My Lords, I beg to move Amendment 43 in my name and that of my noble friend Lady Hamwee, and to speak to other amendments in this group. Amendment 43 seeks to remove paragraph 4 of Schedule 2 to the Data Protection Act in relation to EEA and Swiss nationals, and there is a reason why it is drafted only in relation to EAA and Swiss nationals.
These Benches and others have consistently opposed the suppression of data protection rights of migrants and free movers, which paragraph 4 of Schedule 2 imposes. My noble friend Lady Hamwee made a very powerful speech when moving an amendment on Report of the Data Protection Bill to remove said paragraph, which she said was “very far-reaching indeed” and even
“gives scope for quite considerable fishing expeditions.”—[
One of the safeguards lacking from the Data Protection Act is the protection of Article 8, on data processing, of the EU Charter of Fundamental Rights. Because the Government refused to include the charter as retained EU law on exit, all we have is the European Convention on Human Rights, and once again there are rumblings about the ECHR. Yesterday, the headline in the Sunday Telegraph—I had to go out and buy it, which was rather galling, because it is behind a paywall—was:
“Boris Johnson set to opt out of human rights laws” and that meant the convention. Here we go again. The Sunday Telegraph reported that Mr Dominic Cummings, no less, has previously attacked the European Court of Human Rights, and
“has warned that voters would expect the jurisdiction of European judges to end in the UK as part of the Brexit process”— those pesky European judges. At least the newspaper had the grace to add that the ECHR and court were not part of the EU system, but there is that attempt to cross over and interlink the whole time. There is a connection between the UK’s adherence to the European Convention on Human Rights and the Brexit process, in the sense that the Government are resisting giving the EU a formal undertaking to adhere to the convention. The Justice Secretary told a radio programme this weekend:
“The idea that we’re going to leave the convention is for the birds.”
The trouble is, one might have thought the same about the idea that the Government might renounce part of the withdrawal agreement—until they did, in the Bill being debated in the other place this afternoon. Indeed, in April 2016, the then Home Secretary, Theresa May, said:
“The case for remaining a signatory of the European Convention on Human Rights, which means Britain is subject to the European court, is not clear.”
She said the case was not clear and she, of course, was subsequently Prime Minister.
The deputy counsel to the Joint Committee on Human Rights advised that implementing the GDPR—the general data protection regulation, the EU’s data protection law—would arguably not be enough on its own to ensure a data adequacy finding for the UK if the Data Protection Bill fell short of standards required by Article 8 of the charter. You can double this if our membership of the European Convention on Human Rights is also at risk. The knock-on effect if the UK fails to get a data adequacy decision will mean that the prospects for law enforcement co-operation with the EU, or business transfers of data to EU and EEA countries, will be dim indeed. This point was made repeatedly in proceedings on the Data Protection Bill and, indeed, on various Brexit Bills in this House. The weakness of human rights safeguards makes the loss of data protection rights for migrants even more significant.
Paragraph 4 of Schedule 2 to the Data Protection Act 2018 is unnecessary and disproportionate. Other provisions in Schedule 2 allow exemption from data protection rights in relation to criminal immigration offences, so that point would anyway be covered. The Equality and Human Rights Commission said that the exemption from data protection rights for migrants could
“permit the authorities to access and process highly personalised data, for example, phone or social media relating to sexual lives of immigrants claiming residency rights on the basis of their relationship with a British citizen.”
The data-sharing agreements that the Home Office has with other departments, plus the ability of private persons—such as landlords, employers, bank staff and so on, which was discussed in the last group—to access data mean that the scope of the immigration exemption from data protection rights is very wide indeed, with a commensurate breadth of potential harm to individuals. Strangely, the Government amended the Data Protection Bill to allow a person to rectify data held on them, but since they cannot access that data in the first place, it is unclear how they can know if it is accurate or inaccurate in order to rectify it.
Amendment 74, in my name and that of my noble friend Lady Hamwee, gives the Minister the opportunity to put on record “something that I understand”, as she said in a Peers’ briefing session during recess which sadly I was unable to attend. She said that the code given to a landlord or employer to check immigration status would not allow them to check, for instance, health information, or to use the information they obtained for any other purpose. I hope that the Minister will therefore be able to accept this amendment, which encapsulates something that she has told Peers.
Amendment 72, in the name of the noble Baroness, Lady Bennett, seeks to limit the use for immigration purposes of data gathered by certain public service bodies in healthcare and education, and where the person has reported a crime or being a victim or witness to a crime. The amendment is helpful in at least limiting the harmful impact of Paragraph 4 of Schedule 2 to the Data Protection Act, but that paragraph in fact needs wholesale deletion. I beg to move.