My Lords, these amendments have been spoken to so well that I do not need to spend a huge amount of time repeating those great arguments. Both Amendment 195A, put forward by the noble Baroness, Lady Bennett, and Amendment 218 have considerable merit. I do not think that they conflict; they are complementary, in many respects.
Awareness raising is important to this, especially in relation to Amendment 218. For instance, if regulators are going to have a growth duty, which looks like it is going to happen, why not have countervailing duties relating to climate change, as the noble Baroness,
Lady Young, put forward so cogently as part of Amendment 218? Amendment 195A also has considerable merit in raising awareness in the private sector, in traders and so on. Both have considerable merit.
6.45 pm
However, this is about data adequacy. We have come to the point—it is an interesting point in our discussions because we have been leading up to this—where we have mentioned data adequacy a number of times. We have said to the Government, “You’re watering down these data subject rights”, and they have said, “Oh no we aren’t”. We have gone back and forth for the past four days in Committee. This debate is really the culmination of our discussions about the risk, if you add everything together.
Data adequacy is crucial to data flows from the EU to the UK. The noble Lords, Lord Vaux and Lord Bassam, put the case forward absolutely. It is a big issue for business; it has been raised with all of us so many times in relation to this Bill. The free flow of data from the UK to the EU is also crucial—it is not just one-way traffic. It is the first question that business raises about this Bill. Of course, we all remember vividly the enormous uncertainty created when the CJEU invalidated the US’s adequacy decisions, most recently in the case of Schrems II in July 2020. Nobody wants to go back to that, so losing adequacy is a significant worry.
One has to look at the test that the European Commission applies when it does an adequacy assessment. It includes
“the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law … the existence and effective functioning of one or more independent supervisory authorities in the third country … and … the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data”.
So, there are quite a number of points of vulnerability here. The UK is at a disadvantage here, in fact. If its data protection law were completely different from that of the EU, it would be much more difficult to weigh up whether it was, in essence, equivalent. Where the UK is clearly dropping its standards, it is easy to distinguish that the UK does not have an essentially equivalent standard of protection.
If you look closely at the elements that make up the finding of essential equivalence for the UK, you will see that some of them have already been removed or run the risk of being removed; others will go through the operation of the Bill. I am not going into great detail but the noble Lord, Lord Bassam, talked about chipping away. We are not talking about little ice-picks: we are talking about sledgehammers being taken to some of those data subject rights, including lowering the standard of protection for data subjects; the deletion of the concept of EU fundamental rights with the potential loss of CJEU case law, which interprets data protection law; and eroding the ICO’s independence. The impact of the proposed UK rules on automated decision-making is one area where the UK is clearly
dropping its standards. We have also talked today about having the ability to lower protections using secondary legislation.
The noble Lord, Lord Vaux, talked about the ruminations that are taking place in Brussels—and not just in the Parliament. On 8 February 2023, the European Commissioner for Justice, Didier Reynders, answered a question in an interesting way. He said:
“In the context of that obligation”—
on data adequacy—
“the Commission has been in regular contact with representatives of the UK government since the early stages of the UK’s reform of its data protection legislation. These contacts have been helpful for a better understanding of the content and scope of the amendments proposed in the Data Protection and Digital Information Bill. While a number of those amendments are aimed at clarifying the existing framework, some specific proposals would—if adopted—raise questions with respect to the level of protection. This is, for example, the case for the amendments that would affect the independence of the UK’s data protection authority, the Information Commissioner, as well as for the proposal to give to the Secretary of State the power to recognise in the future certain interests of the data controller as a legal basis for processing (so-called ‘legitimate interests’) without any limitation and without the need for a balancing against the rights and interests of the individual. The Commission has repeatedly raised these concerns with the UK government and will continue to closely monitor how the Bill evolves in the parliamentary process.”
So no pressure.
Adding that to what the noble Lord, Lord Vaux, talked about when he mentioned the chairman of the European Parliament’s Civil Liberties, Justice and Home Affairs Committee, the Government should not think that they can simply water down data subject rights and ramp up the Secretary of State’s rights without it being noticed across the water and without consequences. That is why they need to think carefully about this Bill and accept the amendment in the name of the noble Baroness, Lady Jones, which is the least we can do, quite apart from scrapping the Bill.