10. What assessment has the Counsel General made of the legal implications for Wales of the UK Government's Data Protection and Digital Information Bill? OQ58655

Thank you. Before the Bill was withdrawn from the Second Reading in the House of Commons, my officials assessed its impact on Wales and identified provisions requiring the Senedd’s consent. Any forthcoming data protection reforms by the UK Government will be similarly assessed.

Diolch, Counsel General; thank you for your response on that and for that reassurance. As we now know, the UK Government has said that they are pausing their data reform Bill, but they are continuing to express their plans to scrap the general data protection regulation. Under GDPR, there is a legal requirement for consent to collect and share data; there is also an obligation for companies to delete any personal data when requested.

In the last few weeks the UK Government has gone further than that and released a statement to say that they are working on a new data adequacy agreement with the US that would allow our personal data to be transferred freely, removing the protections currently in place to secure our data from being used by private companies without our knowledge or consent. This means that they could sell our NHS data. This means that it will impact our Agriculture (Wales) Bill that's coming up, because Welsh Government will be collecting that data, and we won't be able to protect it because it will be under UK legislation that impacts us. It means that the biometric data that is being collected on children in schools will be able to be sold. And I have to say, this is all about trade agreements—this is all about trade agreements. So the recent right-wing experiments of the UK Tory Government do not leave me with hope that they will protect citizen data. What can we do? What talks are you having with them? Thank you, Counsel General. 

Thank you for raising what is a really important issue that is not often commented on. I think this is the first specific question I've had on this, and it's very important that it has been raised. What I can say generally is that when issues in terms of data collation have arisen, I know that the Welsh Government Ministers have always raised the issue in terms of the protection of that and avoiding the misuse of that. I know that has happened within the health sector, and I see my colleague Eluned Morgan here, who I know took major steps ensuring that NHS data could only be used for specific objectives of medical benefit et cetera, for NHS purposes, and not be used in other ways where it can be sold and disseminated and used for any other corporate or commercial activities. That applies in terms of other legislation that may arise. 

So, we will continue to seek to work with UK Government departments to gain information and consider the potential issues arising from any proposals to reform data protection law. We will strongly oppose any reforms that undermine an individual's right to protection of their personal data and their privacy. We do recognise also that the potential loss of EU adequacy is a major threat to Welsh exporting businesses, whose main overseas market continues to be the European Union. So, we will oppose any reform that marks a significant departure from the principles of the EU GDPR on the basis that this is likely to jeopardise the UK's chances in terms of having its EU adequacy status withdrawn. 

And finally, question 11, Joyce Watson.