My Lords, I am grateful to the noble Lords, Lord Clement-Jones and Lord McNally, for the opportunity to explain the meaning of data processing. As the noble Lord, Lord Clement-Jones, has explained, Amendment 2 would import words in relation to this term from Section 1(2) of the Data Protection Act. It might be helpful if I explain that the definition in Clause 2(4) of the Bill is taken directly from article 4(2) of the GDPR. Importantly—the noble Lord, Lord Clement-Jones, was right to mention this—the extent to which we can redefine or reinterpret it is therefore limited.
Having said that, the current definition of data processing already refers to,
“any operation or set of operations which is performed on personal data, or on sets of personal data”.
That is a very broad term. If somebody obtained, recorded, used or disclosed all or any part of the data relating to individuals, I have no doubt and am confident that it would be covered by the existing definition.
I go on to the amendments in the name of the noble Lord, Lord Stevenson, who I thank for his kind words about us being together at the Dispatch Box. I greatly look forward to it, too. As he explained, Amendment 3 aims to clarify that the processing of data includes processing undertaken by information society services, such as commercial websites. Article 4 of the GDPR and Clause 2 make it quite clear that the term processing applies to any automated and certain non-automated processing. There is no doubt that this would include information society services.