We need your support to keep TheyWorkForYou running and make sure people across the UK can continue to hold their elected representatives to account.

Donate to our crowdfunder

Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 - Motion to Approve

Part of the debate – in the House of Lords at 4:30 pm on 18th February 2019.

Alert me about debates like this

Photo of Baroness Ludford Baroness Ludford Liberal Democrat Lords Spokesperson (Exiting the European Union) 4:30 pm, 18th February 2019

I do not often get that response from Ministers, so that is very gratifying.

Also, a second version of these regulations was published at the end of last week—I think the Minister referred to it—which is specifically about privacy shields in the US. I am rather surprised that we will have two separate considerations: why could they not have been incorporated into this debate? As the ICO pointed out in a notice a while ago, US companies will need to update their privacy shield commitments to state that they apply to transfers of personal data from the UK. That is a big deal for many companies. It is another reason for what I said about the need for an impact assessment. If that does not happen, a lot of companies will be in serious difficulty.

Will the Minister tell us what advice the Government are giving businesses on using standard contractual clauses or binding corporate rules in the absence of an adequacy decision? The European Data Protection Board issued a notice about this last week, on 12 February. Are the Government going to advise businesses, large and small, exactly how this will work? Lastly, what progress is being made on an adequacy decision? The Minister will know from discussions during the passage of the EU withdrawal Act and the Data Protection Act that many of us are worried about this issue. Last summer, the Government expressed their aspiration for a legally binding agreement that would be more than a unilateral adequacy decision and which would enable the ICO to have a seat on the European Data Protection Board. Essentially, it would be Brexit in name only and would retain all the benefits of being in the EU with regard to data protection structures. That aspiration is not recognised in the political declaration, which talks only about an adequacy decision, so the UK has been knocked back in that area. Perhaps the Minister could tell us precisely where we are. What signal is he getting from the Commission on an adequacy decision? Are we talking months or years?

The Government in their wisdom—or, some of us think, lack of wisdom—decided not to incorporate the Charter of Fundamental Rights, and not even its Article 8 on data protection. Therefore, reliance for privacy safeguards has to be found in the European Convention on Human Rights. Again, this has been commented on in the last couple of months. The political declaration has a strange expression whereby the UK is committing itself only to respect a framework of the ECHR. This is starting to get a bit thin. When the Commission looks at an adequacy assessment, of course it always has the European Parliament breathing down its neck; the Parliament does not have a legal role but looks at this area rather closely. It seems that the Government are shooting themselves in the foot with regard to saying, “We have a very high standard of commitment to human rights, including privacy”, and that is before you get to the fact that the Government, or the Conservative Party, are refusing to rule out abolition of the Human Rights Act, which is still in place. We know that when an adequacy decision comes to be made, the scope of the assessment is wider than if we were a member of the EU, and it will bring in things like surveillance by the intelligence agencies—for instance, under the Investigatory Powers Act. As noble Lords will know, in the Strasbourg court the UK was found—I think last September—in breach of the ECHR privacy obligations in respect of the bulk collection of data. How do the Government intend to reassure the European Commission as well as other EU players that they are thoroughly fit for purpose when it comes to getting an adequacy decision, and are these issues delaying the Commission advancing on that question?