My Lords, as a veteran of the 2018 arguments on Article 80(2), I rise in support of Amendment 287, which would see its implementation.
Understanding and exercising personal data rights is not straightforward. Even when the rights are being infringed, it is rare that an individual data subject has the time, knowledge or ability to make a complaint to the ICO. This is particularly true for vulnerable groups, including children and the elderly, disadvantaged groups and other groups of people, such as domestic abuse survivors or members of the LGBTQ community, who may have specific reasons for not identifying themselves in relation to a complaint. It is a principle in law that a right that cannot be activated is not fully given.
A data subject’s ability to claim protection is constrained by a range of factors, none of which relates to the validity of their complaint or the level of harm experienced. Rather, the vast majority are prevented from making a complaint by a lack of expertise, capacity, time and money; by the fact that they are not aware that they have data rights; or by the fact that they understand neither that their rights have been infringed nor how to make a complaint about them.
I have considerable experience of this. I remind the Committee that I am chair of the 5Rights Foundation, which has raised important and systemic issues of non-compliance with the AADC. It has done this primarily by raising concerns with the ICO, which has then undertaken around 40 investigations based on detailed submissions. However, because the information is not part of a formalised process, the ICO has no obligation to respond to the 5Rights Foundation team, the three-month time limit for complaints does not apply and, even though forensic work by the 5Rights Foundation identified the problem, its team is not consulted or updated on progress or the outcome—all of which would be possible had it submitted the information as a formal complaint. I remind the Committee that in these cases we are talking about complaints involving children.
4.30 pm
Article 80(2) has important implications for the ability of a small, highly specialised civil society organisation to take action. The challenge and resource intensity to manage appropriately a child and their
family or guardian through what is generally a long and drawn-out process is a major barrier to justice. Rightly, safeguarding and ensuring the privacy and well-being of a child is the paramount issue, but the issue raised is almost always relevant to all children, or a wide group of them—not just to a single child who has been forced into the position of poster child for a particular issue.
Giving a highly specialised civil society organisation the right to act on behalf of all children would provide a much simpler and more effective way to raise and resolve systemic risk, and this is obviously the case for other user groups. A formal relationship with the regulator would allow for better use of both the regulator and the NGO’s resources as the action and the learning would be transparent. The costs and evidentiary burden to show the nature of data protection infraction would lie with the complainant organisation, so there would still be a high bar of quality in the complaints process. Indeed, expert organisations are better placed to describe non-compliance, and it would prevent revictimising or overburdening a child if the law enabled expert groups to act on behalf of all children, or indeed any identified group being let down.
The noble Lord, Lord Clement-Jones, made an excellent case and, for the reasons given, I support his amendment.