My Lords, sensitive processing requires meeting at least one condition from the menu in Schedule 9 and one in Schedule 10. This could be achieved, for instance, because the processing is necessary to protect someone’s vital interests under Schedule 9, and for the same reason under Schedule 10 when consent cannot be given. I wondered whether the repetition amounted to there being only one condition to be met, rather than two or perhaps one and a half—hence Amendment 137R.
Amendment 138A is another amendment suggesting that the Secretary of State’s regulation-making power is too wide under the Bill. In our view, the Secretary of State should be able to add conditions—in other words, protections—but not vary or omit them. That is a thread that runs through the whole of the Bill.
Amendments 139A and 139B probe the condition in Schedule 9 that processing is necessary for the purposes of legitimate interests pursued by the controller or a third party to whom the data is disclosed. Again, “legitimate interest” made me pause. It is made lawful by Clause 84 because it meets one of the lawfulness conditions, so there is a circularity here. The schedule then applies a condition to the condition—it is not lawful if it prejudices rights and freedoms or legitimate interests of data subjects, or rather is unwarranted because of prejudice to the rights and freedoms or interests of the data subject. Does that allow for the risk of prejudice? It struck me as quite a clumsy phrase—“unwarranted … because of prejudice”. I realise that the person who drafted it—I do not want to say “draftsman”—must have had some very particular thoughts in mind.
7.15 pm
Schedule 10 lists the conditions for sensitive processing in the case of the intelligence services. Amendment 139C suggests that, in the case of processing to protect vital interests when there is no consent—one might argue that that is what the services do all the time—it should be reported to the commissioner. Amendment 139D refers to another condition where it is necessary, in connection with legal proceedings, advice or legal rights. We wondered whether it should be restricted to offences—for instance, to exclude an employment dispute between a service and an employee. I confess that I realised this morning that I had not thought through the implications for legal professional privilege, but my focus here is on whether we are giving the services an advantage which, in the example that I have used, is not available to another employer, including law enforcement, under Part 3. That might not be the best example, but I am curious as to how extensive the provision is.
Amendment 140A excludes the condition relating to medical services and is tabled to enable the Minister to tell us how it would apply in the case of the intelligence services. My imagination is inadequate.
Finally, on Amendment 140B, the second data principle requires the manner of processing to be compatible with the purpose of collection, and then gives what I read as examples of compatible processing. Amending,
“if the processing … consists of … and … is subject to”,
what is set out to “only if” would change this to an exhaustive list of criteria. The short question about this clause is whether “if” means “only if”. I beg to move.