---

European Union (Amendment) Bill

I confess that I am thoroughly confused about what the noble Lord, Lord Hunt of Wirral, wants to achieve. He is worried that if data passes out of our hands it will not be protected by the proper data protection safeguards, but the precise purpose of the two provisions against which he has tabled amendments is to establish common data protection rules. First, there are specific provisions under the common foreign and security policy. Secondly, the provision that Amendment No. 38 targets is the data protection rules, which would apply normally within the European Union. If we are worried that there will not be proper data protection safeguards, surely we want to make sure that there are common high standards. I found the noble Lord’s account really rather confusing. On the one hand, he deplores, as we all do, the loss of data that we have experienced in the UK. I happen to believe that the UK is not the only member state where this has happened; we have just had rather more publicity. We have to try to make the member states not only pass the laws but live up to them. That means having those strong independent authorities. I remind the noble Lord that those independent authorities are the national data protection supervisors—in our case, the Information Commissioner. This is made clear in paragraph 7.45 of the report from the EU Committee. That makes clear that the independent authority is not some Euromonster. Our own Richard Thomas will monitor compliance. We need the rules and we need them to be respected. If these amendments aim at having no common data protection rules, we are indeed at risk of not having proper protection. There is some concern that we need to make sure that there is clarification on the scope and purpose of the specific rules for common foreign and security policy, so that they do not then apply to things that should properly be covered by the other clause. I was reassured when the Minister for Europe told the Lords EU Committee that, for instance, a passenger name record agreement, which was agreed with the United States last year precisely on a common foreign and security legal basis—which was shocking—in future would not be agreed, so the specific rules for common foreign and security policy would not apply to data sharing on things such as air passenger data. There will be a lot more coming down the track in that vein, which reassures me to some extent. You would expect me to say no less because the CSFP rules will not be subject to the codecision or assent of the European Parliament, so we are cut out of the picture on the those rules. There is some danger that if the member states use them as the way to circumvent the normal codecision, we would have to look to the national parliaments to be especially vigilant—perhaps more vigilant than they normally are. I do not think that the noble Lord is on the right track with these two amendments. We need common rules and need them to be enforced properly, which they are not always at the moment. In fact, I believe that the European Commission is contemplating infringement proceedings against the UK, not least because the Information Commissioner does not have the powers and resources that he needs. But we need those common rules and we need them to be properly enforced everywhere, including by our own Information Commissioner. Something that may emerge in future is the requirement to notify a breach of that personal data, which I would welcome. That is perhaps for the future. I hope that the noble Lord might rethink his approach on this, because we need the safeguards of common data protection laws.