My Lords, I rise to speak to Amendments 13 and 15. Before I do, let me say that I strongly support the comments of the noble Lord, Lord Clement-Jones, about HIV and the related vulnerability, and his assertion—almost—that Clause 5 is a solution in search of a problem. “Legitimate interest” is a flexible concept and I am somewhat bewildered as to why the Government are seeking to create change where none is needed. In this context, it follows that, were the noble Lord successful in his argument that Clause 5 should not stand part, Amendments 13 and 15 would be unnecessary.
On the first day in Committee, we debated a smaller group of amendments that sought to establish the principle that nothing in the Bill should lessen the privacy protections of children. In his response, the Minister said:
“if over the course of our deliberations the Committee identifies areas of the Bill where that is not the case, we will absolutely be open to listening on that, but let me state this clearly: the intent is to at least maintain, if not enhance, the safety and privacy of children and their data”.—[Official Report, 20/3/24; col. GC 75.]
I am glad the Minister is open to listening and that the Government’s intention is to protect children, but, as discussed previously, widening the definition of “research” in Clause 3 and watering down purpose limitation protections in Clause 6 negatively impacts children’s data rights. Again, in Clause 5, lowering the protections for all data subjects has consequences for children.
4 pm
In Clause 5, proposed new paragraph (6) of Article 6 gives the Secretary of State power to amend the circumstances under which data processing is deemed legitimate in the public interest. Amendment 13 simply requires the Secretary of State to ensure that the Bill does not “reduce, minimise or undermine” existing standards and protections for children’s data when exercising these powers. Similarly, proposed new paragraph (9) gives examples of the types of processing that may be necessary for the purpose of a generalised—as opposed to a public interest—legitimate interest, including, in new paragraph (9)(a),
“processing that is necessary for the purposes of direct marketing”.
Amendment 15 limits direct marketing in paragraph (9)(a) to adults.
I struggle to understand why the Government believe it is appropriate to enable companies to market directly to anyone without their express consent. The requirement to opt in to marketing has served consumers well and, arguably, online users need more protection, rather than less, from intrusive marketing practices. But it seems a retrograde step that, if an individual, irrespective of age, expressly states they do not wish to receive direct marketing, a company could rely on paragraph (9)(a) to override those wishes. For children, not only is this intrusive and aggressive but it conflicts with their rights and protections, as set out in Article 6(1)(f) of the UK GDPR and codified in the age-appropriate design code.
Once again, I am finding it hard to marry the Government’s assurance—given privately, from the Dispatch Box in the other place, and by the noble Viscount the Minister—that the Government remain fully committed to the high standards of protection they set out for children with the proposal routinely to expose them to direct marketing. The changes in UK data law proposed by Clause 5, and numerous others scattered throughout the Bill, expose the reality that the Bill is intended to reduce privacy for UK citizens and, as a knock-on, the privacy and safety protection of children. The Government have a choice: to let the House decide whether children deserve a lesser standard of protection, or to amend the Bill to maintain the current standards.