Data Protection (Fundamental Rights and Freedoms) (Amendment) Regulations 2023

I thank the Secondary Legislation Scrutiny Committee and European Statutory Instruments Committee for their views on these regulations. I have noted their concerns that rights protected by domestic law under the Human Rights Act might not provide the same level of protection as rights protected by EU law under the Charter of Fundamental Rights of the European Union. The matter of protection of people’s rights is of utmost importance, and I take this opportunity to reassure the Committee that the changes we are making via these regulations will not significantly affect the way the data protection framework works or indeed erode the protections it affords to people. Prior to EU exit, EU law rights protected by the charter included, for example, the right to respect for private and family life, the right to protection of personal data and the right to freedom of expression. The new definition will be based on rights protected by the ECHR, which includes the right to respect for private and family life and the right to freedom of expression.

The committee and others have raised a concern that the regulations remove reference to the specific right to data protection that was a feature of the charter. It is true that there is no such free-standing right under the ECHR. However, case law on this issue shows that data protection forms part of the protection offered by the right to respect for private and family life in Article 8 of the ECHR. It is further protected by our data protection legislation, which provides a comprehensive set of rules for organisations to follow and rights for people in relation to use of their data. The stand-alone right to protection of personal data was a feature of EU law and its removal is a result of EU exit legislation, including the retained EU law Act, rather than these regulations, which merely replace outdated terminology to recognise the new position.

I inform the Committee that we have formally consulted the Information Commissioner’s Office on the drafting of these regulations, and it recognises why the data protection legislation cannot continue to refer to rights that have been repealed. I hope that noble Lords will join me in supporting the draft regulations. I beg to move.

The Court of Justice of the European Union—CJEU—case law from before the end of 2020 was also preserved in domestic law, as was domestic case law interpreting EU rights and obligations. The general principles of EU law, which include fundamental rights and the protection of personal data, were retained as an aid to the interpretation of our data protection frameworks. The principle of the supremacy of EU law was preserved. This meant that, in a conflict between the provisions in the UK GDPR and the DPA 2018, the UK GDPR took precedence. This was confirmed in the case of R (on the application of the Open Rights Group) v the Secretary of State for the Home Department and the Secretary of State for Digital, Culture, Media and Sport. In this case, the retained principle of supremacy was relied on by the Court of Appeal to find that the overly broad exemption in the DPA 2018 from data subject rights in an immigration context was unlawful. Yesterday, the Court of Appeal ruled that the Government must amend the immigration exemption in Schedule 2 to the Data Protection Act because it is incompatible with Article 23 of the UK GDPR. This sort of argument will no longer be possible after the end of this month because the exemptions in Schedule 2 to the DPA will take precedence over the UK GDPR.

The EU Charter of Fundamental Rights was not saved into the domestic statute book. The Government’s view was that this made no substantive difference because the charter simply listed the rights found in EU law, so because the rights and obligations listed in the charter were being saved into domestic law through the European Union (Withdrawal) Act, no rights would be lost. Further, the EUWA clarified that retained case law which referred to rights in the charter should be read as referring to the underlying rights and obligations listed in the charter. This ensured that case law which referred to the charter would still be applicable.

Nothing in EUWA prevented Parliament legislating to change the UK GDPR and the DPA 2018. Indeed, the White Paper on the EUWA stated that, after the UK’s exit from the EU:

“It will then be for democratically elected representatives in the UK to decide on any changes to that law, after full scrutiny and proper debate”.

As we will be discussing next Tuesday at its Second Reading, the UK’s data protection frameworks are being changed through the vehicle of the Data Protection and Digital Information Bill. As I have indicated to the Minister, the noble Viscount, Lord Camrose, these Benches do not welcome those changes and regard them as dilutions of data subject rights.

However, there are also fundamental changes to the UK’s statute book being made at the end of this year through the REULA, which will sweep away the retained EU general principles, including fundamental rights and the requirement to interpret retained EU law in accordance with those principles. Further, the principle of the supremacy of EU law is being deleted. The default position is that domestic law whenever enacted will trump the law which came from the EU.

Changes introduced by REULA are bound to create legal uncertainty. In terms of the UK GDPR and the DPA 2018, EU fundamental rights are the underpinning foundation of the law. If they are simply deleted—the default position under REULA—the UK GDPR and the Data Protection Act 2018 will become more difficult to interpret. This is, of course, why the regulations have been introduced. They are intended to ensure that, as the Minister said, references to fundamental rights and freedoms in the UK GDPR and the DPA 2018 are read as references to fundamental rights and freedoms as set out in the European Convention on Human Rights as implemented through the Human Rights Act 1998.

On one level, this makes sense. Article 8 of the EU’s Charter of Fundamental Rights—the right to the protection of personal data—is based on Article 8 of the ECHR on the right to private and family life, but it is not certain that the rights under Article 8 of the ECHR provide exactly the same protections as the right to data protection in the EU legal order. First, this is because the ECHR has no specific fundamental right to the protection of personal data. In the case of R (Davis & Watson) v Secretary of State for the Home Department, the High Court held that Article 8 of the charter goes further and is more specific than Article 8 of the ECHR. Secondly, the charter contains general provisions explaining how the relevant rights should be interpreted, and Article 52 of the charter confirms that, when rights in the charter correspond to the rights in the ECHR, the meaning and scope of those rights should be the same as in the ECHR, although the EU is not prevented from providing more extensive protections. Whether EU fundamental rights provided more extensive protection than those under the ECHR will be tested in the courts over the coming years, but there is likely to be uncertainty in relation to this point from the end of this year.