My Lords, I will say a little bit about my intention to delete this clause altogether. Clause 9 significantly changes the data and privacy landscape, and for the worse. The Constitution Committee’s report on the Bill, published on 25 January, noted:
“Clause 9 amends Article 12 of the UK GDPR to broaden the basis for refusal”—
not for enhancing, but for refusal—
“of a data access request by providing more leeway to ‘data controllers’”.
In the world we live in, there is a huge imbalance of power between corporations, governments, public bodies and individuals. People must have a right to know what information is held about them, and how and when it is used. It is vital in order to check abuses and hold powerful elites to account.
The request for information can, at the moment, be wholly or partly denied, depending on the circumstances. It can be refused if it is considered to be manifestly unfounded or manifestly excessive. These phrases, “manifestly unfounded” and “manifestly excessive”, are fairly well understood. There is already a lot of case law on that. Clause 9, however, lowers the threshold for refusing information from “manifestly unfounded or excessive” to “vexatious or excessive”.
5.30 pm
As has been pointed out, under the Bill, data controllers are required to carry out only those searches they think “reasonable and proportionate”. On 29 November, the Minister in the other place pointed out that data controllers can reject inquiries that they deem to be
“of low importance or of low relevance to the data subject”.—[Official Report, Commons, 29/11/23; col. 873.]
The Bill therefore effectively allows organisations to make assumptions about the reasons for requests and then refuse to act upon requests that
“are intended to cause distress”,
or
“are not made in good faith”.
That in itself is highly problematic. It means that there will be little or no transparency about the data controllers’ decisions. The unilateral decision of the controllers cannot easily be challenged, which is a further erosion of people’s right to know.
I have no doubt that, at some point, the Minister will refer to the private costs of meeting the SARs. I would welcome some data, if the Minister has any, on how many requests for information are received each year, how many are considered “manifestly unfounded or excessive” at the outset by the data controllers, how many are rejected, how many requests go to the Information Commissioner and are rejected, how many subsequently go to tribunal, and whether the initial decision to refuse the request is accepted or rejected. If he going to refer to any costs, I would also like to ask him some accounting questions about how the costs are computed. I hope he will be able to answer those, because I simply will not take his word that it actually has a cost. If those costs exist, who audited them and when? He has a lot of information to give on that.
In many ways, any focus on costs is primitive, because these private costs do not consider the social costs. There is a social cost associated with refusal. That social cost is highly evident from the case of the Post Office scandal. People regularly asked for information. In November 2015, for example, the Justice For Subpostmasters Alliance urged its members to submit subject access requests to find out what information the Post Office held about them. The information they received, even though only part of their request was met, helped to show that the Post Office knew about the flaws of the Horizon system. Clause 9 makes it easier for companies such as the Post Office to refuse
to provide such information to people, and to refuse even to tell them what data it holds. If Clause 9 becomes law, it will help to hide wrongdoings and corrupt practices.
If, in his response, the Minister is tempted to argue that the “vexatious” threshold of the Bill will somehow be aligned with the freedom of information regime, I would remind him that the FoI regime is much broader in scope, as it enables individuals to seek access to
“information held by public authorities or by persons providing services”.
Instead, this Bill empowers individuals to make requests only in relation to their personal data. The scope of these requests is therefore much narrower—the two cannot really be compared. Of course, numerous FoI requests by sub-postmasters were also refused or only partly answered. These included a request for six months’ correspondence between the business department and Paula Vennells. That was refused on the grounds of cost, even though a previous request for a longer period of correspondence had been fulfilled.
I come to the further link between FoI and this Bill. I personally experienced such selective obstruction by the Treasury when I requested some information about the forced closure of the Bank of Credit and Commerce International in July 1991. After some five and half years of obstruction and the legal process, three judges, in the 2011 case of Professor Prem Sikka v the Information Commissioner and the Commissioners of Her Majesty’s Treasury, ordered the Government to release a document codenamed the Sandstorm report to me. It showed that the Government were covering up fraud and money laundering on a gigantic scale. They used BCCI to fund al-Qaeda, which was created by the western powers, Saudi intelligence services, arms smugglers, criminals, murderers—all the lowlifes.
As a result, I have no idea what information the Government now hold about me. Under this clause, it would be so easy for someone to deny that information to me if I requested it. If people such as me cannot access personal data, it will be almost impossible for us to exercise our right to call for the erasure of that data. I cannot ask anyone to delete that data if someone refuses to give it to me. I urge the Minister to withdraw this clause, as it is an affront to human rights and public accountability.