Chris Bryant and Eleanor Campion.

Q1 The Chair: Welcome to the House of Lords European Affairs Select Committee. This afternoon we are returning to a subject that we looked at in detail last year: the UK-EU data adequacy arrangements.

For anyone watching who is not familiar with the background, data exchanges between the UK and the EU are greatly facilitated by having adequacy status under two EU regulations: the general data protection regulation, GDPR, and the law enforcement directive. They were set to expire in June of this year, which is why last year, in March, we held a short inquiry to look into the issues arising from that and the implications.

In the end, we could not do a formal report because we were cut off by the general election, but we wrote a full letter to the incoming Government in October, and we got a very helpful reply from the Secretary of State in November. We wanted to return to it because, although the deadline has been pushed back, they are still there, and this is a crucial set of decisions with some quite wide-ranging implications.

All that said, I am delighted to have with us the Minister of State, Sir Chris Bryant MP, Minister of State in the Department for Science, Innovation and Technology, and in the Department for Culture, Media and Sport. He is accompanied by Eleanor Campion, the deputy director at DSIT. There is no one better, therefore, to help us with the issues that are still outstanding.

I might just note, finally, that the Data Use and Access Bill is under very active consideration between our two Houses right now. I suggest that we try to keep the questions and answers to the UK-EU aspects of this if we can this afternoon; that is our remit here.

With that, thank you both for coming. Just to kick things off, when you came into office, you had this data adequacy status potentially expiring within the year. It is now slightly longer. Could you start off by telling us about the kind of engagement you have had with the commission over that time, and how that leaves you thinking about the implications? Then we will develop all the details in further questions.

Chris Bryant: Primarily, I would separate the engagement on this specific issue from all other EU-UK reset discussions, because this is a unilateral decision, in the end, that is made by the EU on its data adequacy expectations of other countries, just as we would have a unilateral decision on the data adequacy of other countries with whom we would want to allow data exchange.

That has primarily been the work of Peter Kyle as the Secretary of State for Science, Innovation and Technology. There has been a succession of different meetings with the old commission and with the new commission, because it is not only that the Government have changed here, but that the Government have changed in Brussels as well. Those have been very warm and friendly discussions, and we have at all times wanted to honour their right to make their unilateral decision.

At the same time, we obviously wanted to talk them through our proposals, because one of the difficulties was that there was going to be a data Bill—that died. There was then going to be a second data Bill—that, too, died at the general election. Then, we came in with the intention of bringing in another data Bill. Of course, the commission wanted to look at what that was going to be like.

I do not think there are any matters in the data Bill as it is which should be problematic for adequacy in any shape or form, though, in the end, it is a decision for them. However, of course, they have been a little bit nervous about considering the data adequacy of the UK at a time when a Bill was in flight. So, I am keen to get the data Bill through to Royal Assent. If there are any Members of the committee who could assist us in getting the Bill to Royal Assent, I would be eternally grateful.

The Chair: I believe there are one or two who fit into that category.

Q2 Baroness Suttie: Can you tell us a little about which policy options you looked at in relation to the UK’s data adequacy status with the EU?

The Chair: Do you mean things we thought we might do which we then decided not to put in the Bill, or something like that?

Baroness Suttie: Which options you looked at.

Chris Bryant: First, I took responsibility for this in opposition, so I was dealing with the data Bill in the previous Conservative version before the general election, and the new version. I think there was a perhaps a view from some people in DSIT before the general election that the Bill should somehow or other prove that there was a Brexit dividend. My feeling was that this was not a particularly useful route to go down, so our version of the Bill is slightly more accommodating than the previous version. However, there is nothing that we considered that we should or should not put in because of the EU data adequacy issue; I was fairly confident that we would be able to meet their requirements.

Q3 Lord Stirrup: Thank you, Minister. It is clear that you have set out the reasons why the commission extended the whole procedure by six months, because of the Bill that was then in being. I wonder if you could tell us what sort of discussions you had with the commission prior to it reaching that decision.

What sense did you get, if you can share with us, of the view the commission was taking on the UK’s position as previously set up before the Bill, and therefore, what sort of risks might have been associated with the Bill going forward? In other words, what was its position at that stage? It said that it wanted you to delay for six months because it wanted to see what happened. Supposing there had not been a Bill, do you have a sense of what its thinking would have been at that point as to the UK’s arrangements?

Chris Bryant: If there had not been a Bill, the law would remain as the law was when data adequacy was last granted. So, I can only presume that that would have been all right, though that might leave you with the question of whether there should be an end time when data adequacy expired.

I was not in any of the meetings that Peter Kyle had with the previous or the new commissioner. I have had some meetings with other commissioners, but in all the readouts I have seen, the best way I would describe it is “cautiously optimistic”.

Lord Stirrup: And was there no sense at that stage that there was a divergence of view growing between the UK and the EU?

Chris Bryant: No. If we had wanted to completely scrap GDPR or if we had wanted to completely scrap human involvement in automated decision-making processes and things like that, then I think the EU would have said, “hang on”, but that was never a route that we were ever going to consider.

I think we have always wanted to say that the UK has been at the forefront of developing a lot of the protections in relation to the use of data, which the EU has wanted to follow as well.

Q4 The Duke of Wellington: Good afternoon, Minister. What steps do you think might need to be taken between now and when the EU reaches its decision? Is there anything that you think will be necessary to address so that it makes the right decision, from our point of view?

Chris Bryant: We need to get the data Bill through to Royal Assent, if I could say that again. There is another process. In order to get the extension to 27 December, member states have to vote before 27 June to be able to secure that. But, as I say, anything that we can do to get the Bill through to His Majesty and out of the Palace in a timely fashion, bearing in mind all the needs for due scrutiny by both Houses, is the single thing that would assist us most in getting to data adequacy, but I am pretty confident that we will get there.

The Duke of Wellington: So, there are no other steps, once the Bill passes, that you think we will need to take to get the right decision?

Chris Bryant: No. The EU has already started its process, in December last year. It knows the Bill, has read the Bill and is aware of all the amendments. I do not think there have been any amendments in relation to these elements that it has raised as potentially problematic with us.

The Chair: In our letter we thought that perhaps a greater risk on the data adequacy front was from the Court of Justice rather than the commission—if the court saw any developments on our side which it was worried about. I do not know if you have heard any echoes of that.

Chris Bryant: If I am honest, Lord Ricketts, I have been so determined to make sure that we get the data Bill in a place where we could secure EU adequacy—because it is so important to so many different aspects of the UK economy—that we have been pretty eagle-eyed, I would say, in drafting the legislation.

A lot of it was very similar to the previous version before the general election, but some of it was very different. Because we wanted to, we took out some things that might have been problematic. We have been pretty keen to make sure that we get to the right place. Data is, as you know, a form of currency in many ways. We would not want to imperil the exchange of that data in a way that could be harmful to UK businesses.

The Chair: Or law enforcement. We will come on in a moment to the law enforcement implications—it is also crucial in that area, is it not?

Chris Bryant: As long as you do not ask me any questions that I shall have to send on to the Home Office, and then have to say that I shall write.

The Chair: We shall leave that to Baroness Ashton to negotiate in just a moment.

Q5 Baroness Hayter of Kentish Town: From the point of view of the House of Lords, if you accept all of the House of Lords amendments, the Bill will just go through.

Chris Bryant: I understand how it works.

Baroness Hayter of Kentish Town: On this, given the friendly discussions you have been having across the water, are you expecting that, assuming we get the data adequacy, it would be open-ended, or do you think that it might again be a fixed period?

Chris Bryant: As I referred to earlier, it is obviously one of the issues. It would be better if it could be open-ended. In the end, that is a unilateral decision for the commission, but it is one of the things that we have said would be better if it was open-ended. Of course, nobody is ever going to say it is a completely blank cheque for the future. If we then subsequently changed the law in a way that made it impossible for data adequacy, then they would want to rescind, no doubt. So, I hope that, if we possibly can, we will get to an open-ended decision.

Baroness Hayter of Kentish Town: If it was not that, do you know why? Why would it not be willing to have a more open-ended decision?

Chris Bryant: You are now asking me to probe into the mind of the European Commission, and that would be difficult for me to do.

Not all the different Governments in Europe have different models of where digital, data and culture sits. I have spoken to other commissioners, such as the Maltese Commissioner, who is very supportive of us as well. I was, I think, the first UK Culture Minister since Brexit to attend the informal meeting of Culture Ministers, a few weeks ago. There was a very warm reception for us, and several people wanted to make sure that we got to a good place on this, because they had bits of responsibility for it.

So, there is a general warmth. As I say, I am trying to keep these two issues of data adequacy and the wider EU-UK reset separate.

The Chair: If I understand rightly, we are the only country that has a time-limited data adequacy decision. All the other EU arrangements are open-ended, as you say, although no doubt subject to review. It means we get a cliff edge every few years and others do not, which seems odd, given the volume and importance of the data that we are exchanging.

Chris Bryant: I love us being an exceptional country, but sometimes it is not very useful to us, being too exceptional. It is a well-made point. One of the difficulties about setting a date when something falls off a cliff is that you have no idea when a general election might be held. You will know when the next commission will be formed, but you will not know when general elections and pieces of legislation will go through, and so on. That is why I can safely say that, in an ideal world, we would prefer it to be an indefinite agreement.

Q6 Baroness Nicholson of Winterbourne: You have indicated that everything is going very well with your discussion with the EU on the data adequacy and on our Bill here. Are there any hidden rocks under the surface you have not yet told us about?

Chris Bryant: I would tell you about any hidden rocks if I knew that they existed. In essence, I am not aware of any hidden rocks. If there are any, they are so hidden that I have not seen them. I do not know whether a civil servant is hiding a hidden rock from me.

Eleanor Campion: I am not, Minister.

Chris Bryant: You are not. I do not think there are any. We have been pretty rigorous about this.

Baroness Nicholson of Winterbourne: Can you be 99% certain that it is going to go straight through, the Bill at the moment?

Chris Bryant: It is not our decision to make; it is the commission’s unilateral decision. Just as I would not like it very much if another third-party country were to start holding forth about what I should do regarding our data adequacy with their country, so I am reluctant to do that in relation to the EU as well.

However, I have always thought that when people say they are 100% certain about something, it means that they have not really checked. I always prefer 99% certain, because it means they have checked.

Baroness Ludford: Minister, thank you for coming.

Chris Bryant: I did not have any choice.

Baroness Ludford: It is conventional to thank you.

Chris Bryant: Thank you for having me.

Q7 Baroness Ludford: Looking beyond the actual passage of the Bill, and I share my noble friend Lady Hayter’s view on how that could be achieved—

Chris Bryant: I watched some of the debate yesterday.

Baroness Ludford: Good; I saw you. There will be a process of continuous assessment by the commission about whether the UK provides an adequate level of protection for personal data. Do you foresee any issues that could arise in implementation of the Bill, or any wider issues? There continues to be talk about the ECHR—not from the Government, it has to be said—but that whole environment is also relevant. I am sorry if I have strayed on to the next question.

Assuming the Bill passes, once it does there will be a continuous process of assessment by the commission about whether we continue to meet data protection standards. Do you see any issues on the horizon from implementation of the Act, or any wider issues on human rights or anything like that?

Chris Bryant: Continuous is not quite right. They will make a decision by 27 December, and I am hopeful that that will go in the right direction. Then, obviously, they keep a watching eye, as they do with all other data adequacy.

Baroness Ludford: That is what I meant.

Chris Bryant: It is broadly speaking what you meant. No, I do not foresee any problems, not least because large parts of the Bill do not impact on data adequacy at all. There is stuff about smart data, which, for instance, has been very successful in modern banking. We hope that we will be able to roll that out in a series of different sectors and that will be massively beneficial to the economy in terms of productivity and a whole series of other things.

Different parts of the NHS in England should have IT systems that work with one another; I do not see how that is going to be a potential problem. The previous Government had this in their Bill as well—it seems odd that we are only doing it now, really. For instance, Doncaster Hospital still employs 32 people just to carry around paper records in the hospital. You would think that that time had long gone. I do not see why digital verification services would be problematic for this either. So no, I do not.

Lord Frost: My question has been anticipated, so I will ask a different one.

Chris Bryant: No, do ask it.

Q8 Lord Frost: We have spoken a lot about the fact that the EU’s decision about us has a fixed timescale. Our decision about them is at least formally open-ended. We formally grant data adequacy to the EU, as well. We signalled that we would look at it after four years—at least, that is my recollection—but other things got in the way. Were there any plans to do a formal review of our grant of data adequacy to the EU, particularly given they are planning to look again at the GDPR, so the regime will evolve?

Chris Bryant: Inevitably, whenever a country with which we share data adequacy engages in a major review, we have to think about that. That is when we would decide whether we need to launch a formal review. We have not made that decision, as yet, because the commission has not decided precisely what direction it is going to go in.

Lord Frost: So, it is not ruled out, but it depends on—

Chris Bryant: I am not ruling anything in and I am not ruling anything out, to use whatever clichés of ministerial contributions to committees.

The Chair: It is certainly something worth bearing in mind, that we have a data adequacy decision to take vis-à-vis the EU.

Chris Bryant: And lots of other countries as well. It is really important that we should do so, because we need to make sure that when data is flowing from the UK to a third country, it is not then going to be misused, abused, or whatever.

Eleanor Campion: I was just going to come in on this. You pointed to this four-year review. There was a statutory deadline, and we are undertaking a review of all of our “deemed adequate” countries at the moment, which includes the EU, but it does not have a time-bound limit, just to clarify. That is not just the EU, that is for all countries when we left the EU and carried over those decisions. They are for all the deemed adequate countries; there are 13 of those.

Chris Bryant: I confess that I hate this word “adequacy”. “Deemed adequate country” seems terribly patronising.

The Chair: It does. It is probably not our language, but I agree.

To come back on what you were saying, there is no reason to doubt that our domestic data protection arrangements, for example, NHS data, and so on, should not be of interest to the EU in an adequacy decision, except if it captures EU citizens’ data. That is a route by which the Court of Justice or the commission could look at our domestic practices, if we are capturing data from EU citizens and particularly if we are sending it on to third parties in some way.

Chris Bryant: Yes, sorry, that was not the point I was making. The point I was making was, as you know, at the moment, lots of different parts of the NHS in England—and for that matter, elsewhere in the UK—use completely different, incompatible IT systems. The Bill says that anybody providing IT systems to the NHS has to have compatible IT systems. It is not specific about data but the point you make is a legitimate one.

Q9 Lord Whitty: You started out by very rigorously separating out the reset process from the data adequacy process. We were, of course, in Brussels a fortnight ago discussing the reset process and the prospects for 19 May. I do not think data adequacy was covered at all there. Is it true that on that date or as part of the reset process, data adequacy will not emerge at all? Given the relative timescales of the May meeting and the deadline for the EU decision, it would be odd that it was not mentioned, in some ways.

Chris Bryant: I will do everything in my power to make sure it is not mentioned, because I want to keep them separate. The deadline, as long as we get the agreement from the member states—which I am relatively confident of us getting—is now 27 December, not the June date, so we have got a bit of time for the EU to complete its work, as long as the Bill gets Royal Assent fairly swiftly.

I want us to have a successful outcome in a week’s time. While there are things that in my other capacity as a DCMS Minister I am very keen to see us restore, such as the ability of British artists to tour across Europe, that is a legitimate matter for those negotiations. I am not trying to do the negotiations on behalf of the negotiators, because one of the things that has been quite successful with the US deal is that Ministers have not gone here, there and everywhere holding forth about what should or should not be agreed, in public. We have let the negotiators get on with the negotiating. I am very keen that the data adequacy is kept separate.

In fact, Lord Frost might remember what it is like as a negotiator, having Ministers wandering all over the place holding forth in the public domain as to what should and should not be in the deal.

Lord Frost: I was the servant of the Ministers when I was a negotiator, so I was quite happy to hear what they had to say.

Q10 Baroness Winterton of Doncaster: Rather cheekily, as you have mentioned DCMS and the very issue that I raised in the Lords last week about creative industries and musicians, would you hope that perhaps some of that might be on the agenda, so that they did not go near any data accuracy? Can you share with us any information?

Chris Bryant: Sorry, Baroness Winterton?

Baroness Winterton of Doncaster: You said you were rather keen for DCMS to perhaps have some items on the agenda for next week. Do you feel that there is anything that you can share with us about whether, for example, the creative industries might be included, or other areas in DCMS?

Chris Bryant: I am not going to do Nick Thomas-Symonds’s job for him, but it is a very well-known fact that in our manifesto, we committed to try to get to a resolution of British artists being able to tour in Europe. I apologise for what I am about to say, but I went to see Depeche Mode last year in Germany, in Cologne. I was very struck that they absolutely went mad for Depeche Mode. In fact, they “Just Can’t Get Enough”. Some of you got that.

My point is that I want to get to a resolution on that, but whether it is at this particular moment that it gets resolved is a matter for Nick Thomas-Symonds, and the discussions are ongoing. It is not only bands like Depeche Mode; it is young bands. When I met my Italian counterpart in Naples last year, I said to him, “What’s the most important thing I can do for you?” and he said, “Get me tickets for Oasis”. But there are so many young bands that only really get to take off if they have that opportunity to tour. It is not about going to one country; it is about going to lots of countries. Under the present arrangements, we just have not got to that resolution. I want us to get there.

The Chair: That is going to be a very strong item in our reset inquiry when we get that covered, because we have taken a lot of evidence on those lines. Thank you.

Q11 Baroness Ashton of Upholland: I promise you that the result of this question does not mean you have to contact the Home Office or write to us. One of the things that I feel very strongly about is making sure that law enforcement is able to utilise all of the tools available in support of the work that it does. We have been talking to them in the context of the reset, because there are a lot of questions for them about how much they are going to be able to have access to information, and we have already heard about SISII and the prospects for that.

Underpinning all of this is data adequacy. Indeed, without that, it is hard for them, as they would probably describe it, to build on. It seems to me that with this time-limited question, and, in a sense, the extension—although I recognise your confidence and you are right to be confident within 99%, not 100%—the more that we can give them confidence that the underpinning is secure, the better.

For you, have there been any discussions in the context of the brief on data adequacy as opposed to the Home Office brief on whether law enforcement has been engaged with this? They are looking now to the future in terms of what could be achieved.

Chris Bryant: Obviously I have had discussions with my Home Office colleagues. We touched tangentially on SISII and things like that, but not specifically in relation to the data Bill or data adequacy. The obvious advantages are clear, but whether that is achievable is not for me to know at the moment—unless you know something different, Eleanor.

Eleanor Campion: The only thing I would add is that there is a team in DSIT which is obviously looking at it from the GDPR perspective on adequacy, and we work incredibly closely with our Home Office counterparts who are overseeing the law enforcement adequacy decisions. So that is just to give some assurance, really, that we are working closely and engaging with the commission together and jointly from an HMG perspective.

Chris Bryant: I seem to recall that one of my big arguments when I was arguing for us to stay in the European Union was that we would be able to exchange this data in a way that would be beneficial for our security and policing.

Baroness Ashton of Upholland: Of course; that is absolutely right.

Chris Bryant: I seem to have lost that argument.

The Chair: Yes. Thank you.

Q12 Baroness Anelay of St Johns: I would like to reflect on some of the changes the Government have made in their government machinery since the election, because I am very interested in the way that government should work and how it does work. I am not going to ask you to do the job of Nick Thomas-Symonds—that does not come into it—but the reality is that you are making progress on data equivalency against the background of a different type of machinery, whereby the handling of EU affairs is done in a different way, a way which one might say has become more cohesive rather than divisive. I am not too sure whether it is, but I believe that is the intention.

How have you actually carried forward the whole issue of data adequacy renewal within that new envelope of a Whitehall machine? The Home Office is of course part of it, and the Cabinet Office. I am not asking you to answer questions on the Home Office approach, but how have you managed to get through all this in a new background of machinery?

Chris Bryant: I am not sure whether you are saying that we are being more consistent, or the commission is being more consistent.

Baroness Anelay of St Johns: I am hoping that we are being more consistent.

Chris Bryant: So am I.

Baroness Anelay of St Johns: I am ever-over-optimistic, but there we are.

Chris Bryant: The changes that were made in terms of the Government Digital Service, and so on, have brought a tighter focus to everything that we are doing in DSIT. Peter Kyle’s work on AI has brought another element into the equation which the Prime Minister is very focused on personally.

One of the things I’ve been trying to do in my capacity, within my portfolio—which is fairly large—is to try to make sure that no decision that I am making is made solely in relation to my department but bears in mind everybody else’s as well. On space, for instance, we have managed to bring together all the space Ministers, because there is the MoD, us, transport, MHCLG, and others as well. We managed to bring all of them together because that might be more effective; likewise on telecoms and digital inclusion. That is the approach that I took to the data Bill as well.

Baroness Anelay of St Johns: In bringing together those parts of the Government, is that on a regular basis?

Chris Bryant: Yes.

Baroness Anelay of St Johns: How regular?

Chris Bryant: It is a moot point as to whether it is better to have a formal or an informal ministerial meeting, because sometimes the informal ministerial meetings end up getting more done because you behave in a slightly more political way and all sit round the table and batter it out. So there is that.

The only other thing I would say is that I was EU Minister in the last Labour Government. In many senses, I was the primary negotiator. Baroness Ashton then became the commissioner, and I was the Minister who negotiated the creation of the External Action Service. Having somebody attending Cabinet, like in Nick Thomas-Symonds’ position, is a really important part of being able to bring in people from lots of different departments rather than just from the Foreign Office. That is probably more effective than I was.

Q13 Lord Stirrup: Minister, I am going to broaden that question a little. This data adequacy renewal process has been rather torturous, and I recognise that we have made it more torturous by having a Bill going through Parliament at the same time.

We are dealing with an area where the confluence of rapidly evolving technology and the challenges we see both domestically and internationally are likely to lead to fairly rapid changes in the way that data is acquired, used and supplied.

Mine is a two-part question, really. You have addressed the co-ordination aspect of the Whitehall machinery, but is it agile enough to deal with what could be rapidly moving events in the future in this area? With regard to the arrangements with the EU, are those agile enough? I recognise that you cannot speak for the EU’s machinery, but have there been any discussions so far about how a more flexible, agile system could be put in place to deal with what, after all, is a rapidly evolving area? If there have not, should there not be such discussions?

Chris Bryant: I feel a bit as if I am now straying into the territory of telling the Prime Minister how to run his Government, which might be career ending, so I am not going to do too much of that, if that is all right.

There are several pieces of legislation which are now approaching or have recently arrived on the statute book which probably should have arrived five years earlier. One of them is the data Bill. I am almost beginning to think that we might need another data Bill in two or three years’ time, because some of this will be rather passé.

I wish we had been able to get the last data Bill over the line before the general election, but there was some stuff in it which we just could not sanction. You could say the same about the Online Safety Act, actually; we should have been acting in that space five years earlier, and if we had, then we might be able to do more things now.

Let us say for the sake of argument that we were to legislate another data Bill in two, three or four years’ time. I am being highly speculative here, and the civil servant is scribbling rapidly, “Bryant, stop it”. But if we were to, then of course we would want to be trying to go in lockstep with our closest allies, in so far as that is possible and meets our own objectives.

You asked about whether the EU is agile enough, and there is a multiplicity of views about that.

Lord Stirrup: Even on our side, a Bill every two or three years sounds like quite a lot, but compared to the pace of events in these sorts of areas, that is pretty glacial, so one does wonder if that is the right way of tackling that issue. Then, you add in the EU dimension and it becomes even more difficult. I realise that it is a very complex and difficult issue, but I just wonder whether we should not be having discussions with our EU partners about better ways of dealing with this area.

Chris Bryant: That is a matter for you and Nick Thomas-Symonds rather than me, but as one who helped lobby the EU back in 1999 for the copyright directive, I personally think that moving from directives to Acts was a good move. I have lots of long-established views on how we could speed up legislation in Parliament, but they are not my views as Minister.

Q14 Lord Jackson of Peterborough: Minister, may I ask you a slightly wider question away from the focus on legislation? One of the key issues we discussed in our inquiry report last year was about whether the European Commission is minded to reform GDPR. You will know, because I know you read these things, that Politico EU reported on 2 May that it is likely that one of the policy options available to the commission is to reduce the size of companies that are encumbered with regulatory obligations under GDPR. Can you give us some sense of whether that is an area you have pressed the European Commission on and whether you think that might have any ramifications for the British economy?

Chris Bryant: No, I have not read that, and it is not really for me to comment on what the EU should or should not do. My broad view is that all regulation should be proportionate. One of the things that we are engaged in across the whole of the Government at the moment is to try to work out what regulation we have that is necessary and proportionate. Where it is disproportionate or unnecessary, we are quite keen on dispensing with it.

Lord Jackson of Peterborough: So, if I could come back to you, you are a key interlocutor in this debate. Accepting what you say, that it is not for you to instruct the commission in its policy objectives, do you feel that there is room for reform of GDPR?

Chris Bryant: There is always room for reform, but you are asking me really to comment on speculation in a news article about what the commission might or might not consider doing. You described them as our key interlocutor; that is not quite how adequacy decisions work. In relation to the EU adequacy decision, they make a unilateral decision, just as we make a unilateral decision about whether their system is adequate for us.

Lord Jackson of Peterborough: So, let me ask you a straightforward question, then, because it seems to me that you are being very diplomatic—that is one way of putting it—and not necessarily answering the question. Are the Government in active discussions with the European Commission about the EU’s potential reform of the GDPR? Active discussions: yes or no?

Chris Bryant: No.

Lord Jackson of Peterborough: Thank you.

Q15 The Chair: We are coming towards the end now. I just wanted to widen the focus a bit, because we spent quite a lot—

Chris Bryant: Further?

The Chair: Further, to the entire world. We spent a bit of time in our inquiry, and it is in our letter, on the relationship between UK-EU data adequacy and what is going on more widely in terms of data sharing with other countries and regions. There are, for example, the global cross-border privacy rules, which are evolving particularly in the Asia-Pacific area, and which I know the UK has been taking an interest in.

We said in our letter, which I will quote, as it is a very good letter: “Adequacy may be coming under increasing strain as the basis of any international data protection regime, owing to its limited ability to scale across many jurisdictions and the political dimension which the process inevitably brings”. So, in a way, it is a follow-up to Lord Stirrup’s question. Given the complexity of data-sharing around the world and the way it is moving, have you had any thoughts about the relationship between what we are doing between the UK and the EU and these wider data-sharing arrangements?

Chris Bryant: We are in favour of encouraging good practice around the world. We have associate status in the global cross-border privacy rules forum, which we are keen to explore. We have allies in that. There are other countries which think in a similar way to us, and there are others that do not, and we try to persuade them.

The Chair: And do you feel that the EU-UK data adequacy arrangements are in any kind of way a straitjacket that makes it more difficult for us to be working in that wider space, which may turn out to be the future of data-sharing in the wider world?

Chris Bryant: It is still to be seen, I think. It does not feel like a straitjacket at the moment. We feel relatively free, and we have a productive relationship with the EU and quite a series of other countries with which we have adequacy rules, bridges or different formats for the ability to exchange data.

As I say, data is going to be an increasing part of world economics, and we will need to make sure that we have the right laws in place. Broadly speaking, I am in favour of free trade. I suppose one of my worries over the last four or five years has been that so many countries have resiled from free trade in lots of different ways, which I do not think is good. Then, there are other countries that have resiled from the rule of law. When you put those two things together, that is quite a troubling world for us all to be in.

The Chair: And maintaining free flows of data in that world may become increasingly challenging as the years go by.

Chris Bryant: You have finished my paragraph for me

The Chair: We are at the end of the pre-allocated questions. Does any Member want to follow up with the Minister on anything arising from that?

Thank you very much. I think we would take away the encouraging view that things seem to be heading in the right direction for this set of data adequacy decisions in December, and the importance that has both for the economy and for law enforcement co-operation with the EU. If anything changes, we just ask that you keep us up to date. The committee remains very interested in this area, having inquired into it quite deeply last year. On that point—

Chris Bryant: It has been very helpful that you did the inquiry for us. The only thing that might change is if we were able to get the data Bill through to Royal Assent.

Baroness Ludford: That is your fourth bite at the cherry.

Chris Bryant: Cherries are only worth eating if you get four bites out of them.

The Chair: We have got the point; we have consumed the cherry. Minister, thank you very much indeed.

Chris Bryant: Thank you for having me.