My Lords, we have amendments in this group. Amendment 79A concerns exemptions from GDPR and adaptations and restrictions based on various articles. As we begin to tighten up our understanding and clarify the range of application of these exemptions as the Bill goes through this House, we have talked to Liberty about the rights of individuals under this part of the Bill. Amendment 79A seeks to remove the exemption from data subjects’ right to restrict the processing of their data—for example, in cases where data accuracy is contested, the processing is unlawful or the data is required for the exercise of a legal claim in relation to a variety of broad purposes including the prevention and detection of crime, tax purposes, risk assessment systems, including in the administering of housing benefit, and the maintenance of effective immigration control.
Amendment 79B is a similar and parallel amendment to remove the exemption from data subjects’ right to object to data processing where there is an absence of compelling legitimate grounds, again in relation to the same range of activities and purposes. Amendment 83B is a probing amendment by which we seek to delete a paragraph which outlines where the GDPR does not apply to personal data processed for the purposes of functions designed to protect the public. Instanced against this are, for example,
“financial loss due to dishonesty … financial loss due to the conduct of discharged or undischarged bankrupts”,
and so on.
A set of amendments then come under Part 3 of this schedule on the protection of the rights of others. Amendment 86A deletes conditions under which a controller can determine whether it is reasonable to disclose information without consent. Amendment 86B probes provisions which state that information can be disclosed without consent where,
“the health data test is met … the social work data test is met, or … the education data test”.
When we get into some of these it seems, frankly, that they are rather loosely drafted and not immediately clear. Perhaps we could work harder to bring these things to a pitch where they are common sense and clear to normally intelligent people—although after the presentation from the noble Lord, Lord Pannick, I do not reach that bar; I am doing my best. Amendment 86C deletes the paragraph which outlines conditions by which the GDPR does not apply,
“to personal data processed for the purposes of or in connection with a corporate finance service provided by a relevant person”.
Even reading the wording of an amendment which we have put some thought into is complicated, and these amendments refer to clauses in the Bill that are even more complicated. Since these affect the rights of individuals, the law should be written with some clarity and lucidity to make it more accessible.
Amendment 86D deletes a paragraph which states that the GDPR provisions do not apply where data is processed for,
“management forecasting or management planning in relation to a business or other activity”.
I have to spit the word “data” out of my mouth when it is used with a singular verb. All my education taught me that it should not be.