My Lords, I am grateful to the noble Lord, Lord Stevenson, for raising this important subject. I recall the questions that he posed at Second Reading about whether data subjects had sufficient support in relation to the power of companies that wanted to access, use and monetise their data, and I recognise the intention behind his amendment, which he carefully explained. I also agree wholeheartedly with him that these are questions worthy of debate, not only during the passage of this Bill, but over the coming months and years as the digital economy continues to develop. Later in Committee, we may discuss suitable forums where this could take place. These are big questions of data rights and how they are monetised, if they are, versus the growth of the digital economy for public benefit.
Through the evolution of the GDPR, we attempted to wrestle with these questions and to reach an appropriate balance between protecting the rights of data subjects and facilitating growth and innovation in the digital economy. Much of this Bill is about balance between rights and about where those rights should or should not be applied. The Government’s view is that, on the whole, the GDPR was ultimately successful in achieving that balance. In particular, I reassure the Committee that there are already mechanisms in the new regime which will support individuals better to understand what data controllers are doing with their data for commercial purposes. For example, data controllers will be required, when obtaining personal data from an individual, to inform that person of: the purposes for which their personal data is being processed; the period for which their data will be stored, to the extent that this is possible; their right, where applicable, to withdraw consent for their data to be used; and their right to lodge a complaint with the supervisory authority. That is not an exhaustive list but is illustrative of the protections that will be put in place. Such information must also be updated if the controller intends to process the personal data for any new purpose.
I take this opportunity to add that the current statutory guidance from the Information Commissioner in relation to direct marketing states that, even if consent is not explicitly withdrawn, it will become harder for organisations legally to rely on that consent as time passes. On that basis, I am confident that the substance of the protections that the noble Lord is seeking to achieve through his amendment is already provided for.
In terms of the form that these protections take, the Government are concerned about the burdens that the noble Lord’s approach would have on businesses, particularly small and micro-enterprises. Many of his remarks were addressed to the large companies that we all know about. This is particularly true in respect of the final part of the noble Lord’s amendment, which would require organisations to notify an individual of the gross revenues that they expected to receive through the commercial use of their data.
The Government have sought in this Bill to minimise burdens on business. The Bill enables processing to support scientific research, journalism and many other areas. Where appropriate, it preserves the conditions and exemptions of the Data Protection Act, allowing business processing to continue. We want to support businesses to implement the new law, though we are in no doubt that updating processes and systems is not a trivial task. We believe that Amendment 71A is a burden that business does not want, and the economic consequence of overregulation of this sort is high risk where knowledge and data-driven industries can move easily to a more favourable regulatory environment.
The Government’s view is that, through this Bill, we are already establishing mechanisms which will empower individuals to make informed decisions about the use of their data. These measures will ensure that when people give their consent to an organisation which is using their data for commercial purposes, they do so on the basis of a shared understanding that any consent thereby given can be withdrawn at any time if they no longer wish their data to be used for certain purposes or to be monetised in certain ways.
I accept the broader issues that the noble Lord has raised. I think they are worthy of debate but I hope that, given my explanations on the specific areas that his amendment addresses, he feels able to withdraw it.