It is definitely not punishment, but it has taken me back, and I am on a steep learning curve here. I thank noble Lords for their interventions. I will try to do some justice to them. As was suggested, if I have not covered the topics adequately, given that the questions were incredibly detailed, I will respond in writing so that noble Lords will have the detail.
As I mentioned in my introductory remarks, it is important to note that these regulations themselves do not remove any EU law rights. Parliament has already agreed to do that in passing the European Union (Withdrawal) Act and the retained EU law Act. If we support these regulations today, instead of allowing references to EU law rights in the data protection legislation to lapse without replacement, we will instead
ensure that the relevant organisations continue to consider analogous rights under our domestic law where it is appropriate to do so.
The overall effect of the changes made by these regulations will neither undermine protections for individuals nor increase the regulatory burden for organisations. There could even be some benefits for organisations in the sense they will only need to consider how the rights of individuals are protected by rights recognised in domestic law rather than trying to comprehend how retained EU law protected those rights.
4.15 pm
I turn to some of the specific questions raised. The noble Lords, Lord Clement-Jones and Lord Bassam, suggested that the regulations could undermine protections. As noble Lords will know, the current definition of fundamental rights and freedoms refers to those rights retained in Section 4 of the European Union (Withdrawal) Act 2018. The EU Charter of Fundamental Rights was not retained under that section, although many of the rights found in the charter were retained because they existed in other EU law. There is no authoritative list of these rights, which means that deciding which rights are caught by this definition is a question of complex legal analysis. The ECHR, by contrast, contains a specific and defined list of rights, which are already familiar in the domestic context. We accept that there may be differences between the rights under EU law and the convention rights described and given further effect in the Human Rights Act, but where these differences are in areas relevant to data protection, we consider that there are analogous rights and protections, even if phrased differently.
The noble Lord, Lord Clement-Jones, also raised the issue of supremacy. The purpose of the REUL Act is to ensure that the UK has control over its laws. However, we acknowledge the importance of making sure that data processing provisions in wider legislation continue to be read consistently with the data protection principles in the UK GDPR. That is why Clause 49 of the DPDI Bill, which will be debated in due course, will make sure that any new data processing provisions continue to be subject to the data protection legislation, unless Parliament decides otherwise. Replication of the effect of UK GDPR supremacy is a significant decision, and we consider that the use of primary legislation is the more appropriate way to achieve these effects, such as under Clause 49 where the Government consider it appropriate.
The noble Lord, Lord Clement-Jones, also raised the retention of EU case law. Any further effect on the application of retained case law by domestic courts will be governed by Section 6 of the European Union (Withdrawal) Act 2018, as amended by Section 6 of the REUL Act once that section is commenced, rather than by this SI. It is not possible to state precisely, of course, how the courts will treat each individual piece of retained case law. However, it is unlikely that a court will depart from a decision simply on the basis that it refers to the right to the protection of personal data where the relevant interest is also protected by Article 8 of the ECHR.
The noble Lord also raised the issue of withdrawal from the ECHR. In these regulations, we are referring to rights recognised in UK law as it currently stands.
The changes we are making refer to rights currently given effect in UK domestic law under the Human Rights Act.
We note that the noble Lord’s concerns about vires were not shared by the Joint Committee on Statutory Instruments.
The noble Lord, Lord Bassam, asked if there were any adequacy concerns about these provisions. We do not believe that there are concerns about adequacy. These are technical changes, designed to ensure legal certainty and protect the coherence of the data protection framework following the commencement of the REUL Act. As we are seeking to provide for continuity as far as possible, we do not think that the measures in the regulations pose a material risk to the EU’s adequacy decisions. Indeed, if we did not have a definition of fundamental rights and freedoms, this could weaken rights protections, which could itself be an adequacy concern.