My Lords, I will speak also to Amendments 46A, 47A, 48A and 50A. We move to a series of probing amendments relating to insurance. I am concerned about many practical things in the Bill, and what I see as unnecessary and unwise obstacles for insurance in general, and for motor insurance and employer liability insurance in particular. I declare my interests as set out in the register of the House and, in particular, those in respect of the insurance industry.
I thank the noble Lord, Lord Clement-Jones, for his support for these amendments—indeed, he was emailing me late last night—and I thank the Minister for a generous slice of his time last week. I also thank the Association of British Insurers and the Lloyds Market Association for their help in preparing my remarks. They, in turn, have had input from the four other major insurance market associations and other bodies.
The insurance industry delivers products in the public interest. Indeed, some of the major classes, such as motor insurance and employer liability insurance, are compulsory. It is greatly to society’s benefit that there is a wide choice of good products available at a reasonable price. It is less well understood in the wider world what an important part reinsurance plays in supporting insurers by protecting insurance companies from large unexpected losses and providing temporary extra capital when it is needed. In other words, insurers, too, need a wide choice of good products available at a reasonable price. It is a complex ecosystem, and unintended consequences tend almost invariably to hurt the man in the street.
The impact assessment called for the setting of new standards in accordance with the GDPR,
“whilst preserving the existing tailored exemptions from the Data Protection Act”.
Later on the same page of the impact assessment there is a call for,
“exercising the derogations in the best interest of the UK”.
In fact, the impact assessment has several references to business and insurance business which make it plain that the Government do not intend to place an undue extra burden on business. I am grateful to the Government and the Bill team for having gone some way to alleviating the problems—but I fear that we need to go a lot further.
Sensitive personal data under the current Data Protection Act 1998 has become special category personal data in the GDPR. The treatment of special category personal data looks similar under the GDPR and the DPA, with consent as the applicable legal ground under which data can be processed in most cases. However, what has changed is the definition of consent, with the threshold for valid consent under GDPR now being much higher.
For insurers and reinsurers, the two most common types of special category personal data are information relating to health and information relating to criminal convictions. Being able to consider health and criminal conviction data is hugely important for insurers uniformly and throughout the world. The ABI estimates that the ability to process these types of data helped in detecting around £1.3 billion in fraudulent claims in 2015 alone, and I fear that the Bill unamended would therefore potentially increase costs for millions of motor insurance policyholders. To get an idea of the size of the market where health data is required for underwriting and claims purposes, the LMA has advised me that it identifies annual Lloyd’s market premiums alone of at least £2.3 billion a year.
Processing special-category data, including health data, is fundamental to calculating levels of risk and underwriting the majority of retail insurance products. ICO draft guidance infer that consent as a precondition of accessing a service, as would be the case for a proposal for an insurance contract, would not be a legitimate basis for processing special-category personal data.
Let us take the example of a daily smoker who at retirement age tries to buy an annuity. They would be asked to provide their medical details. This health data would establish that the individual has a below-average life expectancy. The insurer is therefore able to offer an enhanced annuity that pays the individual a higher percentage of income every year.
Under the Bill and its associated draft ICO guidance, insurers would not be able to access the individual’s medical records as consent is a precondition of accessing the enhanced annuity market and therefore such consent cannot be freely given. Insurers would be unable to offer an enhanced annuity and the individual would be treated as a consumer with average life expectancy and receive a lower income from their annuity. This would be a highly undesirable state of affairs.
Take the situation where an insurer has a direct relationship with the insured—a personal motor policy, let us assume. It would seem relatively easy for them to obtain a consent for all processing. However, it is not. More than half the motor insurers in the UK make use of the Motor Insurance Bureau’s MyLicence anti-fraud facility. This third-party service, available to all insurers, allows them at the quote stage to understand a driver’s record using DVLA data. Express consent is not possible and nor, for the same ICO reasoning as my annuity example, would any consent anyway be valid. If the Bill is unamended, this would be bound to drive up premiums for motor insurers, as a principal defence against fraud would cease to exist.
I should notify the Committee that if Amendment 45B is agreed, I cannot call Amendments 46 to 50A by reason of pre-emption.
My Lords, the noble Earl, Lord Kinnoull, has clearly and knowledgeably introduced the amendment, which I strongly support. He made clear through his case studies the Bill’s potential impact on the insurance industry, and I very much hope that the Minister has taken them to heart. Processing special category data, including health data, is fundamental to calculating levels of risk, as the noble Earl explained, and to underwriting most retail insurance products. Such data is also needed for the administration of insurance policies, particularly claims handling.
The insurance industry has made the convincing case that if the implementation of the Bill does not provide a workable basis for insurers to process that data, it will interrupt the provision to UK consumers of retail insurance products such as health, life and travel insurance, and especially products with health-related consumer benefits, such as enhanced annuities. The noble Earl mentioned a number of impacts, but estimates suggest that, in the motor market alone, if this issue is not resolved, it could impact on about 27 million policies and see premiums rise by about 3% to 5%.
There is a need to process criminal conviction data for the purposes of underwriting insurance in, for instance, the motor insurance market. Insurers need to process data to assess risk and set the prices and terms for mainstream products such as motor, health and travel insurance.
The key issue of concern is that new GDPR standards for consent for special category data, including health, such as the right to withdraw consent without experiencing detriment, are incompatible with the uninterrupted provision of these products. As the noble Earl, Lord Kinnoull, has clearly stated, there is scope for a UK derogation represented by these amendments, which would be in the public interest, to allow processing of criminal conviction and special category data when it is necessary for arranging, underwriting and administering insurance and reinsurance policies and insurance and reinsurance policy claims. I very much hope that the Minister will take those arguments on board.
My Lords, the noble Earl, Lord Kinnoull, has done us a great favour in introducing with great skill these amendments, which get to the heart of problems with some of the language used in the Bill. We are grateful to him for going through and picking out the choices that were before the Government and the way their particular choices seem to roll back some of the advances made in the insurance industry in recent years. I look forward to the Minister’s response.
Our probing Amendment 47 in this group is on a slightly higher level. It is not quite as detailed—nor was it intended to be—as the one moved by the noble Earl. We were hoping to raise a more general question, to which I hope the Minister will be able to respond. Our concern, which meets the concerns raised by the noble Earl, Lord Kinnoull, and the noble Lord, Lord Clement-Jones, is where the Government want to get to on this. It must be true that insurance is one of the key problems facing many people in our country. It is the topic that will be discussed in the QSD in today’s dinner break as it bears heavily on financial inclusion issues. So many people in this country do not take out insurance, personal or otherwise, and suffer as a result. We have to be very careful as we take this forward as a social issue.
However, an open-ended derogation to allow those who wish to gather information to make a better insurance market surely also raises risks. If we are talking about highly personal profiling—we may not be because there are constraints in the noble Earl’s amendment—it would lead to a more efficient and cheaper insurance industry, but at what personal cost? For instance, if it is possible to pick up data from those who perhaps unadvisedly put on Facebook or Twitter how many times they get drunk—I am sure that is not unusual, particularly among the younger generation—information could be gathered for a profile that ought to be taken into account for their life, health or car insurance. I am not sure that we would be very happy with that.
Underlying our probing amendment is to ask the Minister to respond—it may be possible by letter rather than today—on protections the Government have in mind. What sort of stock points are there that we can rely on as we move forward in this area? As processing becomes more powerful and more data is available, pooled risks are beginning to look a little old-fashioned. The old traditional model under which insurance is gathered is that the more the pool is expanded, the risks are spread out more appropriately across everybody. The trouble is that the more we know, we will be including people who are perhaps more reckless and therefore skewing the pooling arrangements. We have to be careful about that.
There is obviously a social objective in having a more efficient and effective insurance market but this ought to be counterbalanced to make sure that those people who are vulnerable are not excluded or uninsurable as a result. The state could step in, obviously, and has done so, as we have been reminded already in our Committee discussions about the difficulty of getting insurance for those who build on flood plains. However that is not the point here. This is about general insurance across the range of current market opportunities being affected by the fact that we are not ensuring that the data gathered is both proportionate and correct in terms of what it provides for the individual data subjects concerned.
I want to say a couple of words on consent, because it is something I have been thinking about for a while. Consent is often seen as a great panacea to this whole thing about protecting people, but I do not think it really is. The requests that really irritate me are the ones that ask for unnecessary information such as your date of birth, when all you are trying to do is to sign up for a warranty on a bit of equipment or whatever, because firms are trying to profile their customers. Those I agree should be stopped. But other consent requests are essential to giving a good service.
There are two things to say about such requests. One is that most people do not mind, because they assume that people know everything about them anyway—particularly the Government and the big boys. They just want the thing to be done properly so that they can get their money, or whatever it is. To put blocks in the way so that they have to click on or sign lots of different consent forms does not get them any further and just irritates them more. Those provisions are very sensible.
My Lords, I am grateful to all noble Lords who have spoken and for the opportunity to speak to Schedule 1 in relation to an industry in which I spent many years. I accept many of the things that the noble Earl, Lord Kinnoull, described and completely understand many of his points—and, indeed, many of the points that other noble Lords have made. As the noble Lord, Lord Clement-Jones, said, I have taken the noble Earl’s examples to heart, and I absolutely accept the importance of the insurance industry. The Government have worked with the Association of British Insurers and others to ensure that the Bill strikes the right balance between safeguarding the rights of data subjects and processing data without consent when necessary for carrying on insurance business—and a balance it must be. The noble Lord, Lord Stevenson, alluded to some of those issues when he took us away from the technical detail of his amendment to a higher plane, as always.
The noble Earl, Lord Kinnoull, and the noble Lords, Lord Clement-Jones and Lord Stevenson, have proposed Amendments 45B, 46A, 47, 47A, 48A and 50A, which would amend or replace paragraphs 14 and 15 of Schedule 1, relating to insurance. These amendments would have the effect of providing a broad basis for processing sensitive types of personal data for insurance-related purposes. Amendment 45B, in particular, would replace the current processing conditions for insurance business set out in paragraphs 14 and 15 with a broad condition covering the arrangement, underwriting, performance or administration of a contract of insurance or reinsurance, but the amendment does not provide any safeguards for the data subject.
Amendment 47 would amend the processing condition relating to processing for insurance purposes in paragraph 14. This processing condition was imported from paragraph 5 of the 2000 order made under the Data Protection Act 1998. Removal of the term might lessen the safeguards for data subjects, because insurers could potentially rely on the provisions even where it was reasonable to obtain consent. I shall come to the opinions of the noble Earl, Lord Erroll, on consent in a minute.
Amendments 46A, 47A, 48A and 50A are less sweeping, but would also remove safeguards and widen the range of data that insurers could process to far beyond what the current law allows. The Bill already contains specific exemptions permitting the processing of family health data to underwrite the insured’s policy and data required for insurance policies on the life of another or group contract. We debated last week a third amendment to address the challenges of automatic renewals.
These processing conditions are made under the substantial public interest derogation. When setting out the grounds for such a derogation, the Government are limited—this partly addresses the point made by the noble Lord, Lord Stevenson—by the need to meet the “substantial public interest test” in the GDPR and the need to provide appropriate safeguards for the data subject. A personal or private economic or commercial benefit is insufficient: the benefits for individuals or society need to significantly outweigh the need of the data subject to have their data protected. On this basis, the Government consider it difficult to justify a single broad exemption. Taken together, the Government remain of the view that the package of targeted exemptions in the Bill is sufficient and achieves the same effect.
Nevertheless, noble Lords have raised some important matters and the Government believe that the processing necessary for compulsory insurance products must be allowed to proceed without the barriers that have been so helpfully described. The common thread in these concerns is how consent is sought and given. The noble Earl, Lord Kinnoull, referred to that and gave several examples. The Information Commissioner has published draft guidance on consent and the Government have been in discussions with her office on how the impact on business can be better managed. We will ensure that we resolve the issues raised.
I say to the noble Earl, Lord Erroll, that consent is important and the position taken by the GDPR is valid. We do not have a choice in this: the GDPR is directly applicable and when you are dealing with data, it is obviously extremely important to get consent, if you can. The GDPR makes that a first line of defence, although it provides others when consent is not possible. As I say, consent is important and it has to be meaningful consent, because we all know that you can have a pre-tick box and that is not what most people nowadays regard as consent. Going back to the noble Earl, Lord Kinnoull—
My Lords, I am sorry to interrupt. The Minister mentioned the guidance from the Information Commissioner. From what he said, I assume he knows that the insurance industry does not believe that the guidance is sufficient; it is inadequate for its purposes. Is he saying that a discussion is taking place on how that guidance might be changed to meet the purposes of the insurance industry? If it cannot be changed, will he therefore consider amendments on Report?
Of course, it is not for us to tell the Information Commissioner what guidance to issue. The guidance that has been issued is not in all respects completely helpful to the insurance industry.
Following up the noble Lord’s point, I would like to say a couple of things. First, I sort of understand where the Information Commissioner’s Office is coming from. I have article 7 in my hands, which contains the definition of consent from the GDPR, and article 9(2)(a). My concern is that even if the Government are very nice to an Information Commissioner and persuade them to change the guidance, it could change at any time. It is important to ensure that the Bill will work for the ordinary man in the street. As for compulsory classes, it is not about looking after the insurers but every small business in Britain and every small person who wants to get motor insurance, especially those who have problems with either criminal convictions or their health.
I agree; I think I mentioned compulsory classes before. Going back to the guidance, we are having discussions. We have already had constructive discussions with the noble Earl, and we will have more discussions on this subject with the insurance industry, in which he has indicated that he would like to take part. I am grateful to him for coming to see me last week.
My Lords, I am sorry to interrupt the Minister again but he is dealing with important concepts. Right at the beginning of his speech he said he did not think this could be covered by the substantial public interest test. Surely the continuance of insurance in all those different areas, not just for small businesses but for the consumer, and right across the board in the retail market, is of substantial public interest. I do not quite understand why it does not meet that test.
I may have misled the noble Lord. I did not say that it does not meet the substantial test but that we had to balance the need to meet the substantial public interest test in the GDPR and the need to provide appropriate safeguards for the data subject. I am not saying that those circumstances do not exist. There is clearly substantial public interest that, as we discussed last week, compulsory classes of insurance should be able to automatically renew in certain circumstances. I am sorry if I misled the noble Lord.
We realised that there are potentially some issues surrounding consent, particularly in the British way of handling insurance where you have many intermediaries, which creates a problem. That may also take place in other countries, so the Information Commissioner will also look at how they address these issues, because there is meant to be a harmonious regime across Europe. The noble Earl has agreed to come and talk to us, and I hope that on the basis of further discussions, he will withdraw his amendment.
I followed the Minister quite well until the last exchange, where I got a bit confused. Is he saying in some sense that there may be a case for two types of derogation: that that which applies to compulsory insurance—there are strong public interest reasons why it should be continued—might be done under one derogation and the rest raised as more specific items, as suggested by the noble Earl?
We can break it down simply between compulsory and non-compulsory classes. Some classes may more easily fulfil the substantial public interest test than others. In balancing the needs, it goes too far to give a broad exemption for all insurance, so we are trying to create a balance. However, we accept that compulsory classes are important.
I am sure that the noble Earl, Lord Kinnoull, will come back at greater length on this. The issue that the Minister has outlined is difficult, partly because the Information Commissioner plays and will play such an important role in the interpretation of the Bill. When the Government consider the next steps and whether to table their own amendments or accept other amendments on Report, will they bring the Information Commissioner or her representative into the room? It seems that the guidance and the interaction of the guidance with the Bill—and, eventually, with the Act—will be of extreme importance.
I agree, which is why I mentioned the guidance that the Information Commissioner has already given. I am certainly willing to talk to her but it is not our place to order her into the room. However, we are constantly talking to her, and there is absolutely no reason why we would not do so on this important matter.
I thank all noble Lords who have taken part in this short but interesting debate. Of course, the Information Commissioner reports to Parliament, so if we held a meeting here, we probably could ask her, quite properly, to come. That might be quite helpful in this complex area. As I said, when you mess around in these areas, the person who suffers is the man in the street, not the insurance companies. The noble Lord, Lord Stevenson of Balmacara, in particular made a number of interesting points in speaking to his amendment, which need to go into the mix as regards how we sort through this difficult area.
I am very grateful to the Minister for confirming that we will continue discussions in this area. I do not think for a moment that I necessarily have all the right answers, but we have started on the journey and will continue. We will certainly be talking about the same issues again in different formats on Report and I look forward to that very much. On that basis, I beg leave to withdraw the amendment.
My Lords, as this amendment involves data provided by local authorities, I should declare my interests as a councillor of the London Borough of Southwark and as a vice-president of the Local Government Association.
Amendment 53 in my name and that of my noble friend Lord Stevenson of Balmacara would delete the first occurrence of the word “substantial” from paragraph 17(2) of Schedule 1 and Amendment 54 would delete its second occurrence from the same provision.
Healthy-functioning political parties are a vital part of our democracy. Campaigners and campaigning have moved on a long way from the days of hand writing envelopes to encompass much more sophisticated methods of contacting voters using all available mechanisms.
Political parties and their members need clarity and certainty as to what they are required to do, what they are able to do and what they are not able to do, so that they act lawfully at all times and in all respects. We cannot leave parties, campaigners and party members with law that is grey and unclear, and with rules that mean that campaigners, in good faith, make wide interpretations that are then found to be incorrect, due largely to the required clarity not having been given to them in the first place by government and Parliament.
I am also very clear that political parties are volunteer armies, with people volunteering to campaign to get members of their party elected to various positions in Parliament and in local authorities and to run various campaigns.
I have a number of questions for the Minister. I do not necessarily expect to get answers today but I hope that when he responds he will agree to meet me along with other interested Peers on the matters I am raising. I know that the noble Lord, Lord Hayward, from the Minister’s Benches would certainly like to meet him, and I am sure that the noble Lord, Lord Tyler, would also wish to be involved in those discussions. I hope that the Minister will agree to that. I also think that it would be useful if any such meeting involved officials from the three parties to discuss how we can get this right; otherwise, there will be all sorts of problems for parties, party members and campaigners, and none of us wants that.
Therefore, my questions to the Minister are as follows—as I said, I shall be happy for him to write to me. Will he provide a list of the characteristics or activities that are required for a political party to conduct operations? Does he believe that the terms in relation to political activity in paragraph 17 of Schedule 1 definitively cover the required activities of UK political parties? Will he clarify what constitutes profiling with regard to the activities of political parties? What activities or operations with reference to paragraph 17(1)(c) of Schedule 1 would be considered necessary for a political party? Does he think that the procedure detailed in paragraph 17(3)(a), whereby a data subject can give written notice to require the data controller—in this case, a political party—to cease the processing of their data, is consistent with Section 13(3) of the RPA 1983, where parties hold and process data on the basis not of consent but of being supplied that data by a local authority via the electoral register? Given the regular transfer of registers to political parties, does the Minister think it is practical or enforceable for a party to cease processing the data, which will likely be resupplied by an authority?
Let me make the point this way: take elector A, who instructs the party to stop processing their data, and the party complies. But the party then gets given data from the local authority in the next round, and elector A’s information is included. As soon as the party processes that data, it will technically have infringed the law. This is very complicated and it would be useful if the Minister’s officials could meet people interested in this area and come back to us. Whatever we end up with following this process, it must be consistent and work, and it should not bring into conflict two different Acts of Parliament. I beg to move.
My Lords, the noble Lord referred to the rules as a bit grey and asked for clarity for the volunteer army. I should declare an interest as a foot soldier in that volunteer army.
The noble Lord’s request that party officials should be involved in this process is a good one—I would have thought they would have been. The Minister should be aware of my first question as I emailed him about this, over the weekend I am afraid. Has the Electoral Commission been involved in these provisions?
The noble Lord mentioned the electoral register provided by a local authority. My specific question is about the provision, acquisition and use of a marked electoral register. For those who are not foot soldiers, that document is marked up by the local authority, which administers elections, to show which electors have voted. As noble Lords will understand, this is valuable information for campaigning parties and can identify whether an individual is likely to turn out and vote and so worth concentrating a lot of effort on. I can see that this exercise could be regarded as “campaigning” under paragraph 17(4) of Schedule 1. However, it is necessary, although I do not suppose that every local party in every constituency makes use of the access it has. It is obvious to me that this information does not reveal political opinions, which is also mentioned in the provisions. I would be grateful to hear the Minister’s comments. I am happy to wait until a wider meeting takes place, but that needs to be before Report.
I want to raise a question on a paragraph that is in close geographical proximity in the Bill—I cannot see another place to raise the issue and it occurred to me only yesterday. Why are Members of the House of Lords not within the definition of “elected representatives”? We do not have the casework that MPs do, but we are often approached about individual cases and some Peers pursue those with considerable vigour. This omission—I can see a typo in the email that I sent to the Minister about this; I have typed “mission” but I meant “omission”—is obviously deliberate on the part of the Government.
My Lords, I begin by repeating, almost word-for-word, the noble Lord, Lord Kennedy: engaging voters is important in a healthy democracy. In order to do that, political parties, referendum campaigners and candidates will campaign using a variety of communication methods. However, they must comply with the law when doing so, and this includes the proper handling of the personal data they collect and hold.
Noble Lords will be aware that the Information Commissioner recently announced that she was conducting an assessment of the data protection risks arising from the use of data analytics, including for political purposes. She recognises that this is a complex and rapidly evolving area where organisations use a person’s internet or public profile to target communications or messaging. The level of awareness among the public about how data and analytics work and how their personal data is collected, shared and used through such tools is low. What is clear is that these tools have a significant potential impact on an individual’s privacy, and the Government welcome the commissioner’s focus on this issue. It is against this backdrop that we considered the amendments of the noble Lord.
The amendments seek to amend a processing condition relating to political parties in paragraph 17. The current clause permits political parties to process data revealing political opinions, provided that it does not cause substantial damage or substantial distress. This replicates the existing wording in the Data Protection Act 1998. I have said that political campaigning is a vital democratic activity but it can also generate heated debated. Removal of the word “substantial” could mean that data processing for political purposes which caused even mild offence or irritation becomes unlawful. I am sure noble Lords would agree that it is vital that the Bill, while recognising the importance of adequate data protection standards, does not unduly chill such an important aspect of the UK’s democracy. For that reason I ask the noble Lord to withdraw the amendments.
I thank the noble Lord for allowing me to reply later to his list of questions. I found it difficult to copy them down, let alone answer them all, but I take the point. In many instances we are all in the same boat on this, as far as political parties are concerned. I shall of course be happy to meet with him, and I take the point about who should attend. I am not sure it will be next week, when we have two days in Committee, but we will arrange it as soon as possible. I will have to get a big room because my office is too small for all the people who will be coming. I take the points the noble Lord made in his questions and will address them in the meeting.
The noble Baroness, Lady Hamwee, asked whether the Electoral Commission had been consulted. It did not respond to the Government’s call for views which was published earlier this year, and we have not solicited any views explicitly from it beyond that.
The noble Baroness also asked about the provision, acquisition and use of a marked electoral register within paragraph 17 of Schedule 1. As she explained, the marked register shows who has voted at an election but does not show how they voted. As such, it does not record political views and does not contain sensitive data—called special categories of data in the GDPR —and, as the protections for sensitive data in article 9 of the GDPR are not relevant, Schedule 1 does not apply.
Lastly, the noble Baroness asked why Members of the House of Lords are not within the definition of elected representatives. Speaking as an elected Member of the House of Lords—albeit with a fairly small electorate—I am obviously interested in this. I have discovered that none of us, I am afraid, are within the definition of elected representatives in the Bill. We recognise that noble Lords may raise issues on an individual’s behalf. Most issues will not concern sensitive data but, where they do, in most cases we would expect noble Lords to rely on the explicit consent of the person concerned. This arrangement has operated for the past 20 years under the current law, and that is the position at the moment.
I hope I have tackled the specific items relating to the amendments. I accept the points made by the noble Lord, Lord Kennedy, about the electoral issues that need to be raised in general.
I fully support my noble friend’s assertions and the Minister’s response. It is very important that registered political parties can operate effectively. I wonder whether, in the discussions he is proposing to undertake, the Minister will also address the issue of other organisations and political parties attempting to influence the political process. I do not think I need to spell it out, in view of recent news, but the use of social media by organisations that are not covered by our electoral law or by registration as a political party must not have the same provisions that registered political parties would have under the Bill or my noble friend’s amendments. I wonder if that could be addressed directly in these discussions.
My Lords, before the Minister replies to my noble friend Lord Whitty, I want to emphasise the importance of his arguments and ask him to reflect again on what he said about the point made by the noble Baroness, Lady Hamwee, on the Electoral Commission’s involvement. Although, as the Minister said, he wrote in general terms to the commission—or it was asked to give evidence to the Government on the matter—that may have been around the time of the general election, when perhaps it was engaged in immediate problems. It is important that it be included in discussions on the broader issues, particularly the ones just raised by my noble friend Lord Whitty. Perhaps it would be worth the Government reflecting on attempting to draw it into the conversation now.
It is easier for me to intervene now, so the Minister can answer everything in one go. In two small amendments, there is a massive issue that needs to be addressed with great seriousness. The Minister referred to the Information Commissioner’s study on the interrelationship between data and the political process. I wonder whether her findings will be available before the Bill becomes law, because that will have a great impact. The other thing we must learn, as the noble Lord, Lord Whitty, said, is that it is often wise to look across the Atlantic to find out what is coming to us. There is a massive problem coming down the road concerning how data are used during the political process. On the one hand, there is the issue, referred to by the noble Lord, Lord Kennedy, of political parties being mostly volunteers, trying their best to deal with complex laws. They must be protected as best they can. On the other side of the argument, there is a degree of sophistication in applying data to politics, which could become a threat to the democratic process. These are two small amendments, but they are an iceberg in terms of the problems that lie beneath them.
My Lords, I want to pick up on the last point of the noble Lord, Lord McNally. We are getting into a situation where political parties are addressing personal messages to individual voters and saying different things to different voters. This is not apparent; there must be ways to control it. We will have to give some considerable thought to it, so I see the virtue of the amendments.
Quickly, because I will not remember all the questions and points, I want to emphasise that they are all very good points and I will reflect on them. My main mission is to get the GDPR and law enforcement directive in place by May 2018. I absolutely accept the point made by the noble Lord, Lord McNally—that this is the tip of iceberg—but we must bear in mind that this is about data protection, both today and on Report, so I will focus on that. We have already had other avenues to raise a lot of the points the noble Lord made, but I agree that it is a huge issue. He asked when the report from the Information Commissioner will be available. I would expect it before Christmas, so it will be before the Bill becomes law.
I certainly undertake to reflect on what the noble Baroness, Lady Jay, said about the Electoral Commission. I believe that our call for views was after the election; nevertheless, I take her point. I am very sorry but I cannot remember what the point from the noble Lord, Lord Whitty, was, but I accept these things have to be taken into account. When we have our meeting—it is becoming a big meeting—it will be for people concerned specifically with the Data Protection Act, not some of the issues that lie outside that narrow area, important though they are.
I ask noble Lords not to press their amendments.
My Lords, picking up on the last point from the noble Baroness, Lady Hamwee, is this the first time the privileges of Members of this House have been reduced in relation to Members of the other House? If so, will the Government consult the Speaker of this House on whether he considers that desirable?
My Lords, they have not been reduced. This is the position that exists today.
My Lords, privileges are being given to Members of another place—and indeed to Members of the Parliaments of Scotland and other places—that are being denied to us. Is this the first time that has been done?
No, it is not the first time because this is the position that exists under the Data Protection Act 1998.
My Lords, I thank all noble Lords for speaking in this debate. As I think the noble Lord, Lord McNally, said, these amendments would delete just two words, but we have had a very important debate. We tabled the amendments to probe these issues, which are very important.
I am pleased that the noble Lord, Lord Ashton of Hyde, has agreed to meet us because we need to discuss this. It would be much better if we could get interested Peers from this House and officials from various parties together to sort this matter out, rather than leave it and let it go to the other place. We have a much better record of sitting down and sorting such issues out. I hope, if we need to amend the Bill, we do so on Report. Before we have our meeting—I accept it will be quite a big meeting—it would be useful if the noble Lord wrote to me, if he can, and to other interested Lords so we can have the Government’s position on paper before we sit down. That would help our discussions and move them on. There is a community of interest among noble Lords.
I certainly agree with the points made by the noble Lord, Lord McNally, and by my noble friends Lord Whitty and Lady Jay, but we need to focus on these issues, get them right and get proper amendments in place to protect parties and campaigners as they do their proper and lawful work. At this stage, I am happy to withdraw the amendment.
My Lords, at Second Reading, the Government described the exemption of doping in sport as a flexibility permitted within the GDPR. This is welcome. My understanding is that anti-doping in sport comes under Part 2, relating to the permissibility of collecting personal data for reasons of public interest. Therefore, biometric data, for example, may be collected and processed to prevent doping without the explicit consent of the data subject—in this case the athlete. Member states are able to pass into their domestic legislation further restrictions on the processing of special categories of data. This is what the Government do under Part 4 of Schedule 1.
The relevant data controller—a role which currently is not clear in the Bill in the case of sport—will have to produce a document that explains how its procedures comply with article 5 of the GDPR and what its policies on retention and use of personal data within its control are. It will also be under an obligation to maintain a record of the processing it or its data processors have undertaken to comply with article 30 of the GDPR. With respect to this, the data controller has to show how they comply with article 6 of the GDPR and whether they have deleted or retained the data under their control. Sport would be wise to reflect that the Government have said that what is proposed is not an exemption to the Bill but flexibility permitted within the GDPR, which will require sporting bodies to exercise a number of important responsibilities, and that ignoring such responsibilities comes with significant sanctions, some criminal in nature. I would be grateful if the Minister could confirm that my understanding is correct on that subject.
From the perspective of the athletes, the fact that—across the party divide, I understand—we are supportive of this flexibility does not underestimate what we are asking for. The doping regime in sport requires the athlete to be totally responsible for what is in their body at all times. I know of few spheres of activity where the onus on an individual is so severe. Our athletes are guilty before being proven innocent. It is intrusive, to say the least, to have a regime whereby a young gymnast eating beef which may have been imported from a country where the farmer used steroids to fatten his cattle for market is immediately found guilty of a doping offence in this country. It is equally important to recognise that the “whereabouts test” required of all our leading professional and amateur athletes requires them to inform the doping authorities of where they are for a given period each and every day including their holidays, where in all other forms of employment this intrusive and onerous requirement goes beyond the freedom that an employee can legitimately expect, not least under European law, as well as the freedom to have their holidays uninterrupted on a daily basis by their employers.
I appreciate that these exemptions must respect the essence of fundamental rights and freedoms, and be a necessary and proportionate measure in a democratic society for the purposes of safeguarding the doping regime in British sport, necessary for reasons of public interest and providing for suitable and specific measures to safeguard the fundamental rights and interests of data subjects. I would be grateful if the Minister could confirm that this is the case. This law, which enshrines in UK law a right to be forgotten and for an athlete not to provide a test sample, claiming protection under this Bill, would drive a coach and horses through the anti-doping regime that we have developed in this country under the aegis of UKAD, or UK Anti-Doping, if it was not treated with the flexibility permitted within the GDPR. Thus, I fully support the decision taken by the Government.
I am also in full support of the work of the governing bodies, UKAD and the world of sport in the fight against doping, which poses the greatest threat to clean sport in our generation, particularly since it was reported only two weeks ago by the World Anti-Doping Agency in publishing its 2016 anti-doping testing figures that the number of adverse analytical findings is increasing. We face a world where new technologies and pharmaceutical products, changes in doping patterns, gene editing and state-sponsored doping both within and beyond the borders of Russia are a growing issue, providing not a diminishing but an increasing menace to clean sport.
The amendments that I have tabled are set against this background, probing in nature at this stage, and underline a number of important points which may require further consideration by the House. Currently, the relevant provision, paragraph 21 in Schedule 1, is broadly drawn and would lead to unintended consequences, for there is no definition of doping nor of sport, and the definition of the bodies to be covered by it is non-existent. This could become a lawyer’s paradise. If I and another noble Lord establish an organisation with the broad aims set out in paragraph 21, it seems to me that we would be deemed a “relevant body”. Indeed, there is no mention of the framework currently in place to eliminate doping—namely UKAD, the government-funded UK anti-doping body, which should be referenced in the legislation, providing it with the necessary powers. Looking further at the wording, I would like to ask the Minister whether he agrees with me that,
“doping … at a sporting event”,
covers spectators as well as competitors. If so, we need further work on the wording.
I have stated that I believe that UKAD should be named on the face of the Bill, since UKAD is the arm’s-length body, or ALB, accountable to Parliament through the Secretary of State at the DCMS and mandated to deliver the Government’s treaty commitments under the UNESCO International Convention against Doping in Sport to protect a culture of clean sport in the UK. This is achieved through the implementation and management of the UK’s national anti-doping policy, which requires funded sports bodies in the UK to comply with the World Anti-Doping Code.
Is there not always a risk in naming a specific body in any piece of legislation, because government have the habit, on occasion, of changing the name of a body and you then have to change the name on the primary legislation?
I hear what my noble friend says. I recognise that the wording may need to recognise any successor body to UKAD, but the importance of putting UKAD in the legislation now arises from the fact that it is an arm’s-length body accountable to Parliament; that it is honour bound—and, indeed, legally bound, at the moment, through the Secretary of State—to deliver the requirements of the UNESCO International Convention against Doping in Sport; and it is the recognised and funded body in this country. It would be possible to add “and to any successor body” to my amendment.
My Lords, how does the noble Lord define sport? That is a major question. For instance, in snooker, which I believe is defined as a sport, it is recognised that beta blockers are a banned substance whereas in other sports they would not necessarily be banned. Dancing is not defined as a sport although it demands very much more activity than either darts or snooker, which is a sport.
The noble Lord raises an issue that could well keep the Committee late into the evening and indeed has taxed the minds of many individuals both inside and outside this Chamber. For example, if we consider sport to require physical activity and competition, gardening at the Chelsea Flower Show might well be covered by that broad definition. I hope that my noble friend in sport, and indeed the noble Lord, will forgive me if I do not pursue that path. However, I did say at the outset that there is an important issue here in that we need to define what the Government mean by sport in their amendment, because it is unclear to many people outside this Chamber—and oft debated—what exactly a sporting activity is.
I shall close by touching on the performance-enhancing substances listed in the World Anti-Doping Code and why I believe it is critical that we should cover those. I have reservations about exempting sports bodies from requiring sensitive personal data from athletes simply because they are deemed to be “contrary to the spirit of sport” or, while legal, “could cause harm to an athlete”. My objective has always been focused on tackling doping in sport and I believe that it may go too far to seek an exemption for these additional categories. However, I remain open to persuasion by the Minister on this issue and will listen carefully to both UKAD and to the UK governing bodies of sport if they feel otherwise. If so, in a future amendment we will need to be specific about exactly what we mean by the “spirit of sport” by defining it in primary legislation and being clear about who determines what does cause “harm to an athlete”, and why such protection from the GDPR rights is appropriate in that context.
On the final question of gender, this is a probing amendment since the current position in UK law is that competitive sports men and women who have undertaken a change in their gender are currently prohibited from participating in certain competitions under the Gender Recognition Act 2004. As a result, an athlete who changes their gender would be subject to the onerous sanctions in this Bill if in the process of any medical treatment to assist their change-in-gender process they used banned performance-enhancing substances. This is not unusual where testosterone is prescribed.
In conclusion, I hope that this is the beginning of a legislative path where those who knowingly cheat fellow athletes out of their careers, recognition, selection or financial gain by taking a cocktail of banned drugs are recognised for what they are doing—namely, committing fraud. We also believe that tailor-made legislation should be put in place to criminalise that activity, as it is in every other sphere of life. UK Anti-Doping has the national duty to ensure that all sports comply fully with anti-doping policies and procedures. Under its new chair, Trevor Pearce, its new director of communications, Emily Robinson, and its CEO, Nicole Sapstead, I believe that an effective team is now in place who recognise that a globally leading NADO has to be well resourced, truly independent of the governing bodies of sport and granted additional powers. My amendments to the Bill begin to provide it with the tools it needs and I believe that it is best positioned to lead the campaign. This legislation should make it unequivocally clear that that is the case because that is the best way of protecting the interests of athletes. I beg to move.
My Lords, if this amendment is agreed to, I cannot call Amendments 58 to 62 because of pre-emption.
I must say how delighted I am that on this occasion we had the noble Lord advocating his own amendment. I was nearly in the hot seat last week, but we have just avoided it. I was delighted at his powerful advocacy because of course the noble Lord is extraordinarily well informed on all matters to do with sport, and this goes to the heart of sport in terms of preventing cheats who prevent the rest of us enjoying what should be clean sport, however that may be defined. All I have to do is pick out one or two of the elements of what the noble Lord said in my supportive comments.
There is the fact that neither “doping” nor “sport” is defined in the Bill, as the noble Lord pointed out. There is no definition of the bodies to be covered by paragraph 21, which is extremely important. He also made an extraordinarily important point about UKAD. Naming UKAD in the Bill, as the amendment seeks to do, would add to its authority and allow it to carry out all the various functions that he outlined in his speech. If it is necessary to add other bodies, as he suggested, that should of course be considered.
The noble Lord’s reference to performance-enhancing substances, which again are mentioned in the amendment and included in the world anti-doping code, ties the Bill together with that code and was very important as well. Finally, the point that he made about gender and the substances used in connection with gender change was bang up to the minute. That, too, must be covered by provisions such as this. So if the Minister is not already discussing these issues with the noble Lord, Lord Moynihan, I very much hope that he is about to and will certainly do so before Report.
My Lords, once again your Lordships’ House is very grateful to the noble Lord, Lord Moynihan, for raising this issue and, as the noble Lord, Lord Clement-Jones, said, for doing so in such a comprehensive way. It is in the context of the much wider range of issues that the noble Lord, Lord Moynihan, has been pursuing regarding how sport, gambling and fairness are issues that all need to be taken together. We have been supporting him on those issues, which need legislation behind them.
Noble Lords may not be aware that we have been slightly accused of taking our time over the Bill. I resist that entirely because we are doing exactly what we should be doing in your Lordships’ House: going through line-by-line scrutiny and making sure that the Bill is as good as it can be before it leaves this House. We saw the noble Lord, Lord Moynihan, at the very beginning of Committee and he then dashed off to Australia to do various things, no doubt not unrelated to sport. He has had time to come back and introduce these amendments—but, meanwhile, the noble Lord, Lord Clement-Jones, and I were debating who was going to pick the straw that would require us to introduce them. We were very lucky not to have to do so because they were introduced so well on this occasion.
Our amendment in this group is a probing amendment that picks up on some of the points already made. It raises the issue of why we are restricting this section of the Bill to “sport”—whatever that is. If we are concerned about performance enhancement, we have to look at other competitive arrangements where people gain an advantage because of a performance-enhancing activity such as taking drugs. For instance, in musical competitions, for which the prizes can be quite substantial, it is apparently possible to enhance one’s performance—perhaps in high trills on the violin or playing the piano more brilliantly—if you take performance-enhancing drugs. Is that not somehow seeking to subvert these arrangements? Since that is clearly not sport, is it not something that we ought to be thinking about having in the Bill as well? I say that because, although the narrow sections of the Bill that relate to sport are moving in the right direction, they do not go far enough. As a society, we are going to have to think more widely about this as we go forward.
I am slightly confused by what is a performance-enhancing drug. We have seen athletes and other sportsmen banned in this country for taking what I would call non-enhancing drugs: in other words, cannabis or whatever it might be. In that case they are not performance-enhancing drugs but the reverse of them—yet people can be banned even if taking them is deemed legal in the country where they do so. Even if it is legal to take cannabis, the drug can still be deemed a banned drug by the anti-drug authorities.
My noble friend is quite right. He has obviously been careful to make sure that he has no personal experience of what he talks about and I would like to make it clear that I have none, either. But it is a very tricky area and we are wrong just to dance around it with the idea that we are somehow doing something important in relation to a particular aspect of drug enforcement.
To do this properly, we need a much clearer approach. I realise that I am in danger of rising above the detail here and going back to my high plain of intellectual approach to the Bill for which I have already been criticised—but I hope that when the Minister responds we can get somewhere on this. A meeting on the particular narrow points raised by the government amendment and by the noble Lord, Lord Moynihan, is required. It would be helpful to see the context in which this might operate. I would be happy to attend such a meeting should that be the case.
My Lords, I want to reiterate what my noble friend Lord Ashton said. I think we are learning a lot about philosophy from the noble Lord, Lord Stevenson, during the passage of the Bill. It is a welcome addition as far as I am concerned.
I shall start with brief reference to the government amendments in this group. These amendments, Amendments 58 to 60 and 62 and 63, make further related provision in respect of processing undertaken to ensure the integrity of sport. This is necessary because, unusually, integrity issues in sport often relate to sensitive data, the processing of which may otherwise be prohibited under article 9 of the GDPR. I am grateful to a number of stakeholders for their help in making sure that these amendments will achieve their intended effect.
I turn now to the amendments tabled by the noble Lord, Lord Moynihan, and the noble Lord, Lord Stevenson. Amendments 57 and 61 seek to amend the processing condition in paragraph 21 on anti-doping in sport. This condition was included in the Bill following extensive engagement with sports governing bodies and UK Anti-Doping, which together implement and manage anti-doping policy in the UK. They are also responsible for eliminating the scourge of doping in sport. The paragraph as included in the Bill permits the processing of sensitive data for these purposes. UKAD is of the view that the measure as drafted will enable it to continue to perform this important function.
Amendment 57, tabled by my noble friend Lord Moynihan, who has such great expertise in this area and has done so much over the years to try to combat doping in sport, seeks to narrow the doping provision so that it allows processing only where it relates to an athlete who may be in breach of UKAD’s rules. Amendment 61, tabled by the noble Lord, Lord Stevenson, instead seeks to limit the provision to rules set by a sports governing body with responsibility for a single sport. Neither position reflects the reality of split responsibility for anti-doping in UK sport today. Removing the reference to “sporting event” and “sport generally” may potentially exclude the anti-doping processing carried out by UKAD and by those bodies which set and enforce anti-doping rules in a particular sporting event rather than a particular sport, such as 6 Nations rugby, the IOC or the Commonwealth Games Federation. The Bill must not be limited to only the interventions of UKAD but must allow processing in those sports and sporting events which have their own anti-doping rules. The fact that those bodies are not governed entirely by UKAD’s rules makes their processing no less important. Equally, the provision must allow processing in relation to participants who are not themselves athletes. As noble Lords will understand, the sensitive data or criminal record of a coach or relative may be fundamental to anti-doping cases.
A narrowing of the scope of this paragraph could create loopholes for participants who cheat. For these reasons, I am confident that the original drafting suffices. Paragraph 21 of Schedule 1 was subject to significant engagement with sports governing bodies. Given that the Bill comes out of the government department that is also responsible for sport, we have been able to take extra care. The large number of relationships we have with this sector have been used to test the draft, and UKAD is content.
Several noble Lords mentioned various items which I will also refer to. My noble friend Lord Moynihan wanted me to confirm that athletes cannot rely on the right to be forgotten. That right is not unlimited, and if the personal data has been lawfully processed, and needed to be processed, then it would be there only if there was no overriding legitimate interest for the processing of that data. The controller would have to erase the personal data in these circumstances.
My noble friend also asked why we did not criminalise doping. None of those interviewed as part of the review were in favour of criminalising doping in sport. This was a unanimous view. For example, sports governing bodies expected that their internal investigations would be negatively affected by the criminalisation of doping in sport. It would remain quicker to deal with an instance using regulatory or disciplinary proceedings, which must be proved to the civil standard of the balance of probabilities rather than beyond reasonable doubt. Others noted that the current penalties were already sufficient to end a sporting career.
My noble friend also wanted to know whether doping at a sporting event covered spectators. This is a broad measure to cover processing in connection with measures designed to eliminate doping, for the purposes of providing information about doping or suspected doping. This could include processing of special categories, such as data relating to spectators or third parties providing information, but not only when necessary in connection with anti-doping measures.
The noble Lord, Lord Stevenson, brought up a good point, about why sport is unique when there are other areas that could also be included in this. Particular provision for sport is needed because sports bodies are an unusual type of regulator, where the regulation they carry out is capable of meeting a substantial public interest test yet they cannot rely on paragraph 9—there is no statutory recognition of their function nor is it beyond argument that enforcement of their rules benefits all members of the public, as opposed to the protection of their participants. Reliance on paragraph 9 for this processing would be too narrow, but important to remedy given the amount of sensitive data that might be processed by sports bodies in pursuit of their integrity functions. This is not something that we are aware would apply to other types of regulators.
I will move the government amendments for the reasons I have set out, and will of course be happy to meet noble Lords if they wish to discuss this point further.
First, I thank the noble Lords, Lord Stevenson and Lord Clement-Jones, for offering to stand in for me at the last Committee sitting. I was in my place for the first sitting, when we were expecting to reach this amendment, but regrettably had to travel to Australia on two occasions in the last month, only returning about four and a half hours ago. I apologise if I was not as lucid as I would like to have been, and I am very grateful to them for offering to assist if I had been absent again.
I will respond very briefly to a number of points raised. In response to the noble Lord, Lord Maxton, I took into consideration the question of what is a performance-enhancing drug and have suggested, in my amendment, that it should be a drug listed under the WADA—World Anti-Doping Agency—code as a performance-enhancing drug and part of the World Anti-doping Code. I know this is a contentious issue and that there is an issue about what should or should not be in that code. Indeed, I have many reservations about a number of the drugs in it, which I do not see as performance enhancing, but it is the best international definition at the moment for sport and is used by the International Olympic Committee.
As a result of the answer given to me by my noble friend, I have looked this up. It says:
“Use of recreational or social drugs is banned in sport”,
even though they may be,
“detrimental to sporting performance and result in a positive test result weeks later”.
It is not just drugs that enhance performance that are banned but those which do not enhance performance.
I have a great deal of sympathy with and support for the noble Lord, Lord Maxton. I said towards the end of my comments that I have reservations about the Bill applying to categories such as “the spirit of sport”—that is a direct quote—and where there may be harm to an athlete from a drug. I am focused on performance-enhancing drugs, which is why I wrote that into the amendment.
Secondly, I have to say to my noble friend—I may well be wrong, and she has had the advantage of being in the United Kingdom over the past three or four days and may well have spoken to UKAD during that time—that my clear understanding is that UKAD would like to go further than what is in the Bill drafted by the Government. If I am wrong, I will be pleased to reflect on what she has said, but I suggest that it would be worth while, given that my understanding differs from hers, that we have a meeting and encourage UKAD to be present, because my clear understanding is that it would like to go further and have the powers to which I referred in the Bill.
Finally, I turn to the somewhat surprising comment that my noble friend made about spectators at a sporting event being covered. Surely when we are looking at doping in sport it is not intended to cover spectators or anybody at a sporting event. The police, St John Ambulance, stewards—where does the catch-all end? My concern derives from that reflection: this is too general. If we are to be really effective in tackling and eliminating doping in sport, let us at least make sure that the legislation that we enact through due process in both Houses is as accurate and comprehensive as possible. In that context, I echo the comments made by both the noble Lord, Lord Clement-Jones, and the noble Lord, Lord Stevenson.
With the expectation of a further meeting and returning to this at a later stage, I beg leave to withdraw the amendment.
Committee (3rd Day)
Relevant documents: 6th Report from the Delegated Powers Committee, 6th Report from the Constitution Committee
Schedule 1: Special categories of personal data and criminal convictions etc data
45B: Schedule 1, page 116, line 35, leave out paragraphs 14 and 15 and insert—
“(1) This condition is met if the processing—(a) is necessary for the purposes listed in sub-paragraph (2), and(b) is necessary for reasons of substantial public interest.(2) The purposes mentioned in sub-paragraph (1)(a) are—(a) the arrangement, underwriting, performance or administration (or assisting in the arrangement, underwriting, performance or administration) of a contract of insurance or reinsurance;(b) the handling or administration (or assisting in the handling or administration) of a claim made under a contract of insurance or reinsurance.”
I am afraid it gets worse. Much more common in insurance is an indirect relationship with the data subject. The distribution of insurance products in the UK usually involves multiple data controllers, such as insurers, brokers, cover-holders and reinsurers. The claims settlement process may involve a number of other data controllers, for example loss adjusters, lawyers and doctors. Obtaining consent is problematic because each party in the product or claims chain who is not in direct contact with the data subject will be relying on another party to obtain consent on their behalf. Each GDPR data controller must be expressly named in consent documentation. That situation therefore would become horribly complex, and be inconsistent with the admirable aims of the impact assessment, without the derogations that I am asking for.
Giving an example of the future under an unamended Bill might help. One of the most popular small-farm insurances on the market in the UK is underwritten by an agency on behalf of 10 or more insurers. Farm policies contain several liability sections. If there is an injury on the farm, express consents on behalf of the injured party will have to be provided for the original broker, the underwriting agency, each of the insurers, the loss adjusters, and potentially all the reinsurers of the original insurers and the associated reinsurance brokers. Until that consent chain is in place, the claim cannot be fully processed. Does the Minister agree with me that this would be another highly unsatisfactory state of affairs?
Yet another unsatisfactory situation arises when a policy is bought by a third party. An example would be employer liability insurance—a compulsory class— where employees’ personal data needs to be supplied to assess the risk; here, the relationship is between the insurer and the employer. In the case of a claim, how does the Bill’s consent chain work? Does the Minister agree with me that we can and must do better in this Bill?
Although it is practicable to obtain the consent of the data subject in many cases, often it is not. Aggrieved claimants, for example, may not provide their consent for the insurer processing their personal data, as they simply want the corporate insured to pay their loss. They do not care whether or not it is covered by insurance. How is the insurer meant to act in these circumstances, or rate for this? I fear it would be a recipe to reduce competition and drive up prices for employer liability insurance, which is a compulsory class. This would certainly not be in the best interests of any policyholders or data subjects. These are market-wide issues and are not specific to any one type of insurance over another.
I feel in general that trying to shoehorn insurance business into GDPR article 9(2)(a)—the consent bit—is far from being in the public interest and that the public would be best served using a derogation under article 9(2)(g): that the processing is necessary for reasons of substantial public interest.
The amendments set out two alternative ways in which the issues might be tackled, while at the same time being wholly consistent with the GDPR. Under Amendment 45B, the new insurance paragraph would continue to sit within the “Substantial public interest conditions” subheading in Schedule 1, Part 2, as do the present paragraphs (14) and (15). The language is modelled on paragraph 6 of Schedule 1: the derogation for,
“Parliamentary, statutory and government purposes”.
It is effective at curing the problems with obtaining consent that I have described—and, indeed, those of withdrawing consent. It is consistent with the impact assessment and article 9(2)(g) of the GDPR. It is clear that the special category “personal data” can be used only for a necessary purpose and not in, say, a marketing drive, and the ICO and the FCA will patrol matters with their usual thoroughness.
The other amendments, together, are an alternative. They would allow insurers to continue to access and use health and criminal conviction data in another way. Amendment 46A widens the definition of insurance to bring more classes of insurance under the regime of Schedule 1, including, for instance, motor insurance and household insurance. This not only replicates the status quo but is also consistent with article 9 of the GDPR, given the twin watchdogs that I referred to: the ICO and the FCA.
Amendment 47A removes a new provision that presents a potential administrative minefield, did not form part of the DPA and is not needed for the purposes of the GDPR. Amendment 48A is a further amendment along the same lines, which widens paragraph 14 of Schedule 1 so that it covers all insurance business and extends the scope to cover criminal convictions. Amendment 50A is, I fear, a rather hurried bit of drafting, but is intended to allow the processing of third-party joint policyholders’ data. Properly drafted, this would allow consent to be given by one policyholder on behalf of another joint policyholder. In many cases, this is simply a pragmatic necessity and, again, I feel the amendment is consistent with not only the Government’s stated aims in the impact assessment but the GDPR. I beg to move.
There is another problem with consent. These days, when you go on any website, there is this great thing about cookies. The website will ask, “Do you mind that we’ve got all these cookies? And, by the way, I’m afraid the website won’t react properly if you do mind”. That is perfectly true; the cookies are necessary to drive the websites. Everyone clicks on the things or just lets them go, so the thing that is supposed to prevent websites spying on you is totally ineffective. That is a typical example of where we put consent into a Bill and all it does is irritate people—it does not do any good at all. So this may be a case where we are going too far on consent, which will just be a nuisance to everybody and will disadvantage some people.
Amendment 45B withdrawn.
46: Schedule 1, page 116, line 36, after “on” insert “relevant”
Amendment 46 agreed.
Amendments 46A to 47A not moved.
48: Schedule 1, page 117, line 5, at beginning insert “relevant”
Amendment 48 agreed.
Amendment 48A not moved.
Amendments 49 and 50
49: Schedule 1, page 117, line 14, after “of “” insert “relevant”
50: Schedule 1, page 117, line 16, leave out “sub-paragraph” and insert “definition”
Amendments 49 and 50 agreed.
Amendment 50A not moved.
51: Schedule 1, page 117, line 35, at end insert—
“15A(1) This condition is met if—(a) the processing is necessary for the purposes of—(i) automatically renewing a pre-GDPR insurance contract, or(ii) carrying out, or managing the expiry of, an insurance contract resulting from the automatic renewal of a pre-GDPR insurance contract,(b) the controller has taken reasonable steps to obtain the data subject’s consent to the processing of personal data necessary for those purposes in accordance with sub-paragraph (2), and(c) the controller is not aware of the data subject withholding such consent. (2) The steps described in sub-paragraph (1)(b) must have been taken—(a) in the case of a contract which automatically renews after a period of less than 10 months, on at least one automatic renewal of the contract in each period of 12 months that has ended since 25 May 2018;(b) in any other case, each time the contract has automatically renewed since 25 May 2018.(3) For the purposes of this paragraph, an insurance contract is automatically renewed if—(a) a new insurance contract between the same parties is made without the insured person taking any steps, and(b) the new contract provides cover which is the same as, or substantially similar to, the cover provided by the expired contract,and references in this paragraph to the automatic renewal of a contract include both the first automatic renewal on the expiry of that contract and subsequent automatic renewal originating with that contract.(4) For the purposes of sub-paragraph (3)(a), the new contract and the expired contract are to be treated as made with the same insurer if they are made with different insurers but arranged by the same intermediary.(5) In this paragraph—“insurance contract” means a contract of general insurance or long-term insurance;“insurer” means a person carrying on business which consists of effecting or carrying out insurance contracts;“pre-GDPR”, in relation to an insurance contract, means made before 25 May 2018.(6) Terms used in the definition of “insurance contract” in sub-paragraph (5) and also in an order made under section 22 of the Financial Services and Markets Act 2000 (regulated activities) have the same meaning in that definition as they have in that order.”
Amendment 51 agreed.
Amendment 52 not moved.
53: Schedule 1, page 118, line 19, leave out first “substantial”
Amendment 53 withdrawn.
Amendment 54 not moved.
Amendments 55 and 56
55: Schedule 1, page 120, line 37, after “Commons” insert “, a member of the National Assembly for Wales”
56: Schedule 1, page 121, line 1, at end insert—
“20A_ This condition is met if the processing—(a) consists of the publication of a judgment or other decision of a court, or(b) is necessary for the purposes of publishing such a judgment or decision.”
Amendments 55 and 56 agreed.
57: Schedule 1, page 121, line 3, leave out paragraph 21 and insert—
“21(1) This condition is met if the processing is carried out—(a) in connection with measures designed to protect sport in the United Kingdom from athletes taking performance enhancing substances listed in the World Anti-Doping Code which are undertaken by UK Anti-Doping (UKAD) or any successor body mandated by the Secretary of State as a non-departmental public body responsible for such objectives, or(b) for the purposes of national governing bodies of sports, sports clubs, institutions of higher education, schools or managers of sporting events providing information about individual athletes who may be in receipt of performance enhancing substances to UKAD or its successor body.(2) The reference in sub-paragraph (1)(a) to measures designed to protect sport in the United Kingdom from athletes taking performance enhancing substances include measures designed to identify or prevent doping including, but not limited to, requesting information about the gender of the data subject if thought to be relevant to the use of banned performance enhancing substances.(3) For the purposes of this paragraph—(a) data controllers include, but are not limited to, the UK Anti-Doping Agency, medical practitioners recognised by the British Medical Association, national governing bodies of sport, sports clubs, higher education institutions, schools and managers of sporting events;(b) data processors include but are not limited to all sports bodies and individuals appointed by the controller; and(c) data subjects are athletes competing in national junior and senior teams aged 12 years and above.”
By naming UKAD in the Bill we will enable it to deliver its current agenda of reforms, which it sees as essential to be a more effective body and with which I agree. This would, for example, extend the reach of UKAD across all sports in the UK covering all levels, including amateur as well as elite. Today it is restricted, given its resources, to work only through the relevant sports and numerous governing bodies and umbrella bodies that exist. It would enable it to demand information from national governing bodies of sport, the NGBs, including the records of treatment of athletes by athlete support personnel. It would enable it to require NGBs to provide UKAD with details of their members, through the provision of their full membership databases. It would enable it to demand production of communications devices, together with their password details and to reach out beyond the remit of governing bodies—for example into university gyms, renowned centres for a small minority of aspiring professional rugby players to add strength and body mass through the use of steroids and other banned performance-enhancing drugs. It would enable it to criminalise doctors who are outside the remit of governing bodies and found to be in breach of the GDPR process when they fail to provide personal data required by the GDPR regime under Clause 21(1) and (2) of the Bill. Finally, it would enable it to have the tools in place to manage a regulated assurance regime that checks on compliance, not just in governing bodies but across sport in the United Kingdom. All could be determined as necessary by UKAD in undertaking its duties if it is, indeed, a controller in this context.
My noble friend the Minister may, in responding, point out that the clause should include bodies wider than just the processes conducted under measures set by UKAD, and that my wording may be deficient in that respect. I understand this opinion, which has been aired by some governing bodies of sport, but if that is the Minister’s view, and it finally proves convincing, a change to my wording could address that, as there are, indeed, other organisations that we may regard as additional to UKAD in the fight against doping. Some examples might be sports which, while working with UKAD in some capacity, have their own related doping rules, such as the FA and the RFU. While it should be pointed out that both the FA and the RFU govern Olympic sports and are therefore fully covered by the World Anti-Doping Agency, which provides the framework for all UKAD’s operations, policies and codes, I believe that UKAD should have ultimate responsibility for accrediting all British anti-doping programmes, and my amendment seeks to achieve this objective.
International federations may apply their own measures when running events in the UK. This might be UK-based federations, such as the Commonwealth Games Federation, or international federations of sport—or, indeed, the International Olympic Committee or the International Paralympic Committee—when they are running events here. Again, I believe that UKAD should have overall authority to determine whether their programmes, when operating in the UK, are to a standard that fulfils their criteria. We should not seek to bring any event to this country with public or lottery funding, nor should we support any international event on these shores, funded either through lottery funding or public money, which does not meet the standards and procedures set and agreed by UKAD, as the sole recognised body responsible for the fight against doping in sport in the UK. Otherwise, we risk allowing British or international sports organisations to hold events that could circumvent what we, as Parliament, recognise to be the minimum standards in the fight against cheating in sport.
My amendment makes reference to performance-enhancing substances listed in the world anti-doping code.
Amendment 57 withdrawn.
Amendments 58 to 60
58: Schedule 1, page 121, line 3, leave out “carried out” and insert “necessary”
59: Schedule 1, page 121, line 4, leave out “in connection with” and insert “for the purposes of”
60: Schedule 1, page 121, line 5, leave out “supervision of a body with responsibility” and insert “responsibility of a body or association that is responsible”
Amendments 58 to 60 agreed.
Amendment 61 not moved.
Amendments 62 and 63
62: Schedule 1, page 121, line 9, at end insert “or association”
63: Schedule 1, page 121, line 11, at end insert—
“21A(1) This condition is met if the processing— (a) is necessary for the purposes of measures designed to protect the integrity of a sport or a sporting event,(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and(c) is necessary for reasons of substantial public interest.(2) In sub-paragraph (1)(a), the reference to measures designed to protect the integrity of a sport or a sporting event is a reference to measures designed to protect a sport or a sporting event against—(a) dishonesty, malpractice or other seriously improper conduct, or(b) failure by a person participating in the sport or event in any capacity to comply with standards of behaviour set by a body or association with responsibility for the sport or event.”
Amendments 62 and 63 agreed.