Lord Bellamy:

Moved by Lord Bellamy

1: After Clause 31, insert the following new Clause—“Right to erasure of personal data(1) Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (right to erasure) is amended in accordance with subsections (2) and (3).(2) In paragraph 1, after point (f) insert—“(g) the personal data have been processed as a result of an allegation about the data subject—(i) which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),(ii) which has been investigated by the controller, and(iii) in relation to which the controller has decided that no further action is to be taken.”(3) After paragraph 3 insert—“4. For the purposes of paragraph (1)(g), a person who has made an allegation about a data subject is a “malicious person” in relation to the data subject if the person—has been convicted of an offence specified in column 1 of the table in paragraph 5 in relation to which the data subject is a person specified in the corresponding entry in column 2 of that table, or is subject to a stalking protection order under section 2 of the Stalking Protection Act 2019 or section 8 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) made to protect the data subject from a risk associated with stalking (see section 2(1)(c) of the 2019 Act and section 8(2)(c) of the 2022 Act).The table is as follows— OffenceData subject1. An offence under section 2 of the Protection from Harassment Act 1997 (offence of harassment: England and Wales)A person mentioned in section 1(1)(a) or 1(1A)(a) of that Act2. An offence under section 2A, 4 or 4A of the Protection from Harassment Act 1997 (other harassment and stalking offences: England and Wales)The person against whom the offence is committed3. An offence under section 8 of the Stalking Protection Act 2019 (offence of breaching stalking protection order etc)A person who the stalking protection order was made to protect from a risk associated with stalking (see section 2(1)(c) of that Act)4. An offence under section 42 of the Armed Forces Act 2006 as respects which the corresponding offence under the law of England and Wales (within the meaning given by that section) is an offence specified in entry 1, 2 or 3 of this tableA person specified in column 2 of the entry in which the corresponding offence is specified5. An offence under section 70 of the Army Act 1955 or Air Force Act 1955 as respects which the corresponding civil offence (within the meaning of that Act) is an offence specified in entry 1 or 2 of this tableA person specified in column 2 of the entry in which the corresponding civil offence is specified6. An offence under section 42 of the Naval Discipline Act 1957 as respects which the civil offence (within the meaning of that section) is an offence specified in entry 1 or 2 of this tableA person specified in column 2 of the entry in which the civil offence is specified7. An offence under section 39 of the Criminal Justice and Licensing (Scotland) Act 2010 (asp 13) (stalking offences: Scotland)The person against whom the offence is committed8. An offence under section 1 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) (stalking offences: Northern Ireland)The person against whom the offence is committed 9. An offence under section 13 of the Protection from Stalking Act (Northern Ireland) 2022 (c. 17 (N.I.)) (offence of breaching order: Northern Ireland)A person who the stalking protection order was made to protect from a risk associated with stalking (see section 8(2)(c) of that Act)10. An offence under Article 4 or 6 of the Protection from Harassment (Northern Ireland) Order 1997 (S.I. 1997/1180 (N.I. 9)) (harassment offences: Northern Ireland)The person against whom the offence is committed”(4) After section 13 of the Data Protection Act 2018 insert—“13A Meaning of “relevant offence” for purpose of right to erasure(1) The Secretary of State may by regulations amend the table in Article 17(5) of the UK GDPR.(2) Regulations under this section are subject to the affirmative resolution procedure.””Member’s explanatory statementThis clause adds a new ground which data subjects can use to obtain erasure of personal data which has been processed as a result of an allegation about the data subject by a person who has been convicted of a relevant offence or who is subject to a stalking protection order protecting the data subject.

My Lords, I have two matters to address. The first matter is the position on devolution. The majority of the measures in Part 1 of the Bill apply to England and Wales. Clause 18, which relates to the issuing of guidance about victim support services, engages the legislative consent process. The Senedd did not grant legislative consent for this measure. Accordingly, the Government will table in the other place an amendment so that this clause applies to England and reserved matters in Wales only, and consequently removes the requirement to consult Welsh Ministers before issuing guidance.

Part 3 of the Bill applies UK-wide, and I can confirm consent has been granted by the Senedd and the Scottish Parliament. However, the process has not yet concluded in Northern Ireland. In the interest of ensuring the legislation is passed and these vital measures come into force across the UK, we will need to proceed to legislate for all, including Northern Ireland.

Part 2 of the Bill applies to England and Wales, and engages the legislative consent process for the appointment of the independent public advocate. The Bill contains a measure which requires the Secretary of State to consult Welsh Ministers before declaring a major incident in Wales and appointing an advocate. The Senedd did not grant consent for this part of the Bill. We continue to believe that this is an appropriate level of involvement for the Welsh Government and that it respects the legislative competence of the Senedd. Having considered the Senedd’s position, the United Kingdom Government have decided that, in this instance and given the context of major incidents, we will proceed without the Senedd’s consent. It would not be acceptable for the independent advocate provisions not to apply in Wales. It is vital that these measures apply to—

Can the Minister explain why the Senedd is refusing to sign up to this agreement? It might be of interest to the House to know why.

I am afraid I am not in a position to say why the Senedd has refused consent; only the Senedd can say. The original issue was whether it should have some kind of veto over the appointment of the independent public advocate, or whether it should simply be consulted. One could infer that it was not satisfied with the requirement to be consulted and wanted a stronger role. That is an inference I draw as I have no inside information on the point. In any event, it is vital, in the Government’s view, that these measures apply to England and Wales to bring the benefit to all victims within England and Wales. So that is the devolution position.

I do not know whether, in this procedure, it is permissible for me to answer the question which the Minister was not in a position to. If I might explain, it was hoped that in the spirit of the United Kingdom you might be able to agree on a lawyer. There are an awful lot of lawyers and normally parties can agree, but, as the Welsh Assembly sees it, for some extraordinary reason the Government refused to do what normal litigants do, which is to agree on a lawyer. It stuck on that point because it thought it showed how unworkable the union is becoming if you cannot even agree on a lawyer.

Quite frankly, there are lots of lawyers in here. I do not know whether, if we put forward everyone’s name, perhaps the Senedd could agree to someone who is already in the House of Lords.

I think this is not a very useful debate to pursue at this stage of the proceedings. Without going any further, I am under the impression that it is not only the question of agreeing on a lawyer, but whether a standing public advocate should be appointed in the first place. I suggest that is something we should leave aside for today’s purposes.

My second duty is to speak to Amendment 1 in my name on the Marshalled List. I thank the noble Baroness, Lady Morgan of Cotes, and Stella Creasy, a Member of Parliament in the other place, for the amendments they have tabled on this issue, and their engagement with myself and officials in this area. The amendment concerns what to do when there is a malicious complaint to social services and the procedure for removing that complaint, following the conviction of the complainant and the finding that the complaint was malicious.

Amendment 1 will insert into Article 17(1) of the GDPR—in fact, it inserts it into the relevant European directive so we have an unusual example of the UK Government directly amending European legislation—a new Part 2 ground which creates the right for certain victims who are data subjects to request deletion of personal data when the following two circumstances occur: first, when an allegation has been made by a person who has been convicted of relevant criminal offence against the data subject, or the person is subject to a stalking protection order made to protect the data subject from a risk associated with stalking; secondly, following an investigation by the data controller, it has been decided that no further action has to be taken in relation to the allegation.

The relevant criminal offences listed in the amendment are the offences of stalking and harassment against a victim. A power is also taken to update this list by regulations made using the affirmative procedure, should further offences be required to be included in the future. This amendment will provide a specific new ground for victims of stalking and harassment for the deletion of false allegations made about them, and support them to prevent the further distress that retaining this information may cause.

To ensure that the data controller has an important reason to retain the data, the exemptions under Article 17(3) of the UK GDPR will apply. This allows the data controller to refuse the re quest for a limited list of reasons, including whether processing is necessary for compliance with a legal obligation or the performance of a task carried out in the public interest, which could capture refusal for safeguarding reasons. However, data controllers must provide reasons for any refusal and inform data subjects of their right to complain to the Information Commissioner’s Office. We will ensure that guidance, including on child safeguarding, is updated so data controllers understand how the new ground is intended to work. We will also update the victims’ code so that victims are aware of their rights around data erasure.

I therefore commend this amendment to the House, and I hope that what I have said will permit the noble Baroness, Lady Morgan, not to press her Amendment 2 on the marshalled list.

My Lords, it is a pleasure to speak on this very important Bill. I am delighted that it covers so many vital issues and will proceed, we hope, to Royal Assent before Parliament is prorogued.

I shall speak to Amendments 1 and 2. I thank my noble friends the Minister and Lady Barran, and their officials, for their engagement on this matter at some speed. I am delighted that Stella Creasy is here to listen to the debate. I thank the noble Baroness, Lady Brinton, my noble friend Lady Finn and the noble Lord, Lord Russell, for their support, as well as the Opposition Front Bench.

Politics is the “art of the possible”, as the important quote goes. The Government have now accepted, after resisting for many months, the principle behind Amendment 2, which we repeatedly tabled in this House at various stages of the Bill. As we have heard, the law should be updated to recognise that, in cases of stalking and harassment, one of the things that the stalker or harasser can do to prolong their victim’s agony is to make a false and malicious allegation which stays on the record, and data controllers hide behind their rights in not deleting it even when the allegation has been found to be both false and malicious.

I recognise the progress that has been made in the tabling of Amendment 1. As ever, of course, the devil is in the detail. As my noble and learned friend Lord Bellamy has said, there are still grounds under Article 17(3) of the GDPR on which a data controller could refuse to delete the data. I really welcome his clear commitment that there needs to be strong guidance to the ICO and data controllers in the Explanatory Notes to the Bill, and also provisions in the victims’ code. The danger with all this is that we still leave the burden on victims to argue for the data to be erased, and the power remains with the data controller. That is what worries me about those exemptions in Article 17(3).

In that guidance, the data controller must be told that they need to set out substantive grounds for refusing any request for erasure of the data. We also hope that the Government will set out scenarios in which those exemptions in Article 17(3), provided for in law, cannot be used in cases where data records have been created as a result of malicious conduct.

Having said all that, I recognise where we are at this time in this Parliament. I will be interested to hear what other noble Lords might say in this short debate and what the Minister might say in summing up. I recognise and thank my noble and learned friend for the progress that he has made on this issue.

My Lords, I will speak very briefly. I pay tribute to the noble Baroness, Lady Morgan, for her persistence and skills in negotiating with her own party, which is possibly easier than doing it from outside the party.

I stress the absolute importance of giving crystal clear guidance. The occupation of data controller is not necessarily high on the list of most of us as a potential career. I suspect that it is not the most exciting part of many bureaucracies. I also suspect that it is an area where one follows the rulebook, or what one perceives to be the rulebook, particularly closely. I suspect that the ability of individuals to feel that they have the power to exercise their own judgment is somewhat limited and probably not encouraged. It is incredibly important that there is absolutely no doubt in the mind of even the least curious or the most obdurate data controller as to what is and is not acceptable in terms of erasure.

Other than that, I thank the Government for having thought about this carefully, and for having responded. I hope that as a result of this, the data controller in Waltham Forest who is making Stella Creasy’s life rather difficult will at least read this debate or be told of it and will rethink his or her decision to not erase the data.

It is my privilege to follow both the noble Lord, Lord Russell, and the noble Baroness, Lady Morgan. I signed this amendment and continue to offer my support. I echo and agree with everything they said.

I have slight concerns that this is not just an issue about the data controller; it is also about social work practice. That really worries me, because there is a mindset that says that if anyone makes a complaint, we have to have it on the record just in case for the future. I hope that the government amendments are sufficient to provide an answer, but should we discover either that Stella Creasy’s case is not dealt with or that there are others, I put all future Governments on notice that there is a team in this House that will return to the subject.

I will make just one point to the Minister: will the direction and guidance given to the data controller say that the information being found to be vexatious will be an automatic reason to delete it? As soon as something is found not to be true, it should be deleted and the data controller should have the obligation to remove it straightaway.

My Lords, I welcome this amendment. Congratulations all round are due to the noble Baronesses, Lady Morgan, Lady Finn and Lady Brinton, and the Ministers. I take issue with what the noble Lord, Lord Russell, said: negotiating with your own party is every bit as challenging as negotiating from outside—I speak from experience—but this is a very good example of the point of the House of Lords. When we do this sort of work, we can take an issue that is clearly an injustice, as my honourable friend Stella Creasy has experienced, along with others—mostly women—and persuade the Government to take action. That is the right thing to have done.

My Lords, there is little I can add. In preparing the guidance, the Government will take into account all the points, particularly those made by my noble friend Lady Morgan. The word “automatic” may be a slightly difficult word in the guidance, but I anticipate that it will be made extremely clear that in these circumstances the data controller would have to provide very clear reasons for not deleting the complaint concerned. I hope that will be covered comprehensively in government guidance, whichever Government are in power.

Amendment 1 agreed.

Amendment 2 not moved.