My Lords, I support the amendment in the names of the noble Lords, Lord Clement-Jones and Lord McNally. I will speak also to Amendments 3 and 9 in this group. This is a wide-ranging, rather stretching group covering a
lot of detail, and I am sure the noble Baroness the Minister, who is making her first appearance on this Bill, will be able to cope with it with ease and will not have to resort to having meetings outside or anything; it will be a straight answer. I mean no disrespect to the noble Lord the Minister who spoke earlier.
Amendment 3 is a probing amendment. I make that absolutely clear, like the noble Lord, Lord Clement-Jones, did. It is about the rather disputed issue, as I understand it, of the status that many of the big tech companies that operate in the United Kingdom have in relation to the Act. Are they, as I think I have heard in other meetings, data controllers in the sense that the Bill sets out to achieve; in other words, are they responsible for all the elements that will be raised in the Bill and in the GDPR in relation to that issue? I am looking for a clear and straightforward answer on that, because it seems to me that there has been too much evasion and difficulty in pinning down some of the definitional points that this issue raises.
Having established that they are data controllers and that the material and data that they go through are subject to the Bill in its entirety—and, by implication, the GDPR—in which territory will this power exist? Obviously, that has relevance both pre and post Brexit. For instance, I asked the representatives of a large company who came in to brief us about their concerns about the Bill the very same question and received the answer that they regarded themselves as being European data controllers, which was a strange combination of thinking, and that they had selected, because it seemed appropriate at the time—again, I would be interested in having more information on that if it is available—that the Irish Information Commissioner would be responsible for any activities that were regulated under the Act and they would look to that body. Irrespective of whether or not that is true, and I suspect it is, that leads to a question about the role the Information Commissioner in the United Kingdom has in relation to companies which choose a European domicile and have a responsible information commissioner who is not in this country and therefore not subject to any regulatory or statutory provisions provided by this Parliament. There is no particular reason why this should be wrong. I am not in any sense making accusations that would arise from that, but it is important that we have on the record a very clear narrative on this point because it will raise a lot of questions if we do not.
Amendment 9 has already been referred to in the debate on Amendment 1, in relation to where the recitals that accompany the GDPR are going to end up. Reflecting on what was said by the Minister in that debate, I found that very helpful in answering the questions that Amendment 4A raised. Therefore, it poses another question about why the Government decided—well, they have no choice—to have an arrangement under which the GDPR comes into play, as required, on 25 May 2018. However, at that point the recitals will not be brought into effect. I understand that the recitals do not have statutory power in the GDPR, but it is quite clear, from reading around on this subject and hearing of cases already
raised in relation to data processing, that they are helpful to those who have side issues arising from the GDPR. The recitals help them to understand what the legislation actually means and, without them, there may well be a problem, at the least, in getting a consistency of approach across the EU. It is therefore important that we should know where the recitals are going to end up. If they are not being brought in, to what extent can they be relied on and, if so, by whom?