Member

Strict statutory requirements already exist in UK law to protect data when it is transferred internationally, including ensuring an appropriate level of protection in the recipient country. Regulations made under Clause 209 must be in accordance with the UK Data Protection Act. In Committee the noble Lord raised concerns about the Data (Use and Access) Act, and he spoke passionately about it during the passage of that Act. I will again try to reassure him: when transfers are based on adequacy, the Secretary of State must determine as part of the assessment that the level of protection guaranteed to the data is “not materially lower” than the standards we uphold here in the UK. That assessment must consider respect for the rule of law and human rights, the strength of data protection authorities, the availability of redress for individuals and the wider legal and constitutional safeguards. The Secretary of State may also consider any other matter that he or she deems relevant.