| Previous Section | Index | Home Page |
'(13) The relevant Commissioner may--
(a) investigate any procedure which relates to--
(i) the processing of personal data for the purpose of safeguarding national security,
(ii) the application of an exemption which is required for the purpose of safeguarding national security, or
(iii) the signing of a certificate under this section,
(b) make any recommendation which relates to--
(i) an investigation under paragraph (a) of this subsection, or
(ii) safeguarding the interests of data subjects, and
(c) if appropriate--
(i) raise any matter which relates to an investigation in an annual report, or in any other report to the Prime Minister, or
(ii) liaise with the Data Protection Commissioner or another relevant Commissioner on matters which relate to an investigation.
(14) The Data Protection Commissioner may raise with a relevant Commissioner any matter which relates to the processing of personal data for the purpose of safeguarding national security.
(15) In this section, the "relevant Commissioner" means the Commissioner appointed by virtue of--
(a) section 4 of the Security Service Act 1989,
(b) section 8 of the Intelligence Services Act 1994,
(c) section 91 of the Police Act 1997, or
(d) section 8 of the Interception of Communications Act 1985.'.
The idea of the amendment is to introduce some element of accountability to the processing of personal data for the purposes of national security. I find it strange, to say the least, that, in certain respects, the Government are offering more privacy protection to members of the mafia and terrorists under investigation by the security services than they are to ordinary law-abiding members of the public--for instance, a data subject who is being positively vetted.
What is more, I am concerned that the Data Protection Act 1984 is being watered down. That Act placed a duty on the security services, by virtue of section 2(2), to comply with the data protection principles. That duty has been removed by this Bill; an exemption under clause 28(1)(a) removes the obligation to comply with the principles.
Under section 27 of the Data Protection Act 1984, personal data held for safeguarding national security are exempt only from the enforcement regime, registration and rights of data subjects. That means that GCHQ and MI5 and MI6 had a legal duty to apply the data protection principles, even though there was no way for the data protection registrar to test whether the duty was complied with. The 1984 Act therefore places those organisations under a moral duty to comply with the principles, but, under the provisions of clause 28, they are permitted to process personal data insecurely, disclose personal data to unauthorised persons, and even sell it to newspapers by virtue of the exemption from clause 55(4).
It may seem a flippant question, but I ask the Minister whether the fees raised by the sale of such unlawfully procured personal data will go into the Consolidated Fund, and how much revenue he expects to be raised in the next financial year.
The Minister might say that MI5, MI6 and GCHQ will not sell unlawfully procured personal data. If that is his argument, why is the exemption in clause 28(1)(c) so wide as to include exemption from clause 55(4), which makes the selling of such personal data an offence? That shows how unnecessarily wide the exemption is with respect to safeguarding national security. Selling misinformation to
the newspapers about politicians and perhaps even about the Government will be perfectly lawful for the security services.
In support of my amendment, I draw the attention of the House to some of the differences between warrants and certificates under the Bill. In respect of warrants signed by the Secretary of State--for example, for the interception of communications, or burglary--there is a safeguard, in that such a warrant is signed and validated for six months at a time. By contrast, under the provisions of the Bill, a certificate lasts for ever and is never reviewed.
I note that for warrants under the Interception of Communications Act 1985, there is an obligation under section 6(3) of that Act to discard irrelevant personal information that has been intercepted. Under the Bill, however, the negation of the third and fifth data protection principles means that irrelevant personal data obtained by means of a certificate can be kept indefinitely.
The previous Government gave the security services a new role--to assist the police in dealing with serious crime. The obligations of the police in respect of data protection compliance are apparently not to be required of the security services. The Minister should explain why he has come to that conclusion.
The Government seem to be ignoring the advice of the Data Protection Registrar, who asserts in her document "Our Answers":
There is a significant risk that improper processing of personal data--for example, data obtained by what may be regarded in other circumstances as unlawful means--relating to a serious crime suspect, would not be subject to any data protection rules at all. Such processing can be undertaken by the security services. That could jeopardise the quality of evidence before a court and the subsequent trust placed in it by a jury. If data protection is so thoroughly disregarded, there is a possibility that some serious criminals will not be convicted.
My amendment would go some way towards introducing a smidgen of accountability into the way that the security services process data. It would use the expertise of the commissioners established by section 4 of the Security Services Act 1989, section 8 of the Intelligence Services Act 1994, section 91 of the Police Act 1997 and section 8 of the Interception of Communications Act 1985.
It would be the duty of those commissioners to examine procedures with respect to data protection. They would have powers to investigate any procedure relating to the processing of personal data for the purpose of safeguarding national security; the application of an exemption that is required for the purpose of safeguarding national security; and the signing of a certificate by a Cabinet Minister. The relevant commissioner could make any recommendation relating to that investigation, and make recommendations that were needed to safeguard the interests of data subjects. The proposals in my amendment are no different from the current duties associated with warrants.
The amendment would permit the commissioner, if appropriate, to raise any matter that relates to an investigation in an annual report, or in any other report, to the Prime Minister, and to communicate with the Data Protection Commissioner or any other relevant commissioner. That is a pretty moderate amendment.
On 1 June the Under-Secretary of State for the Home Department, my hon. Friend the Member for Knowsley, North and Sefton, East (Mr. Howarth) replied to me that the Government
Mr. Richard Allan (Sheffield, Hallam):
We have some sympathy with the spirit of the amendment. My noble Friends in another place also tabled amendments on the issue of the security services exemption, because we are concerned about any blanket exemption, where there is no specific justification for exempting data from the data protection principles. The thrust of the Bill derives from European conferences and conversations in which the Parliamentary Secretary, Lord Chancellor's Department was deeply involved, and which reflected, to some extent, the experiences of the residents of the former East Germany, who had good reason to be suspicious of the way in which their security services held data.
"The extension of the role of the Security Service into areas of traditional policing should not carry with it an extension of the exemptions provided by section 27"--
the section of the 1984 Act that deals with national security.
"have decided not to depart from the existing policy that the Security Service should not register any of the personal data they hold under the Data Protection Act 1984."
He went on to say:
"I understand similar considerations also apply to the Secret Intelligence Service and GCHQ."--[Official Report, 1 June 1998; Vol. 313, c. 52.]
However, it is a departure from data protection policy when the security services take on a traditional policing role, and that is against the advice of the Data Protection Registrar. I believe that it is an unwise decision. At the very least, the Minister should explain it to the House.
7.45 pm
| Next Section
| Index | Home Page |