Amendment 29

Automated Vehicles Bill [HL] - Report – in the House of Lords am 5:47 pm ar 6 Chwefror 2024.

Danfonwch hysbysiad imi am ddadleuon fel hyn

Baroness Bowles of Berkhamsted:

Moved by Baroness Bowles of Berkhamsted

29: Clause 95, page 68, line 33, leave out “does” and insert “must”Member’s explanatory statementThis amendment seeks to change a presumption that a provision relating to information disclosure does not contravene data protection legislation into an active requirement that it should not.

Photo of Baroness Bowles of Berkhamsted Baroness Bowles of Berkhamsted Democratiaid Rhyddfrydol

My Lords, I have tabled four amendments which constitute this group. There are two interacting issues: public interest and commercial interest. It is clear that where safety, human lives or participation are at risk, that has to win over commercial interest. This is what we are dealing with in these amendments. I have made some suggestions because I do not really understand what the legislation is saying. Instead of a speech, and because my voice is dodgy, I am just going to read out the subsection and explain what I do not understand.

Clause 95(2) says:

“The provision does not require or authorise any disclosure, obtaining or use of information that … contravenes data protection” or is prohibited under something to do with the Investigatory Powers Act. What does “the provision does not” mean? I have changed it to say that the provision —which would come forward from regulations—“must” not authorise things that would contravene data protection legislation. This might be similar to what we used to call a “notwithstanding” clause—notwithstanding what the provision says, it actually means something else, or it does not mean what it says. I think it would be better if it said “must”.

If it is a contravening provision—a notwithstanding type—meaning that the regulation might say one thing but that thing is not allowed because it is forbidden in another piece of legislation, at what point does this come to light in the request for information? Is the requester of the information obliged to make it clear: “Oh well, we do not need this bit”, or does the person who is requested to give the information have to plead: “Oh, I do not have to answer that”? I do not know the answer to those questions. I do not know whether this is a notwithstanding clause or whether the constraint will be clear at the point at which the evidence or information is being sought. I wait to hear what the Minister tells me it means.

Amendment 30 would add intellectual property rights to the list of legislation which must not be contravened. As Clause 95 deals quite a lot with commercial rights and the use of data and things that can be asked for under investigatory powers, why can we not put in intellectual property rights, which is another part of the family, if you like? I am still having some interesting discussions with the officials as to whether or not it is needed. I think it is, they think it is not. Maybe we can get some clarity by Third Reading. That is the basis of my second amendment.

My third amendment is to Clause 95(3), which says:

“But the provision is to be taken into account in determining whether the disclosure, obtaining or use of information would contravene the data protection legislation”.

I do not quite know what it means when a provision starts with “But”. It might be another notwithstanding—in which case this is a notwithstanding clause on a notwithstanding clause. I am not quite sure where two notwithstandings leave us.

Does this mean that the provision can have in it new things that it then deems can be taken into account? Is it without limit or does it regard a provision that is cast within an obligation there might be under some other legislation, as there is in data protection legislation —that is, you can have new reasons in the public interest as to why something might be needed? Does the constraint apply or not? From what it says here, I cannot tell. It looks to me as if a provision can be made and then taken into account when interpreting it. I just do not see how that works.

I cannot construe this any better than I have attempted to do—and I am not quite a beginner in construing legal things. I may wish to test the opinion of the House on this clause because it is really quite confusing. If it verges on that broader side, we would be better off without it. Provisions can be made in the public interest under all kinds of legislation; you can do it under data legislation and intellectual property legislation. There are times when the public interest will prevail. So I do not see why we need this clause there at all.

My final amendment simply suggests that Clause 95, which is titled “Disclosure of information: interaction with external constraints”, should be inserted into the list at the start of Clause 96, which is headed “Crown application” and says that the provisions in Sections 42, 73 and 88 “bind the Crown”. To some extent, Clause 95 is mainly relevant to Sections 42, 73 and 88; it therefore seemed logical to me that it should also be listed in Clause 96.

This is not the grand speech that I was going to make, it is just why I cannot understand what is written here. What I think about it will now depend entirely on what the Minister is able to tell me—in particular, about these clauses, which may or may not be “notwithstanding” clauses. I beg to move.

Photo of Lord Liddle Lord Liddle Shadow Spokesperson (Transport)

My Lords, these are important issues that the noble Baroness, Lady Bowles, has raised. She has, with her characteristic acuity, asked lots of penetrating questions about what the proposed legislation actually means. For the part of the Official Opposition, we will listen carefully to what the Minister says in reply but, if we are not satisfied, we will support the noble Baroness in her testing of the opinion of the House.

Photo of Lord Davies of Gower Lord Davies of Gower Parliamentary Under-Secretary (Department for Transport)

My Lords, I begin by briefly clarifying a point that I made earlier in response to a question from the noble Lord, Lord Tunnicliffe, which I am afraid I did not hear correctly. I should have responded by saying that the right legislative vehicle for the Road Safety Investigation Branch remains under consideration.

I thank the noble Baroness, Lady Bowles, for her insightful and challenging remarks. I reiterate that we take the protection of personal data and intellectual property very seriously. I can confirm that the Bill does not seek to replace or change existing legislation on either personal data protection or intellectual property rights. The Bill does not enable us to contravene this legislation, whether domestic or under treaty obligations. Indeed, this would be beyond the scope of the Bill, which is confined to creating an effective safety framework for self-driving vehicles.

Although that may necessitate the use and sharing of information, this will not be done indiscriminately. We will do so only for specified public interest purposes because safety and security must come first. These purposes would be considered and developed with stakeholders. They would be subject to consultation and would be laid in the House before coming into force. This will provide multiple opportunities for input to, and scrutiny of, the proposals. Indeed, we are required by law to consult the Information Commissioner’s Office if our regulations permit or require the sharing or use of personal data.

As colleagues have highlighted today and in our meetings, it is not just the application of the law that is important but the understanding of it. That is why we are consulting the ICO in the development of specific guidance for the self-driving vehicle industry; that guidance will support the interpretation and understanding of existing personal data protection legislation in an industry-specific context. I hope that this provides some reassurance before I turn to the amendments.

On Amendment 29, the noble Baroness is right to understand Clause 95(2) as a clarifying clause or a “notwithstanding” provision, as she has referred to it. I am advised that the correct legislative form is to use “does” rather than “must”, but the effect is the same. The clause ensures that the Bill is consistent with data protection legislation, and is written using standard drafting. Its effect is that recipients of information must continue to ensure that their processing complies with data protection legislation and the Investigatory Powers Act 2016. The clause provides confirmation that these obligations continue to apply to provisions made in or under the Bill.

To be clear, the Bill does not change existing data protection legislation. However, the UK general data protection regulations do allow new purposes for the processing of personal data to be set out in law. This law must meet an objective of public interest and be proportionate to the legitimate aim pursued.

If a legal obligation to process personal data is set out in regulatory provisions, it will be taken into account when considering whether there is a lawful basis for processing the data. This brings me neatly to Amendment 31, which proposes the removal of Clause 95(3). This subsection clarifies that new legal obligations to process data will be taken into account when determining whether data protection legislation has been contravened.

As I have already highlighted, it is a requirement of the UK GDPR that a legal obligation to process data be laid down in law. This law must meet an objective of public interest and be proportionate to a legitimate aim. Regulations that comply with this requirement are neither waivers nor exemptions from the UK GDPR but are part of the UK GDPR system. For the sake of clarity, the phrasing

“the provision is to be taken into account” does not mean that the provision alters the data protection legislation.

I move now to Amendment 30. The addition of “intellectual property rights” to Clause 95(2) would have the effect of excluding all such rights from the power to make information sharing regulations. It is common for intellectual property law to allow information sharing for specific reasons that are in the public interest. The power to make regulations that override duties of confidence or create exemptions from intellectual property rights is reflected in Clause 95(4). The suggested amendment would restrict the use of these powers in relation to information protected by intellectual property rights, even where this would be in the public interest. There is no justification for such a restriction in relation to this Bill.

I turn finally to Amendment 32. It would serve no purpose to provide that Clause 95 binds the Crown. This is because the clause does not contain any obligations or restrictions that could bind any person, including the Crown. The clause merely defines the scope of restrictions and obligations in other provisions of the Bill, including those which do bind the Crown. Therefore, the amendment would have no effect.

I am conscious that these are highly technical matters in which the noble Baroness has particular expertise. Once again, I am grateful for her engagement in this area and hope these explanations offer her some reassurance.

Photo of Baroness Bowles of Berkhamsted Baroness Bowles of Berkhamsted Democratiaid Rhyddfrydol 6:00, 6 Chwefror 2024

I thank the Minister for his explanations. I am a little further forward, in that I understand Clause 95(2). I am not sure that I agree with what he said would be the effect of adding “intellectual property” to a new paragraph (c), but, for now, I am prepared to continue conversations with officials so that, between us, we can thrash out whether we understand one another on the point, or, if I am right, the Minister would have an opportunity to do something about it. I think we both want it to be right, it is just that I have different interpretations there.

I think the Minister said about Clause 95(3) that, where it says the provision itself

“has to be taken into account”,

it will be a provision that is subject to the constraints under the GDPR, and so would have to fulfil the tests in the GDPR, if I have understood that correctly. The Minister is nodding. Therefore, it is not a free-for-all, and new ones cannot be invented without that anchor. In general, I am satisfied with that. I am sure that, maybe, this will have a little more investigation as the Bill goes further in the other place, just to make sure that is the correct interpretation. On that basis, I will withdraw the amendment.

Amendment 29 withdrawn.

Amendments 30 and 31 not moved.

Clause 96: Crown application

Amendment 32 not moved.

Clause 97: Regulations