Data Protection (Charges and Information) (Amendment) Regulations 2019

Motion to Approve

Moved by

That the draft Regulations laid before the House on 17 December 2018 be approved.

My Lords, I declare an interest which every Member of this House who speaks will have to declare so perhaps I can save them the bother. I will benefit from the fact that I will not have to pay the £40 charge if the regulations are approved. Secondly, my wife is a parish councillor and will also benefit.

The original regulations were debated and approved in this House on 20 March 2018. Noble Lords may recall that those regulations introduced a new charging structure to fund the Information Commissioner’s Office. The authority for doing so derived at the time from the Digital Economy Act 2017, now superseded by the powers set out in Section 137 of the Data Protection Act 2018. As we promised during those debates, we are now looking to implement a new exemption from the annual data protection charge for elected representatives, candidates for election and Members of the House of Lords for processing that they undertake in the course of fulfilling their democratic duties.

The new data protection framework is about protecting personal data—that is, information that can identify individuals. Some of us in this House will be data controllers—we may hold personal data—and are responsible for how that information is processed. There may be a number of reasons why we hold that personal data—for example, we may have been entrusted with it by members of the public for particular aspects of parliamentary work—but, as data controllers, we have various obligations under the Data Protection Act, including how we look after that information.

While we have previously debated the importance of having an adequately funded regulator, there will be some situations where it would be unreasonable for some data controllers to pay the charge or where the charge would give rise to unintended negative consequences. For that reason, Schedule 1 to the funding regulations details a number of exemptions to the payment of the charge. For example, any data controller who processes personal data only for staff administration purposes, or purely for advertising, marketing and public relations reasons, is not required to pay.

My Lords, we welcome this statutory instrument and the exemptions provided for. Like the Minister and, I think, everybody in this House, we do not want a tax on democracy, but people should be assured that the legal responsibilities remain the same and can be quite onerous. The Minister’s last remark was that we must not allow people to use the candidate or even the MP or Peer as cover for activities that would be outside the narrow exemption of this House.

This reminds me of debates we had some 20 or even 30 years ago—in the early 1990s—when we brought in legislation about the financing of political parties. I remember that those of us who had experience of working for political parties were very conscious that they are all made up of volunteers, often amateurs. There was a danger in that legislation—and I think there still is—of putting on to enthusiastic volunteer amateurs, who make our democracy work, very onerous financial responsibilities in terms of election spending and, in this case, very onerous data protection responsibilities. There might be a case for giving political parties some funding for advice, training and support to make sure that these responsibilities are understood and work well.

What the Minister has had to say is very welcome, and we are all involved in this, but it appears that the initial advice was a little confusing and caused concern. Once these regulations are approved, as I am sure they will be, I wonder whether the House authorities can issue some clear and definitive advice that will be of benefit to Members of this House. We look forward to this SI being passed.

My Lords, I just want to add to what my noble friend Lord McNally has said. I am glad that this matter is being cleared up, because we had very confusing advice a few months ago. I also want to note, as one of the people who was involved in the European Parliament’s proceedings on the GDPR, that it is a UK decision to impose a fee on data controllers. The mandatory requirement was removed from the GDPR, and it is a unilateral UK decision to fund the ICO in this way so that, in effect, data controllers in the UK will not feel the change which perhaps will be felt by data controllers in other EEA states, where Governments make a decision to fund their data protection authorities from, for instance, general taxation. I realise that that decision was made in the Digital Economy Act rather than in last year’s Data Protection Act, but it is imposed not by Brussels but by Whitehall and Westminster.

My Lords, these amendments represent a little island of calm in a turbulent ocean. For once, I am referring not to Brexit or the backstop but, rather, to the fact that we are in the middle of some very turbulent changes in our regimes for the protection of data and privacy and many other aspects of communication. This morning, we saw the publication of the report of the Digital, Culture, Media and Sport Committee of the other place on disinformation and “fake news”. In so far as I have got into the report—which is not very far—it is very welcome in that it represents a much broader view of the threats to democracy from the present regime for controlling the use of data. There is much more to be said, and I hope that the Minister will be able to say something about the ways in which the broader picture will be taken into account. These amendments do not need changing because of the broader picture, but it is curious to fiddle with the small stuff when such major and serious issues are happening in this domain.

My Lords, this seems a sensible measure and the issues have been well rehearsed. There was one area where there was some confusion in my mind, and I hope that noble Lords will not mind my bringing it to their attention now. I, too, am looking forward to not having to pay £40—that is good news, but in exempting Members from both Houses, candidates and so on from the need to pay that charge, we recognise that many of us have other duties and obligations not related to our being Members of this House. We are in employment, we run things and so on, and we handle people’s data other than in the sense that has been described. I guess they will have to pay their £40 or whatever it is, but my confusion lies in the hinterland between those two modes of operation: information gained in respect of activities of one kind can without too much imagination become useful in respect of those of another kind. I wonder whether some thought has been given to handling that kind of confusion and, if so, how. It would be helpful if the Minister could say something about that; otherwise, this seems like common sense and we would have no hesitation in wanting it to go forward.

My Lords, I am grateful to all noble Lords who have responded. This statutory instrument is unique among those I have dealt with recently in having gained a speedy and generally favourable response; I am grateful for that.

I am grateful to the noble Lord, Lord McNally, for his welcome. He spoke about financing political parties and the need to give advice—as indeed did the noble Baroness, Lady Ludford. I can say that the House authorities will take that on board and provide some clear advice, taking into account the new requirements if this statutory instrument is passed; I am very pleased about that.

I acknowledge—the noble Baroness, Lady Ludford, was right about this—that the approach to funding the ICO was originally set by the Digital Economy Act, which was superseded by the Data Protection Act. The method of funding the ICO, and the question of whether it is adequate, have been occupying us for several years. I am pleased that we have finally resolved it. The noble Baroness is right that we decided to do it this way and not as part of the GDPR. Supervisory authorities can be funded in a number of ways. The reason for doing it this way was that it did not involve much practical change from the ICO funding arrangements under the Data Protection Act 1998 and a register is not necessary.

The noble Baroness, Lady O’Neill, talked about an ocean of calm within a broader picture that is possibly not so calming. I agree with her that it is a small but important issue. It is right to deal with an issue that promotes—or at least does not prevent—demographic engagement; and a commitment was made when the regulations were debated last year that we would look at this and take it forward. It is important to carry forward what we said; I take on board her points about the issues alluded to in the DCMS Committee’s report, as outlined this morning. Generally speaking, we have not yet had time to analyse it in great detail but, together with the Cabinet Office, we will be taking forward a lot of these issues around disinformation and its effect on elections, particularly through the online harms White Paper, which will be coming out soon.

I wonder if I could ask for a little more resolution on the matter. My mind is filled with pictures of activities that I myself have engaged in where, by doing work for which I am remunerated, I gain some kind of control of people’s data or the use of it, and at the same time I can be involved in an area where I am exempt from all that. Because of the homogeneity of the activities, one paid and one not, it is not difficult to see that the dividing line between what qualifies and what does not might be difficult to establish, even with the good will of the authorities of the House who write the best guidance that has ever been written.

If the guidance does not produce clarity in the noble Lord’s mind, then I think the answer is to avail himself of the ICO’s telephone hotline, which is there specifically to answer questions such as the ones that he has asked. He will be able to give them the specific examples of where he is unable to be clear. That applies generally to people in public office such as him but also, importantly, to other small businesses; there is a specific small-business hotline that is there exactly to answer questions like his. I hope that has covered most of the issues.

Motion agreed.