Crime and Policing Bill

Committee (15th Day)

Clause 192: Implementation of international law enforcement information-sharing agreements

Amendment 464

464: Clause 192, page 223, line 33, at end insert— “(4A) Before the appropriate national authority makes regulations under subsection (1) for the purpose of implementing a new international agreement, or significantly altering an existing agreement, the authority must conduct and publish a comprehensive Privacy Impact Assessment.(4B) The Privacy Impact Assessment required under subsection (4A) must analyse and report on—(a) the necessity and proportionality of the information sharing arrangements,(b) the mechanism by which individual rights, including those under Article 8 of the Human Rights Act 1998, will be safeguarded,(c) the risks of non-compliance with the data protection legislation or of unintended consequences arising from the sharing of personal data, and(d) the nature and volume of personal data intended to be shared or accessed under the agreement.(4C) The appropriate national authority must lay before Parliament, no later than 12 months after the first regulations are made under this section, and annually thereafter, a report on the operation of regulations made under this section.(4D) The annual report required under subsection (4C) must include, in particular—(a) an assessment of the overall volume and categories of information shared under the regulations,(b) a detailed analysis of the impact of the regulations on the privacy and data protection rights of individuals, and(c) a summary of any internal reviews, audits, or legal challenges relating to information sharing under the agreements implemented by the regulations.”Member's explanatory statement This amendment requires a privacy impact assessment to be carried out before regulations are made under this section.

My Lords, in moving Amendment 464 I will speak to Amendments 467, 468 and 503, in my name. These amendments collectively address the governance of Clauses 192 to 194, which grant the Secretary of State broad powers to make regulations giving effect to international law enforcement information-sharing agreements. Following the recent passage of the Data (Use and Access) Act 2025, we are now operating in a new legal landscape, where the statutory threshold for protecting data transferred overseas has been lowered. These amendments are not just desirable; they are essential safety mechanisms to fill that gap.

Amendment 464 would be a safeguard of, so to speak, look before you leap. It stipulates that, before regulations are made under Clause 192 to implement a new international agreement, the authority must publish a comprehensive privacy impact assessment. The necessity of this assessment has intensified following the enactment of the Data (Use and Access) Act. The UK’s new test for onward transfers of data has lowered the bar. It no longer requires foreign protections to be essentially equivalent to ours, but merely not materially lower. This creates a dangerous new risk profile. The European Data Protection Board has explicitly noted that this new test omits key safeguards against foreign government access and removes redress mechanisms for individuals. If the general statutory floor has been lowered, Amendment 464 becomes the essential safety net. We must assess these specific risks via a privacy impact assessment before we open the digital borders, to ensure that we are not exposing UK citizens to jurisdictions where they have no legal remedy.

This brings me to Amendment 467, which addresses the nature of the data being shared. Where regulations authorise the transfer of highly sensitive personal data, such as biometrics, genetics or political opinions, this amendment would require enhanced protective measures. All this highlights the illusion of data protection when transferring data to high-risk jurisdictions that lack the rule of law. We know that in authoritarian states domestic intelligence laws will always override the standard contractual clauses usually relied on for data transfers. Because the Data (Use and Access) Act has removed the requirement for foreign safeguards to be essentially equivalent, we cannot rely on the general law to protect highly sensitive biometric or health data. My amendment would restore the requirement that transfers of such sensitive data must be demonstrated to be strictly necessary and proportionate. We cannot allow efficiency of data sharing to deny the reality that, in some jurisdictions, once data arrives, the state will have unrestricted access. Transparency must follow these powers.

My Lords, we thank the noble Lord, Lord Clement-Jones, for his amendments and the importance that he has obviously placed on the right to privacy of the general public.

I support the principle behind Amendment 464. Sharing information often carries a risk with it, particularly when it is for the purposes of law enforcement, and especially when this is done internationally. Law enforcement data contains information that is far more personal to the individual or case in question than the norm. Any data of this sort must be handled with the highest discretion. Ensuring that the sharing of this data respects the right to privacy carries no unintended consequences and, most importantly, is necessary and should be the benchmark from which regulations are made.

If this amendment is accepted, I do not see the additional need for Amendment 468. At the very least, the privacy impact assessment under Amendment 464 should form the basis of any annual report that Amendment 468 would mandate. Less is more when it comes to admin and reports, so I am hesitant to support a new report that is not necessarily needed.

I think Amendment 467 is sensible. In general, internationally shared data should not include information prejudicial to any individual, let alone domestic citizens. This particularly extends to the sharing of biometric data for the purpose of unique identification or genetic identification.

These categories of data are obviously vital for the purposes of law enforcement, but law enforcement extra territorially risks placing this data in the wrong hands. This and similar data should therefore be particularly protected, which is the aim of the noble Lord’s amendment. I hope that the Minister can outline what the Government intend to do to ensure that the international sharing of personal data is undertaken in the most discreet and protected manner.

My Lords, it is a pleasure to kick off what I very much hope will be the last day in Committee—not to jinx it. I am grateful to the noble Lord, Lord Clement-Jones, for setting out the case for these amendments, which relate to the provisions in Clauses 192 to 194.

International law enforcement information-sharing agreements are a vital tool that provide law enforcement officers with access to new intelligence to fight crime, increase public protection and reduce the threat of societal harm posed by international criminality. To clarify, these measures provide the appropriate national authority with the power to make regulations to implement both new and existing legally binding international law enforcement information-sharing agreements. Such regulations may, for example, make provision for the technical and, where appropriate, operational detail to facilitate the information sharing provided for in a particular agreement.

The UK is recognised globally for having one of the most robust data protection regimes, anchored in the Data Protection Act and UK GDPR, which ensure that privacy is protected even in the most complex areas of law enforcement and international co-operation. This Government are committed to maintaining these high standards and ways of working to ensure that data protection and privacy are not compromised as we strengthen cross-border security. UK law already requires data controllers to conduct a data protection impact assessment for any activity that is likely to result in a high risk to individuals’ rights and freedoms. Public bodies and law enforcement authorities are bound by the Human Rights Act, the European Convention on Human Rights and the Equality Act, and they must duly assess activities accordingly.

Existing data protection principles and statutory requirements, particularly data protection impact assessments, already cover the concerns raised by the noble Lord’s amendments, making new duties duplicative and unnecessary. As is required under Article 36(4) of the UK GDPR, regulations made under this power as they relate to the processing of personal data will require consultation with the Information Commissioner’s Office.

My Lords, I thank the Minister for his detailed reply. It was very cheerful, which I find quite extraordinary in the circumstances. It is almost as though he has been reading Voltaire’s Candide: everything is for the best in all possible worlds. I will read carefully what he said, but there was an extraordinary amount of complacency built into his response about the nature of sharing data across borders—specifically that the existing regime is sufficient to safeguard these transfers and that my amendments would introduce unnecessary friction into law enforcement co-operation. That is because the rules of the game have changed since the Data (Use and Access) Act 2025.

The Information Commissioner can operate only within the legislation provided, which is no safeguard in those circumstances. I have the highest regard for the Information Commissioner and his office, but they have to operate within the bounds of the law, which have changed since the Act was passed. I mentioned the European Data Protection Board and so on. The Minister has performed some kind of parliamentary jujitsu by seeming to say that sensitive data, which I cited as being one of the reasons why I tabled my amendments, makes it far too difficult to do what I am proposing. I admire his speechwriting but I must say that I do not think that is an answer.

I will withdraw my amendment, but I believe that the Act that we spent so long debating has changed the rules of the game and that these amendments are necessary to ensure that international co-operation does not become a backdoor for the erosion of privacy. I will come back to this but, in the meantime, I beg leave to withdraw my amendment.

Amendment 464 withdrawn.

Amendments 465 and 466

465: Clause 192, page 224, leave out lines 1 and 2 Member’s explanatory statement This amendment is consequential on my amendment to clause 192, page 223, line 27.

466: Clause 192, page 224, leave out lines 7 and 8 Member’s explanatory statement This amendment is consequential on my amendment to clause 192, page 223, line 27.

Amendments 465 and 466 agreed.

Clause 192, as amended, agreed.