Previous SectionIndexHome Page

Mr. Hoon: I thank my hon. Friend the Member for Leyton and Wanstead (Mr. Cohen) for allowing us to have this short debate, which will be of assistance. He is concerned about clause 34, which performs an important function. It ensures that certain key provisions of the data protection regime do not conflict with the rules relating to information that is required by statute to be made public.

As my hon Friend's amendments recognise, the provision is essentially about public registers. He gave a number of examples: the registers of births, marriages and deaths, registers held by Companies House, the electoral register, and so on. The essential feature of all those registers, which is recognised in clause 34, is that they are all governed by their own discrete legislation.

Those statutes will determine the detailed conditions that apply to the information contained in the registers. They will cover matters such as the nature of the

2 Jul 1998 : Column 596

information contained in the registers, the conditions governing access to the registers, the accuracy of the information, and so on.

The purpose of clause 34 is to ensure that the detailed rules of the specific statutes, rather than the general data protection rules governing the registers, determine those matters. I hope that my hon. Friend will accept that that is sensible. The information contained in the registers is collected for a specific and particular purpose. It is much more appropriate for the specific statute to determine the relevant conditions that apply than for the general data protection legislation to do so. That is not to say that the data protection rules do not apply at all. To the extent that the data protection principles, and other provisions of data protection law, are not dealt with expressly in the specific statutes, they will apply. That is the position under the 1984 Act, and it will be maintained in the Bill.

8.30 pm

I remind my hon. Friend that clause 34 does not provide an exemption for the subsequent use of data collected from the registers. To the extent that any of those who obtain personal data from public registers process those data in a way that would be caught by the Bill, they would have to comply in full with the requirements set out in the Bill.

My hon. Friend wants to go a little beyond that. He wants to provide the Secretary of State with the power to specify conditions governing access to specific public registers. I hope that I have made it clear why the Government do not believe that that is the right approach. Moreover, I invite my hon. Friend--who I know is extremely knowledgeable on this matter--to consider how his proposed new arrangements would be enforced. Not all those seeking access to the registers would become data controllers, so the conditions could not be enforced through the various mechanisms set out in the Bill. Again, that argues for the conditions applying to particular registers to be set by the parent enactments--if I may use that phrase--which will be able to make suitable arrangements for enforcement.

I hope that my hon. Friend will accept that that is the right way forward, and that it is better for these issues to be dealt with in the specific context of the Acts that deal with registers rather than in the context of wider data protection legislation. I am grateful to my hon. Friend for bringing the matter to the attention of the House, but I invite him, in the light of what I have said, to withdraw the amendment.

Mr. Cohen: My hon. Friend is right in saying that I want to go further and impose more general data protection controls on public registers. However, I acknowledge that he has made some good points, so I beg to ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 40

Enforcement notices

Mr. Cohen: I should like to speak to amendment No. 1, in page 23, line 32, to leave out "the fourth" and insert "any". However, I welcome the Government amendments that have been grouped with it, which,

2 Jul 1998 : Column 597

I think, accept the points that I wanted to make. The rights granted by article 12 (b) and (c) of the European directive, as established by the Bill, should apply to all the data protection principles, and not only to the fourth principle, as originally proposed, so that unlawful and unfairly obtained data--not only inaccurate data--are covered.

There was a danger that the Bill would not implement the data subject's rights under those two articles of the directive, which would also have meant a lessening of protection for data subjects under the Data Protection Act 1984. I welcome the Government amendments.

Mr. Deputy Speaker (Mr. Michael J. Martin): Is the hon. Gentleman saying that he is not moving amendment No. 1?

Mr. Cohen: Yes. I am prepared not to move it, as I accept the Government amendments.

Amendments made: No. 33, in page 23, line 33, leave out 'may' and insert

'which requires the data controller to rectify, block, erase or destroy any inaccurate data may also'.

No. 34, in page 23, line 34, leave out 'any inaccurate data and'.

No. 35, in page 23, line 36, leave out 'or' and insert--

'(3A) An enforcement notice in respect of a contravention of the fourth data protection principle'.

No. 36, in page 23, line 39, leave out from 'party' to second 'to' and insert

'may require the data controller either--
(a) to rectify, block, erase or destroy any inaccurate data and any other data held by him and containing an expression of opinion as mentioned in subsection (3), or

No. 37, in page 24, line 2, leave out from 'notice' to 'or' in line 4 and insert

'requires the data controller to rectify, block, erase or destroy any personal data'.

No. 38, in page 24, line 6, leave out 'were inaccurate' and insert

'had been processed in contravention of any of the data protection principles'.--[Mr. Hoon.]

Mr. Richard Shepherd (Aldridge-Brownhills): I beg to move amendment No. 15, in page 24, line 28, at end insert--

'(7A) The Commissioner shall maintain a register containing--
(a) a copy of every enforcement notice issued under this section;
(b) such other particulars relating to such notices as the Secretary of State may by order prescribe.
(7B) The provisions of sections 19(6) and (7) shall apply in relation to the register maintained under this section as they do in relation to the register maintained under section 19(1).'.

Mr. Deputy Speaker: With this, it will be convenient to discuss the following amendments: No. 16, in clause 42, page 25, line 20, at end insert

'and may, if he considers it appropriate, inform any other person'.

2 Jul 1998 : Column 598

No. 17, in clause 59, page 36, line 44, leave out

'necessary for reasons of substantial'

and insert 'in the'.

Government amendment No. 46.

No. 18, in page 36, line 44, leave out 'substantial'.

Mr. Shepherd: The amendments reflect concern about a new prohibition on the release of information in clause 59, which would make it an offence for the Data Protection Commissioner or her staff to disclose information about any identifiable business or individual other than in very limited circumstances. The offence would be committed even if the disclosure caused no harm to commercial confidentiality, for example. No such offence exists under the Data Protection Act 1984.

The provision is likely to prevent the commissioner from publicly identifying businesses that have been found to be misusing personal data about individuals by obtaining data through deception, for example, or by selling private information for commercial purposes. The commissioner may be unable to reveal that she has received large numbers of complaints about a particular company, that a company has failed to respond to requests to improve its practices or that an enforcement notice has been served against a firm. Equally, it may be an offence to reveal that a business has agreed to correct a problem without formal action, or that a complaint had proved unfounded.

The registrar has expressed concern at the new provision, which she says may require her and her staff to be unnecessarily guarded in future. The result may be both to deny the public information that they should have and to undermine public confidence in the commissioner's work, by preventing her from explaining what action she has taken to deal with complaints relating to matters of public concern.

The offence is not limited to disclosures likely to cause actual harm, but will be caused by any disclosure ofany information about an identifiable business. That contradicts the policy established by the previous Government, whose 1993 White Paper on open government provided that, in any new offences involving the disclosure of information,

It is also inconsistent with this Government's proposals for a freedom of information Act. The freedom of information White Paper proposes that information should be withheld only where disclosure would cause either harm or substantial harm to specified interests. Existing statutory restrictions on disclosure are being reviewed with a view to repealing or amending those that do not reflect the proposed harm test.

In Committee, my hon. Friend the Member for Ryedale (Mr. Greenway) tabled an amendment to restrict the offence to information that is potentially damaging. The amendment was not accepted. The Government say that the new offence is required by the European data protection directive, which states that national supervisory authorities must be subject to

However, the registrar's view, as expressed in January, is that that obligation can be met without the creation of a new criminal offence. Moreover, the directive contains

2 Jul 1998 : Column 599

a number of pro-disclosure provisions, which would permit a far more balanced approach. They include recital 72, which states that

    "this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive",

and recital 63, which states that supervisory authorities

    "must help to ensure transparency of processing".

The Government maintain that the restriction is not as serious as it seems, as the commissioner has a discretion to release information under clause 51(2), which states:

    "The Commissioner shall arrange for the dissemination in such form and manner as he considers appropriate of such information as it may appear to him expedient to give to the public about the operation of this Act, about good practice, and about other matters within the scope of his functions under this Act".

However, precedent under similar provisions suggests that that may be of limited value.

For example, the Health and Safety Commission and Executive are prohibited from disclosing information unless it is for the purposes of their functions, but they are required to ensure that people concerned with matters relevant to the purposes of the Health and Safety at Work Act, etc. 1974 are

those matters. The HSC and HSE interpret those two requirements restrictively, and say that they are prohibited from revealing information about individual premises unless to do so would directly prevent risk, or is necessary to protect health and safety. Requests for information about identifiable premises from people who are not themselves in danger, including Members of Parliament, researchers and journalists, are usually refused. The explicit prohibition on releasing information about identifiable businesses is therefore likely to override the commissioner's general discretion to release information, unless, under clause 59(2)(c),

    "the disclosure is made for the purposes of, and is necessary for, the discharge of . . . any functions under this Act".

It would be extremely difficult to demonstrate that a particular disclosure was necessary for any function under this Act. If the function can be discharged without the disclosure, the disclosure will not be necessary, and, indeed, will be illegal.

Clause 59(2) permits disclosure in certain other limited circumstances--for example, when the information is already publicly available, when the individual or business concerned consents to the disclosure and when disclosure is made in connection with legal proceedings. The subsection also provides for a limited, highly restrictive, public interest defence.

The amendments would require the commissioner to maintain a public register of enforcement notices, whose disclosure might otherwise constitute an offence. They would permit--but not require--the commissioner to reveal the results of an assessment of whether a particular business was complying with the legislation. At present, that information can be revealed only to the person who asks for the assessment, and its disclosure to a Member of Parliament or a journalist could be an offence. The amendments also attempt to strengthen the public interest defence available to the commissioner or her staff.

Let me deal first with amendment No. 15. Under clause 41, the commissioner may serve an enforcement notice when it appears to her that a data controller is

2 Jul 1998 : Column 600

contravening any of the data protection principles. The notice may require the controller to take specified action or to stop processing data. The amendment requires the establishment of a register of such notices, as is made clear in new subsection (7A), which would have to be available to the public, free of charge, at all reasonable times. Certified copies of entries could be obtained on payment of any prescribed fee. That is provided for by new subsection (7B), which applies the existing provisions of clause 19(6) and (7), relating to the data protection regime.

The amendment would bring the Bill into line with existing legislation, such as the Environment and Safety Information Act 1988 and the Environment Protection Act 1990, which require the establishment of public registers of enforcement notices about environmental and safety hazards. Paragraph (b) of new subsection (7A) would allow the Secretary of State, by order, to require other information relating to such notices to be included in the register. That would allow the fact that a notice had been cancelled under clause 41, or was the subject of an appeal under clause 48, to be recorded; it might also permit the person on whom the notice had been served to add a statement of explanation or mitigation to the register.

Amendment No. 16 refers to clause 42. Under clause 42(1), a person who believes that he or she has been directly affected by any processing of personal data may ask the commissioner for an assessment of whether that processing breaches the Act's requirements. After carrying out the assessment, the commissioner must inform the applicant, to the extent that she considers appropriate, of

That is in clause 42(4)(b).

Next Section

IndexHome Page