We need your support to keep TheyWorkForYou running and make sure people across the UK can continue to hold their elected representatives to account.Donate to our crowdfunder
I do not often get that response from Ministers, so that is very gratifying.
Also, a second version of these regulations was published at the end of last week—I think the Minister referred to it—which is specifically about privacy shields in the US. I am rather surprised that we will have two separate considerations: why could they not have been incorporated into this debate? As the ICO pointed out in a notice a while ago, US companies will need to update their privacy shield commitments to state that they apply to transfers of personal data from the UK. That is a big deal for many companies. It is another reason for what I said about the need for an impact assessment. If that does not happen, a lot of companies will be in serious difficulty.
Will the Minister tell us what advice the Government are giving businesses on using standard contractual clauses or binding corporate rules in the absence of an adequacy decision? The European Data Protection Board issued a notice about this last week, on
The Government in their wisdom—or, some of us think, lack of wisdom—decided not to incorporate the Charter of Fundamental Rights, and not even its Article 8 on data protection. Therefore, reliance for privacy safeguards has to be found in the European Convention on Human Rights. Again, this has been commented on in the last couple of months. The political declaration has a strange expression whereby the UK is committing itself only to respect a framework of the ECHR. This is starting to get a bit thin. When the Commission looks at an adequacy assessment, of course it always has the European Parliament breathing down its neck; the Parliament does not have a legal role but looks at this area rather closely. It seems that the Government are shooting themselves in the foot with regard to saying, “We have a very high standard of commitment to human rights, including privacy”, and that is before you get to the fact that the Government, or the Conservative Party, are refusing to rule out abolition of the Human Rights Act, which is still in place. We know that when an adequacy decision comes to be made, the scope of the assessment is wider than if we were a member of the EU, and it will bring in things like surveillance by the intelligence agencies—for instance, under the Investigatory Powers Act. As noble Lords will know, in the Strasbourg court the UK was found—I think last September—in breach of the ECHR privacy obligations in respect of the bulk collection of data. How do the Government intend to reassure the European Commission as well as other EU players that they are thoroughly fit for purpose when it comes to getting an adequacy decision, and are these issues delaying the Commission advancing on that question?