to the interpretation of our data protection frameworks. The principle of the supremacy of EU law was preserved. This meant that, in a conflict between the provisions in the UK GDPR and the DPA 2018, the UK GDPR took precedence. This was confirmed in the case of R (on the application of the Open Rights Group) v the Secretary of State for the Home
Department and the Secretary of State for Digital, Culture, Media and Sport. In this case, the retained principle of supremacy was relied on by the Court of Appeal to find that the overly broad exemption in the DPA 2018 from data subject rights in an immigration context was unlawful. Yesterday, the Court of Appeal ruled that the Government must amend the immigration exemption in Schedule 2 to the Data Protection Act because it is incompatible with Article 23 of the UK GDPR. This sort of argument will no longer be possible after the end of this month because the exemptions in Schedule 2 to the DPA will take precedence over the UK GDPR.
The EU Charter of Fundamental Rights was not saved into the domestic statute book. The Government’s view was that this made no substantive difference because the charter simply listed the rights found in EU law, so because the rights and obligations listed in the charter were being saved into domestic law through the European Union (Withdrawal) Act, no rights would be lost. Further, the EUWA clarified that retained case law which referred to rights in the charter should be read as referring to the underlying rights and obligations listed in the charter. This ensured that case law which referred to the charter would still be applicable.
Nothing in EUWA prevented Parliament legislating to change the UK GDPR and the DPA 2018. Indeed, the White Paper on the EUWA stated that, after the UK’s exit from the EU:
“It will then be for democratically elected representatives in the UK to decide on any changes to that law, after full scrutiny and proper debate”.
As we will be discussing next Tuesday at its Second Reading, the UK’s data protection frameworks are being changed through the vehicle of the Data Protection and Digital Information Bill. As I have indicated to the Minister, the noble Viscount, Lord Camrose, these Benches do not welcome those changes and regard them as dilutions of data subject rights.
However, there are also fundamental changes to the UK’s statute book being made at the end of this year through the REULA, which will sweep away the retained EU general principles, including fundamental rights and the requirement to interpret retained EU law in accordance with those principles. Further, the principle of the supremacy of EU law is being deleted. The default position is that domestic law whenever enacted will trump the law which came from the EU.
Changes introduced by REULA are bound to create legal uncertainty. In terms of the UK GDPR and the DPA 2018, EU fundamental rights are the underpinning foundation of the law. If they are simply deleted—the default position under REULA—the UK GDPR and the Data Protection Act 2018 will become more difficult to interpret. This is, of course, why the regulations have been introduced. They are intended to ensure that, as the Minister said, references to fundamental rights and freedoms in the UK GDPR and the DPA 2018 are read as references to fundamental rights and freedoms as set out in the European Convention on Human Rights as implemented through the Human Rights Act 1998.
On one level, this makes sense. Article 8 of the EU’s Charter of Fundamental Rights—the right to the protection of personal data—is based on Article 8 of
the ECHR on the right to private and family life, but it is not certain that the rights under Article 8 of the ECHR provide exactly the same protections as the right to data protection in the EU legal order. First, this is because the ECHR has no specific fundamental right to the protection of personal data. In the case of R (Davis & Watson) v Secretary of State for the Home Department, the High Court held that Article 8 of the charter goes further and is more specific than Article 8 of the ECHR. Secondly, the charter contains general provisions explaining how the relevant rights should be interpreted, and Article 52 of the charter confirms that, when rights in the charter correspond to the rights in the ECHR, the meaning and scope of those rights should be the same as in the ECHR, although the EU is not prevented from providing more extensive protections. Whether EU fundamental rights provided more extensive protection than those under the ECHR will be tested in the courts over the coming years, but there is likely to be uncertainty in relation to this point from the end of this year.
4 pm
Another area of significant uncertainty will be how, if and to what extent CJEU case law still applies when interpreting the UK GDPR and the DPA 2018. Much of the CJEU case law on data protection references EU fundamental rights, as set out in the charter. If EU fundamental rights have been deleted, it is not clear that the case law still applies. Again, we will have to wait for cases to reach the courts to understand whether and to what extent the case law is still applicable. The Explanatory Memorandum and Explanatory Note make no attempt to answer whether the Government consider that they do, other than stating that
“no, or no significant, impact”
is foreseen by the implementation of the regulations.
Given what I have said so far, this looks a rather complacent and even misleading statement, especially when Sir John Whittingdale in the Commons said of these regulations that
“they simply tidy up the existing statute book as a result of the UK’s withdrawal from the European Union”.—[Official Report, Commons, Second Delegated Legislation Committee, 4/12/23; col. 8.]
In fact, looking closely at the wording of the Explanatory Memorandum, we see that there is no unequivocal statement to the effect that there is “no, or no significant, impact” on individual human rights as such. I think that the Minister, when she introduced those regulations, actually used those words—that there is no significant impact on human rights as such—but I hope that she will reassure us by repeating those and that she anticipates that there will be no significant impact.
The deletion of supremacy also turns the relationship between the UK GDPR and the DPA 2018 on its head. If there is a conflict between the UK GDPR and the DPA 2018, the DPA 2018 will take precedence. That is the opposite of the intention of the legislation when it was drafted and may have unforeseen consequences. There is a limited exception to the general rule that REULA introduces, that domestic law will trump retained direct EU legislation. This exception operates in the context of data protection rights. Data subject rights under the UK GDPR will generally take precedence over rights or obligations in other domestic law. However,
the rights and obligations in chapter 3 of the UK GDPR, relating to the rights of the data subject, are subject to the exceptions in Schedule 2 to the DPA 2018.
It appears that there is no scope under REULA to disapply the Schedule 2 exceptions on the basis that they are overly broad, as happened in the Open Rights Group case; instead, the courts would need to make an incompatibility order under Section 8 of REULA, which may delay, explain, remove or constrain the consequence of the Schedule 2 condition trumping data subject rights, but this is a less certain remedy than would have existed before. Under EUWA or when EU law still applied, it would have been clear that the UK GDPR had precedence and that overly broad exceptions in Schedule 2 to the DPA 2018 were unlawful. In practice, this means that data subject rights in the UK will be less certain and potentially less protected than before.
The significant uncertainty caused by the changes that REULA makes to the statute book could have been remedied by the Government using powers in REULA. The powers in Section 11 of REULA could have been used to turn the effect of EU fundamental rights and supremacy back on. Alternatively, the current relationship between the UK GDPR and the DPA 2018 could have been restored by using the power in Section 7. For instance, the Government could have clarified that established case law still applies, but they have chosen not to do so. The regulations seek only to cure the problem of deleting EU fundamental rights by replacing those references to fundamental rights under the ECHR, using the powers in Section 14, but this creates new uncertainties as outlined above.
I think noble Lords would agree that all this potentially makes the head spin, but I have not even got to the point where we might need to talk about the consequences if the UK withdraws from the ECHR or repeals the Human Rights Act, as so many Conservative MPs seem to want to do. Lowering the standard of data protection rights in the UK creates obvious risks to the continuing UK data adequacy decision, which rests on data protection rights being essentially equivalent to those rights in the EU. If the Conservative Party campaigns to leave the ECHR or repeal the Human Rights Act at the next election, then this will simply magnify the uncertainties. The substitution that the regulations make of ECHR human rights for EU fundamental rights may be short-lived. Lowering the standard of protection of personal data in the UK also risks failure in delivering the trusted data regime, which purports to be one of the underpinning foundations of the UK’s ambition to become a technology superpower by 2030.
There are clearly major questions to answer, which the Explanatory Memorandum and the Minister’s introduction come nowhere near answering. Perhaps she will now make a bit of a stab at this—although I would be perfectly happy for her to write with a response. We should be very grateful to Eleonor Duhs for her SOAS ICOP policy briefing and to Professor David Erdos for raising these issues in the first place.
In addition to all the foregoing, Professor Erdos also raises the question of ultra vires. I hesitate to raise this at this stage, having said quite a lot already, but he raises the fundamental issue concerning what appears
to be a problem with the draft regulations’ legal basis— I expect that the Minister has been briefed on this. This is stated to be issues relating to Section 14 of the Retained EU Law (Revocation and Reform) Act 2023.
There is a case to answer, in a number of respects. I hope the Minister can give us some assurance on all of these issues, and I certainly hope that the chickens do not come home to roost.