Part 5 of the Digital Economy Bill was debated in the House of Lords a few days ago during its Committee Stage.
As you will know if you have been following our work, Big Brother Watch have proposed 12 changes we want to see made to the Bill before it becomes law.
These changes, we believe, will ensure that any the individual will have the right to control how their personal data is used and shared by government, and that any process of sharing will be restricted to what is absolutely necessary, proportionate and subject to strict safeguards and protections. These 12 points are supplemented with more detailed briefings and guidance on our campaign page.
Clearly defined technical, legal and privacy safeguards should be written onto the face of the Bill.
The Codes of Practice must be legally binding documents which require any official sharing data to comply with them rather than just have regard to them.
Individuals should be notified when their data is accessed, shared or retained in real time. Consent for data to be accessed, shared or stored must be sought.
An annual audit of all requests, actions and shares of personal data should be sent to every individual.
Citizens should be able to amend their data if they know the data is inaccurate or has an error.
Any data sharing must be necessary, proportionate and for a legitimate purpose.
Data should be shared when vital not simply to improve wellbeing.
Data requested, shared or stored must be the minimal amount necessary to fulfil the task.
The bulk sharing or bulk storage of birth, death, marriage, civil partnership documents must not be permitted.
Data must be encrypted when in storage or in transit.
Data used for statistics and research should be subject to absolute anonymisation not de-identification. This will protect citizens from being re-identified if data is combined.
The public authorities entitled to data share under the Digital Economy Bill should be written on the face of the Bill.
We are pleased to report that Peers from all political parties raised a number of these concerns in the debate and challenged the Government to make improvements.
The debate can be read in full here, but as a brief overview here are some key moments in relation to our 12 asks.
The draft codes of practice were heavily debated, with particular discussion about the intention for those who will be sharing our data to only have “regard to” the codes rather than “comply with” them. Whilst the Government argued that to have “regard” is standard procedure for legislation, that response was not well received by Peers.
Indeed the codes of practice as a whole raised profound concern with many Peers.
Lord Collins, Labour’s frontbench spokesperson described them as “totally inadequate” whilst Lord Clement-Jones for the Liberal Democrat frontbench said that “there is something defective about these codes of practice. They seem to be far too bland and they do not give the public the reassurance that they should.” We wholeheartedly support these statements and are pleased to see our concerns about the codes being shared by the two Parties.
Lord Keen, who spoke on behalf of the Government stated that the codes had been “developed over two years of open policy development.” Big Brother Watch was a part of that process, we can confirm that the concerns we outlined over those two years are not adequately addressed in the draft codes as currently published.
Lord Keen was clear that new drafts of the codes will be published and be subject to a “public consultation” before being laid before Parliament. Whilst this may sound reassuring, no timetable was given, which considering the Bill is already in its later Parliamentary stages, is of serious concern. Indeed the Lords are beginning Report Stage in just seven days. It is unlikely that publication and consultation will begin before then.
This unwillingness to outline a timetable is of very serious concern. With so much of the crucial detail not being on the face of the Bill but buried in the codes of practice, failure to grant thorough scrutiny until the end of the Parliamentary process raises serious alarm bells. Issuing guidance to badly drafted, woolly law, in documents which won’t have full scrutiny but will be passed as secondary legislation is not the way to make law. Clearly we are not alone in that view as many Peers expressed their concern.
The issue of consent and informing citizens of why and when their data will be shared was raised by Labour, the Liberal Democrats and the Conservatives. Some excellent points were made regarding the risk that personal data, if not properly secured, could run the risk of increasing fraud; the exact same concerns we have been expressing, particularly with regard to the data that appears on our birth certificates which this Bill would enable to be freely shared without our consent – a point raised in the debate.
Widespread opposition was given to the bulk sharing of birth and marriage certificates with emphasis placed on asking why this data needs to be shared in bulk being asked by Peers. Lord Clement-Jones said “we on these Benches and many others outside the House are deeply concerned that Chapter 2 of Part 5 contains no safeguards against bulk copying of civil registration data.“
Despite the attempts of Lord Keen to outlined exactly why Government want to allow the bulk sharing of civil registration document, Lord Clement-Jones stated that the codes of practice relating to the bulk sharing capability are “very opaque in this respect.”
The Liberal Democrats made clear that civil registration data should only be shared with the consent of the individual, a concern we share.The Government’s response; that consent is already covered by the Data Protection Act 1998 (DPA) falls short of specifically responding to the point. Indeed, it would offer more reassurance and weight if those key points in the DPA were explicitly outlined on the face of the Bill and clearly stated in the codes of practice. That they are not lead to the concerns being outlined in the debate.
As with so much of Part 5, reassurances that consent, security and data protection issues are already dealt with because of compliance with the DPA are only reassuring if the adherence is explicitly stated as a necessity for all of the proposals. Furthermore we must not forget that as of May 2018 the DPA will be replaced with the General Data Protection Regulation (GDPR) of which little mention is made on the Bill or in the draft Codes of Practice and which could lead to a large overhaul of Part 5 of the Bill.
Concern about the use of “well-being” as a purpose for data sharing was raised by both Conservative and Liberal Democrat peers. Baroness Janke eloquently said that “improving people’s physical health, their emotional well-being, their contribution to society and their social and emotional well-being, the breadth of those areas is really rather daunting.”
She went on to say that “you could justify almost anything under those four areas”. We wholeheartedly agree, as we do with Baroness Byford’s excellent remark that “defining well-being in terms of well-being suggests that definitions of those covered by this legislation could depend on the personal and political stance of those making those decisions.”
Amendments were also tabled relating to the security of data and emphasis was given to the need to minimise data by Baroness Janke. Her point that “there needs to be a clear justification for sharing data; the purposes must be clear and the definitions governing that must be tight” is outlined as one of our 12 asks.
Overall it was a strong debate for the issues of privacy, security, control, consent and protection.
Whilst many of the amendments were probing and therefore not put to a vote, we will continue to work to ensure that amendments addressing these points are raised at Report Stage.
The Government is clearly aware, if not openly admitting, that Part 5 is nowhere close to being a workable piece of legislation. Questions therefore persist as to why Part 5 has been allowed to progress this far. However we are where we are. The concern of Peers from each and every corner of the House to the Bill is reassuring. Let’s hope that Report Stage will cement these concerns into actual amendments. We certainly will be pushing for that to happen.