My Lords, the Bill sets new standards for protecting general data, in accordance with the GDPR, which will give people more control over use of their data and provide new rights to move or delete personal data. However, there will be occasions when it is not in the best interests of the data subject for these rights to be exercised, or where exercising them might impinge on the rights and freedoms of others. Schedule 3 considers this issue in the specific context of health, social work, education and child abuse data. It provides organisations operating in these fields with targeted exemptions where it is necessary for the protection of the data subject or the rights and freedoms of others. Importantly, much of Schedule 3 is directly imported from existing legislation.
The amendments which the noble Lords, Lord Stevenson and Lord Kennedy, have tabled focus on exemptions available for healthcare and social services providers. Let me deal first with the amendments
relating to the healthcare exemptions. Amendment 93A would amend the serious harm test, in paragraph 2 of Schedule 3, by removing the reference to harm caused to other individuals. This is an important safeguard. For example, if a child informed a healthcare provider that they had been abused by a relative and then that person made a subject access request, it is obvious that disclosure could have serious consequences for the child. I am sure that this is not what the noble Lords envisage through their amendment; we consider there are good reasons for retaining the current wording. As I said earlier, these provisions are not new: they have been imported from paragraph 5 of the Data Protection (Subject Access Modification) (Health) Order 2000.
Amendments 94A and 94B would amend the exemption in paragraph 4 which allows health professionals to withhold personal data from parents or carers where the data in question has been provided by the data subject on the basis that it would not be disclosed to the persons making the request. Again, neither of these provisions is new. They too were provided for in paragraph 5 of the 2000 order and we think they remain appropriate.
4 pm
Amendment 94A relates to situations where the personal data is withheld from a person acting on behalf of somebody who cannot manage their own affairs. It would make it clear that this provision applies only in relation to persons who are adjudged to lack capacity under the Mental Capacity Act 2005. The important thing here is not the status of the data subject per se, but the requester’s relationship to the data subject: this paragraph addresses cases where the requester is not the data subject, but is in a position to make subject access requests on the data subject’s behalf. That is why it is framed as it is. We do not feel this amendment is necessary as the Bill already provides that the carer should have been appointed by a court to manage the person’s affairs. I also note in passing that these provisions of the 2005 Act apply to England and Wales only.
Amendment 94B would delete sub-paragraph 2(a) which provides that the data should not be disclosed to the parent or carer if it were provided by the patient in the expectation that it would not be disclosed to that person. Removing this provision could reduce the protection that is available for children and ultimately make them less willing to tell healthcare professionals about things they would not want their parents or carers to hear—for example, complications suffered following female genital mutilation or details about a pregnancy.
Amendments 94C, 94D, 95A and 95B relate to social work exemptions. It is worth recalling that social services records will often contain information from a wide range of sources—for example, schools, doctors, the police or the probation service. Social services are likely to have similar considerations to healthcare professionals when deciding whether to disclose personal data in response to subject access requests. Disclosures to individuals purporting to act on behalf of data subjects could have particularly damaging effects in cases of domestic abuse.
Paragraphs 7 and 8 of Schedule 3 define the meaning of “social work data” and list various social work functions for the purposes of these provisions. Amendment 94C would amend the definition of “social work data” by deleting paragraph 7(1)(b). This paragraph confirms that social work data does not include education data or data concerning health which are dealt with in other parts of the schedule. Given the separate provision in this schedule for the processing of health and education data, we think this provides helpful clarification.
Amendments 94D, 95A and 95B would amend the list of social services functions in paragraph 8 of the schedule. Amendment 94D would amend paragraph 8(1)(a) by removing references to functions conferred on social services providers under the Local Authority Social Services Act 1970 or the Social Work (Scotland) Act 1968. These Acts list a wide range of social services functions, including protecting the welfare of young people, the elderly, the disabled and those suffering from mental health difficulties. Again, there are strong arguments for including them.
Amendment 95A would amend paragraph 8(1)(k) by removing the ability of the Secretary of State or the Department of Health in Northern Ireland to designate voluntary organisations which can carry out social services functions similar to those carried out by a local authority. Amendment 95B would amend paragraph 8(1)(m) by removing the reference to NHS bodies that exercise functions similar to those carried out by the local authority. However, I stress that none of these provisions is new and that they were imported from paragraph 1 of the schedule to the Data Protection (Subject Access Modification) (Social Work) Order 2000. Given current trends in health and social care delivery, we believe that they are still necessary requirements and can see no benefit in their removal. I urge the noble Lord to withdraw his amendment.