Data Protection Bill [HL] - Commons Amendments

Part of the debate – in the House of Lords at 3:15 pm on 14th May 2018.

Alert me about debates like this

Photo of Lord Ashton of Hyde Lord Ashton of Hyde The Parliamentary Under-Secretary of State for Digital, Culture, Media and Sport 3:15 pm, 14th May 2018

My Lords, this group of Commons amendments relates primarily to the enforcement powers available to the Information Commissioner. This is one area where, after the Bill originally left your Lordships’ House, events have influenced the Government’s thinking.

The Information Commissioner’s investigation into Cambridge Analytica is unprecedented in both its scale and its complexity. It has, necessarily, pushed the boundaries of what the drafters of the Data Protection Act 1998, and the parliamentarians who scrutinised it, could envisage.

While recognising that the Bill already expands and enhances the commissioner’s ability to enforce the requirements of the data protection legislation in such circumstances, the Government undertook to consider whether further provision was desirable in light of the commissioner’s recent experience. Following extensive conversations with the commissioner and others, we concluded that such provision was indeed desirable. The amendments made in the other place would strengthen the commissioner’s ability to enforce the law while ensuring that she operates within a clear and accountable structure. I want to give five examples in particular.

First, Commons Amendment 64 would allow the commissioner to require any person who might have knowledge of suspected breaches of the data protection legislation to provide information. Previously, information could be sought only from a data controller or data processor. This could be important where, for example, a former employee had information about the organisation’s processing activities or if an organisation had gone into administration.

Secondly, Commons Amendment 70 would allow the commissioner to apply to the court for an order to force compliance where a person failed to comply with a requirement to provide information. Organisations that might previously have been tempted to pay a fine for non-compliance instead of handing over the information will now find themselves at risk of being in contempt of court if they do not comply.

Thirdly, Commons Amendments 67 and 87 would allow the commissioner to require controllers to comply with information or enforcement notices within 24 hours in some very urgent cases, rather than the seven days the current law provides for. Amendment 79 would allow the commissioner in certain circumstances to issue an assessment notice that can have immediate effect. The amendments would allow the commissioner to obtain information about a suspected breach or put a stop to high-risk processing activities promptly and effectively. They will also allow her to carry out no-notice inspections without a warrant in certain circumstances.

Fourthly, Commons Amendment 81 criminalises the behaviour of any person who seeks to frustrate an information or assessment notice by deliberately destroying, falsifying, blocking or concealing evidence which has been identified as being relevant to the commissioner’s investigation.

Finally, we have also taken this opportunity to modernise the commissioner’s powers. Storing files on an office PC is rapidly becoming a thing of the past. Commons Amendment 210 would enable the commissioner to apply for a warrant to access material which can be viewed via computers on the premises but which is actually held elsewhere, such as in the cloud.

When strengthening the commissioner’s enforcement powers, we have been mindful of the need to provide appropriate safeguards and remedies for those who find themselves under investigation. For example, where an information, assessment or enforcement notice containing an urgency statement has been served on a person, Commons Amendment 104 would allow the person to apply to the court to disapply that urgency statement: in effect, they have a right to apply to the court to vary the timetable for compliance with the order.

These amendments were developed in close liaison with the Information Commissioner. We are confident that they will give her the powers she needs to ensure that those who flout the law in our increasingly digital age are held to account for their actions. I beg to move.