Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019

Motion to Approve

Moved by

That the draft Regulations laid before the House on 14 January be approved.

My Lords, today we are concerned with the protection of personal data once the UK has withdrawn from the EU, when EU law will cease to apply in the UK.

Noble Lords will recall from debates last year on the Data Protection Bill that much of our current data protection framework derives from EU measures. When the UK leaves the EU, the GDPR will be retained in domestic law through the European Union (Withdrawal) Act 2018. That Act also permits fixes to be made so that the retained version of the UK GDPR continues to be operable in a domestic context. That is what the regulations before the House today are designed to do.

Before we look at the changes in more detail, it is important to make clear the general approach. The purpose of this exercise is to correct deficiencies arising from our departure from the EU. As such, these regulations do not significantly affect UK businesses or erode people’s data protection rights. We are looking to maintain continuity. This approach will put the UK in the best possible position to receive a positive adequacy decision from the EU.

Many of the amendments made to the GDPR by these regulations simply replace European Union-related terminology with UK equivalents. For example, there are many references in the GDPR to “member states” or “member state law”. These references have typically been amended by these regulations to refer to “the UK” and “domestic law” respectively, or removed altogether. For greater clarity post exit, the retained version of the GDPR as amended by these regulations will be known as the UK GDPR.

However, simply replacing European terminology with UK equivalents does not address all the deficiencies that arise as a result of our exit from the EU. The Government have given careful thought to how the UK GDPR and the Data Protection Act 2018 should approach these remaining deficiencies. I shall address a number of these important issues in more detail.

It would not be appropriate for the EU Commission to make adequacy decisions on behalf of the UK. Therefore, these regulations transfer the function of making adequacy decisions under article 45 of the GDPR and article 36 of the law enforcement directive to the Secretary of State. Parliament will have the opportunity to scrutinise these decisions, including the opportunity to stop them from continuing to have effect. Similarly, the function of preparing standard contractual clauses is also transferred from the European Commission to the Secretary of State. The Information Commissioner will also continue to exercise this function, but will no longer be subject to EU Commission oversight.

To minimise any disruption to established general data flows from the UK to the EEA on the day of exit, a number of transitional provisions are made by these regulations. They include a provision to continue to treat EU member states, other EEA countries and Gibraltar as adequate in relation to general data processing under the UK GDPR. These provisions will be kept under review. Without such a provision, many UK businesses which are transferring personal data to businesses in the EEA on a regular basis would be forced to explore alternative mechanisms to ensure that transfers from the UK to the EEA continued to be lawful. For the purposes of adequacy assessments under the law enforcement directive and Part 3 of the Data Protection Act 2018, EU member states and Gibraltar will, as a further transitional measure, automatically be deemed adequate to preserve the flow of critical law enforcement data from the UK to the EU and Gibraltar.

Although this is not strictly relevant to the purpose of this SI because it is an EU Commission matter, I should say that while the measures I have outlined should protect established data flows from the UK to the EU, the European Commission may not put reciprocal arrangements in place prior to our departure from the EU in a no-deal situation. The Government will continue to encourage the EU Commission to begin its adequacy assessment of the UK as soon as possible.

Many UK businesses will be accustomed to transferring personal data freely to countries that have already been deemed adequate in whole or in part by the EU Commission. The regulation also makes transitional provision for those decisions that were in place at the time this SI was laid in Parliament to continue to have effect as if they had been made by the Secretary of State. These arrangements will be kept under review. This includes the EU’s decision in relation to companies participating in the Privacy Shield scheme in the United States. To reflect specific arrangements put in place by the US to ensure the continued application of Privacy Shield and its protections for UK data transfers, further regulations will very shortly be brought forward to clarify that personal data can be transferred to US companies only when they have updated their Privacy Shield commitment to include the UK. Where UK organisations are relying on standard contractual clauses approved by the EU Commission as an adequate safeguard for transfers to other third countries, further transitional provisions will mean that they will not have to rewrite those contracts.

On the approach that the regulations take to the extraterritorial provisions in the GDPR, noble Lords may recall that, in addition to applying to data controllers that are based in the EEA, the GDPR applies to those based outside the EEA which are processing EEA data for the purposes of providing goods and services or monitoring individuals’ behaviour. Where a data controller outside the EEA is systematically processing the data of EEA residents, it is required to appoint a representative in the EEA to act as a contact point for EEA supervisory authorities. To ensure that there is no dilution in data protection standards when the UK leaves the EU, these regulations preserve the GDPR’s extraterritorial approach. This means that the UK GDPR will apply to certain data controllers based outside the UK which process the data, or monitor the behaviour, of data subjects in the UK.

Articles 60 to 76 of the current GDPR focus on how the different supervisory authorities in the EEA will work together to investigate data breaches and share guidance and best practice through the European Data Protection Board. Once the UK leaves the EU, there will be no automatic right for the Information Commissioner to sit on the EDPB or to participate in the GDPR’s one-stop-shop mechanism, so these provisions have been removed from the UK GDPR. The Government recognise the value of cross-border regulatory co-operation. That is why the draft political declaration makes it clear in paragraph 10 that the EU and the UK should collaborate to ensure that our regulators can continue to work together where it is in our shared interests. Clearly, we cannot pre-empt the outcome of these discussions. However, what we can do is to retain Article 50 of the GDPR in our law, which says that the Information Commissioner,

“shall take appropriate steps to … develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection of personal data”.

This ensures that, come what may, data protection authorities on both sides of the channel will have a common basis from which to develop new international co-operation mechanisms.

My Lords, if the Minister will forgive me, this is a crucial issue in what is going to happen. Where there is a data controller outside the United Kingdom in a no-deal scenario, will there be a requirement for it to have a representative inside the United Kingdom to replicate the existing EU arrangement? It was not clear from what the Minister has just said whether that will be an absolute requirement.

If they fulfil those conditions that I mentioned, the answer is yes.

I would like to touch on what our exit from the EU might mean for the applied GDPR, as provided for by Chapter 3 of Part 2 of the Data Protection Act 2018. Noble Lords will recall that we created a separate regime which provides for broadly equivalent standards to the GDPR to apply to processing activities that are outside the scope of EU law and covered by neither Part 3 nor 4 of the Act, which deal with processing by law enforcement and intelligence services respectively. This regime currently applies, for example, where a controller other than the intelligence services is processing for national security or defence purposes.

As the EU GDPR will not, as a matter of domestic law, apply directly to any general processing activities when we leave the EU, these regulations are intended to simplify matters by providing for a single regime for all general processing activities. Those provisions in the 2018 Act that provide for the applied GDPR, together with other references to the applied GDPR in legislation, are removed. Importantly, the provisions in the applied GDPR which currently provide exemptions from specified provisions where these are required for the purposes of safeguarding national security or for defence purposes have been retained in the merged regime. These exemptions balance the need to protect personal data against ensuring that the UK’s security and intelligence community can continue to carry out its vital work to safeguard national security. I should emphasise that the merger does not itself alter the purview of EU law so where aspects of domestic data protection law were outside EU competence before exit day, this will not change as a result of this instrument. We have included provisions in the regulations to make that point clear.

I believe that the approach the Government are taking is an appropriate way of addressing the deficiencies in domestic data protection laws resulting from the UK leaving the EU. The aim of these regulations is to ensure continuity for data subjects, controllers and processors by maintaining the same data protection standards that currently exist under the GDPR and the Data Protection Act 2018.

My Lords, I am not sure the Minister is going to have quite the easy ride he had with the first statutory instrument. My eye was caught by a very detailed briefing by the law firm Fieldfisher on the consequences of this SI. It was the final paragraph that caught my eye. It says:

“From a broader perspective, the creation of a new data protection regime in the UK may present additional complexities for controllers and processors who are caught by both European and UK law and will therefore need to comply with both the GDPR and (in relation to UK customer data) something that looks like the GDPR but which may start to move away from it as time goes on”.

Those last words are ominous. There is no doubt that the GDPR was a great success for European co-operation. The noble Baroness, Lady O’Neill, reminded us earlier of the wide range of issues that we will have to take into account in protecting our democracy from data abuses. There are similar dangers in the protection of our commercial and business life. The value of the GDPR is that it gives us a strength of certainty of European legislation.

I will delay the House a little with a reminiscence. Between 2010 and 2013 I was the Minister at the Ministry of Justice responsible for the earlier negotiations on GDPR. I went to a meeting in Lithuania and throughout the day I noticed that there was one person sat at the table who never participated, voted or said anything. At the end I turned to the British ambassador and asked, “Who is the guy at the end of the table—he has not said anything?” “That is the Norwegian,” he said. “He can come and listen, but can’t vote and he is not involved our decisions.”

I often think of that when I hear people banging on about sovereignty. Sovereignty was best exercised by British Ministers at the table briefed, I have to say, by officials who were the people to go to. I will not name any particular official, but there was one man to go to as GDPR clunked its way through the machinery. There were “light touchers” and those who had quite recently experienced a Stasi or state abuse of personal data and privacy, and balancing the requirements of GDPR was part of the diplomacy our officials showed. I was also greatly assisted by our parliamentarians in the European Parliament: my noble friend Lady Ludford was very influential in steering the GDPR through some choppy waters.

My first visit as a Minister was to Lithuania. I felt considerable pride that I was sitting with 27 colleagues in a part of Europe that had experienced every kind of dictatorship, from Nazism to communism. We were now sitting around a table trying to deal with one of the most important issues that we will have to face in the years ahead, with this fourth industrial revolution, artificial intelligence and the data revolution. It worries me that we are going into a period when data is described as the new oil, the most important and valued asset that we can have, while real doubts are still on the agenda and being exacerbated by the Brexit process—never, of course, put on the side of a bus.

The Minister gave sweet assurances on how quickly we would deal with adequacy. He is now shaking his head, so let us hear from him.