My Lords, I will comment on Amendments 3, 4 and 5. The Minister and the noble Baroness may well feel that I do not give up, and I agree: I do not. I of course understand clearly what the Government are trying to do with the amendment from the noble Baroness, Lady Royall of Blaisdon—that they have agreed to get that into the Bill. It is helpful to know that public bodies need to be defined as such when they are processing data for tasks that are not defined as tasks in the public interest. This opens up the possibility of their instead using legitimate interests as a legal basis under some circumstances: for example, as has already been mentioned for universities, contacting alumni for fundraising purposes.
My point is different: universities and their research activities and how that is recognised, which we discussed. Here, it is more pressing to be clear on what counts as a task in the public interest, since public bodies will need to determine which legal basis is appropriate to the processing they are undertaking in different circumstances. For example, is research conducted in universities a task in the public interest, in which case the university would be considered as a public body for the purposes of the Bill, or is it not? In the latter case the university is not a public body for research purposes, and the research is therefore conducted on the legal basis of legitimate interest.
These differences matter, particularly as the GDPR requires data controllers to be clear on the legal basis they are using. How are public bodies such as universities to make this determination? The clearest answer would be, as I indicated in Committee, that the ICO gives guidance. I understand that the Government cannot direct the ICO to give guidance, so a way needs to be found to clarify which tasks fall under the public
interest basis, specifically using the example of university research to provide that clarity. I would be grateful if the Minister commented on that.
4.15 pm