Data Protection Bill [HL] — House of Lords, 2018-05-14
Topic: Civil Rights
Thomas Ashton (Conservative, Centre-right): My Lords, this group of Commons amendments relates primarily to the enforcement powers available to the Information Commissioner. This is one area where, after the Bill originally left your Lordships’ House, events have influenced the Government’s thinking. The Information Commissioner’s investigation into Cambridge Analytica is unprecedented in both its scale and its complexity. It has, necessarily, pushed the boundaries of what the drafters of the Data Protection Act 1998, and the parliamentarians who scrutinised it, could envisage While recognising that the Bill already expands and enhances the commissioner’s ability to enforce the requirements of the data protection legislation in such circumstances, the Government undertook to consider whether further provision was desirable in light of the commissioner’s recent experience. Following extensive conversations with the commissioner and others, we concluded that such provision was indeed desirable. The amendments made in the other place would strengthen the commissioner’s ability to enforce the law while ensuring that she operates within a clear and accountable structure. I want to give five examples in particular First, Commons Amendment 64 would allow the commissioner to require any person who might have knowledge of suspected breaches of the data protection legislation to provide information. Previously, information could be sought only from a data controller or data processor. This could be important where, for example, a former employee had information about the organisation’s processing activities or if an organisation had gone into administration Secondly, Commons Amendment 70 would allow the commissioner to apply to the court for an order to force compliance where a person failed to comply with a requirement to provide information. Organisations that might previously have been tempted to pay a fine for non-compliance instead of handing over the information will now find themselves at risk of being in contempt of court if they do not comply Thirdly, Commons Amendments 67 and 87 would allow the commissioner to require controllers to comply with information or enforcement notices within 24 hours in some very urgent cases, rather than the seven days the current law provides for. Amendment 79 would allow the commissioner in certain circumstances to issue an assessment notice that can have immediate effect. The amendments would allow the commissioner to obtain information about a suspected breach or put a stop to high-risk processing activities promptly and effectively. They will also allow her to carry out no-notice inspections without a warrant in certain circumstances Fourthly, Commons Amendment 81 criminalises the behaviour of any person who seeks to frustrate an information or assessment notice by deliberately destroying, falsifying, blocking or concealing evidence which has been identified as being relevant to the commissioner’s investigation Finally, we have also taken this opportunity to modernise the commissioner’s powers. Storing files on an office PC is rapidly becoming a thing of the past. Commons Amendment 210 would enable the commissioner to apply for a warrant to access material which can be viewed via computers on the premises but which is actually held elsewhere, such as in the cloud.