My Lords, I rise to speak to Amendments 11, 12, 13, 14, 15, 16, 17 and 18 and to whether Clauses 5 and 7 should stand part of the Bill. In doing so, I thank the noble Lord, Lord Clement-Jones, and the noble Baronesses, Lady Jones and Lady Kidron, for their amendments. The amendments in the group, as we have heard, relate to Clauses 5 and 7, which make some important changes to Article 6 of the UK GDPR on the lawfulness of processing.
The first amendment in the group, Amendment 11, would create a new lawful ground, under Article 6(1) of UK GDPR, to enable the use of personal data published by public bodies with a person’s consent and to enable processing by public bodies for the benefit of the wider public. The Government do not believe it would be necessary to create additional lawful grounds for processing in these circumstances. The collection and publication of information on public databases, such as the list of company directors published by Companies House, should already be permitted by existing lawful grounds under either Article 6(1)(c), in the case of a legal requirement to publish information, or Article 6(1)(e) in the case of a power.
Personal data published by public bodies can already be processed by other non-public body controllers where their legitimate interests outweigh the rights and interests of data subjects. However, they must comply with their requirements in relation to that personal data, including requirements to process personal data fairly and transparently. I am grateful to the noble Lord, Lord Clement-Jones, for setting out where he thinks the gaps are, but I hope he will accept my reassurances that it should already be possible under the existing legislation and will agree to withdraw the amendment.
On Clause 5, the main objectives introduce a new lawful ground under Article 6(1) of the UK GDPR, known as “recognised legitimate interests”. It also introduces a new annexe to the UK GDPR, in Schedule 1 to the Bill, that sets out an exhaustive list of processing activities that may be undertaken by data controllers under this new lawful ground. If an activity appears on the list, processing may take place without a person’s consent and without balancing the controller’s interests against the rights and interests of the individual: the so-called legitimate interests balancing test.
The activities in the annexe are all of a public interest nature, for example, processing of data where necessary to prevent crime, safeguarding national security, protecting children, responding to emergencies or promoting democratic engagement. They also include situations where a public body requests a non-public body to share personal data with it to help deliver a public task sanctioned by law.
The clause was introduced as a result of stakeholders’ concerns raised in response to the public consultation Data: A New Direction in 2021. Some informed us that they were worried about the legal consequences of getting the balancing test in Article 6(1)(f) wrong.
Others said that undertaking the balancing test can lead to delays in some important processing activities taking place.
As noble Lords will be aware, many data controllers have important roles in supporting activities that have a public interest nature. It is vital that data is shared without delay where necessary in areas such as safeguarding, prevention of crime and responding to emergencies. Of course, controllers who share data while relying on this new lawful ground would still have to comply with wider requirements of data protection legislation where relevant, such as data protection principles which ensure that the data is used fairly, lawfully and transparently, and is collected and used for specific purposes.
In addition to creating a new lawful ground of recognised legitimate interests, Clause 5 also clarifies the types of processing activities that may be permitted under the existing legitimate interests lawful ground under Article 6(1)(f) of the UK GDPR. Even if a processing activity does not appear on the new list of recognised legitimate interests, data controllers may still have grounds for processing people’s data without consent if their interests in processing the data are not outweighed by the rights and freedoms that people have in relation to privacy. Clause 5(9) and (10) makes it clear this might be the case in relation to many common commercial activities, such as intragroup transfers.
4.15 pm
The first stand part notice in this group would remove Clause 5 from the Bill in its entirety. As I have explained, these provisions are important because they will encourage responsible and necessary data sharing under a new lawful ground of recognised legitimate interest and clarify the types of processing activities that may take place under the existing lawful ground of legitimate interest under Article 6(1)(f). Therefore, I hope the noble Lord will not press his opposition to this clause.
Amendments 12 to 14 concern the Secretary of State’s regulation-making power to add new processing activities to the list. Amendment 12 would remove this delegated power, with the intention, as I understand it, to implement a recommendation of the Delegated Powers and Regulatory Reform Committee. Amendment 13 would make sure that the Secretary of State has greater regard to the rights of children before making use of the regulations, and Amendment 14 would increase parliamentary scrutiny over any additions to the list by making the regulation-making power subject to the super-affirmative procedure.
The Bill already provides for additions to Schedule 1 to be subject to the affirmative resolution procedure, and we believe that this provides the right level of scrutiny, given the other safeguards the Secretary of State must consider before bringing regulations to Parliament. These include requirements for the Secretary of State to consider the impact of any changes to the rights and freedoms of individuals, to have regard to the specific need to provide for the special protection of children, and to consult the Information Commissioner and any other persons the Secretary of State considers appropriate on future changes to the list.
Introducing a higher degree of parliamentary scrutiny to that included in the Bill, or removing the power to add to the list of activities, could be detrimental in instances where there is a need for Ministers to add other urgent public interest activities to the list of recognised legitimate interests and could lead to unnecessary delays in the sharing of vital information.
On the point made about EU data adequacy, across all reforms in the Bill, the Government maintain an ongoing dialogue with the EU and have a positive, constructive relationship with it. We continue to engage regularly with the EU to ensure that our reforms are understood, and we believe that they are compatible with maintaining our data adequacy decisions. For all these reasons, I hope that noble Lords will agree not to press their amendments.