My Lords, I shall also speak to Amendments 13, 15 and 21. It is slightly putting the cart before the horse to deal with Amendment 11. I will do so since it comes earlier in the order, but it covers a rather less general issue than the less general amendments.
Under the current Data Protection Act, controllers need a Schedule 2 legal basis to process personal data. Schedule 2 lists six main groupings and the controller has to select at least one from the list. If the controller does not have a legal basis for processing, then the controller cannot process the personal data. So it is surprising to discover that Clause 7, through the use of the word “includes”, can legitimise public sector processing of personal data on a ground not listed in the Bill. Such a basis might be, for instance, not necessary for the controller’s statutory functions, and that is why I seek the Minister’s reassurance.
There is all the difference between setting out the bases in an exhaustive way and a non-exhaustive way. In looking at how the position is reached, one needs to look at Clause 7, which states:
“In Article 6(1) of the GDPR (lawfulness of processing), the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for … administration of justice”,
and so on until (d),
“the exercise of a function of the Crown, a Minister of the Crown or a government department”.
It can be seen by comparison with Schedule 2 of the DPA that the only missing basis for processing is,
“the exercise of any other functions of a public nature exercised in the public interest by any person”.
The Explanatory Notes to Clause 7 state:
“Article 6(2) of the GDPR enables Member States to, amongst other things, set out more specific provisions in respect of Article 6(1)(c) and (e). This clause provides a non-exhaustive list of examples of processing under Article 6(1)(e)”.
That seems slightly paradoxical; it says it is going to be more specific than the Explanatory Notes say it is going to be non-exhaustive. The note continues:
“This includes processing of personal data that is necessary for the administration of justice”,
and so on. The section on Clause 7 concludes:
“The list is similar to that contained in paragraph 5 of Schedule 2 to the 1998 Act”.
So the intent, as explained in paragraphs 85 and 86 of the Explanatory Notes, is for the Government to use the flexibility set out in Article 6(1)(c) and (e) to take
an exhaustive list of legal bases for the processing of personal data and actually create a non-exhaustive list of grounds that public bodies can use in Clause 7. How paradoxical can you get?
7.30 pm
The difference between exhaustive and non-exhaustive is profound. An exhaustive list requires that the legal basis associated with processing be one of those listed. The non-exhaustive list says that the legal basis can be one of those listed, but there may be another legal basis that is not listed that applies to the processing of personal data. In other words, the legal basis, or the grounds in Clause 7 that allow a public sector controller to process personal data, extend beyond paragraphs (a) to (d) and include other unspecified grounds. What are these other grounds? How many are there? Who defines them? What are the Government’s intentions? Indeed, how can Clause 7 be enforced by the ICO if a public sector controller such as a local authority can argue that the processing of personal data, although not necessary for the exercise of the function conferred on it by enactment, is necessary for the exercise of a function agreed at, say, a council meeting? Who knows whether this ground is valid when the list of possible grounds in Clause 7 is non-exhaustive? I hope I have made clear the position and our bafflement as to why the list is non-exhaustive, and I very much hope that the Minister can explain the import and purpose of Clause 7.
Other amendments that we have tabled are probing in nature as well. The term “public interest” is used throughout the Data Protection Bill and is key to applying many of its provisions. These include consideration of the legal basis, condition for processing, whether the exemption applies, whether the data can be transferred, and as a defence to certain offences. In relation to special categories of personal data, the term “substantial public interest” is used in the Bill, as in the GDPR. Neither “public interest” nor “substantial public interest” are defined terms in the Bill. Concerns regarding the lack of clarity around those terms were raised during Second Reading. My noble friend Lady Ludford, in particular, raised that, and the noble Lord, Lord Patel, raised it in the context of research.
Further clarification on the scope of “public interest” and “substantial public interest” in the Bill is required. I am afraid that the noble Lord, Lord Collins, may have to put up with this, but guidance is needed on how those terms are to be interpreted when applying the Bill’s provisions. I think we will see a theme whereby the noble Lord, Lord Collins, stands up every time the word “guidance” is mentioned, asking when, how and so on.
The application of a public interest test or substantial public interest test will to an extent depend on the circumstances of the processing. However, guidance on the application of these terms from the ICO would provide clarity and greatly assist controllers and processors in carrying out their obligations, and data subjects in understanding whether their data is being processed in accordance with the terms of the legislation. It would be desirable
to have a statutory code of practice requiring the commissioner to produce such guidance, and to allow it to be consulted on and scrutinised by Parliament.
Public interest, of course, is also relevant to both freedom of expression and freedom of information. Guidance should be available as to its application in both those contexts. I hope I have said enough in the hope that the Minister will untangle this particular puzzle for us over time—perhaps not at this stage, but certainly as the Bill progresses. I beg to move.