Examination of witnesses (Questions 230 - 249)
TUESDAY 3 FEBRUARY 1998
MRS E FRANCE,
and MR F ALDHOUSE
230. Under the blanket exemptions which the Chancellor
said departments would have, that it is not in the national interest
to release that information.
(Mrs France) I would find it very difficult to
accept that they did not have subject access rights under the
Data Protection Bill to their own information.
231. The issue is that if you are given something to
act as a deterrent against what a potential enemy was going to
inflict on you, they would claim that was a security reason. The
Gulf War veteran would still be left in the dark about what she
or he was given by the Ministry of Defence, enabling them to create
a legal framework for them to claim compensation. That is the
whole crux of their argument at the moment. They cannot get to
the bottom of what they were given and why and who authorised
it.
(Mr Aldhouse) So far as FOI is concerned, so far
as access to that sort of blanket background information is concerned,
I suppose that is an argument between the Committee and the Chancellor
and the Government. So far as data protection legislation is concerned,
if it were information clearly related to an individual, we would
say there is no exemption, except for a limited national security
exemption.
232. That is the clause, is it not?
(Mrs France) It is very limited.
233. Thank you for a very clear presentation of the points.
What you have done is show how clear the position is as far as
you are concerned and how confused it might be for somebody who
would want to make use of the information. I actually thought
the starting point was to enable the individual to have a clear
run at gaining this information, either through data protection
or through FOI. I cannot see anything you have said which expresses
the view other than that it is as clear as mud for the individual.
(Mrs France) There is a risk that it could be
as clear as mud. If we forget for the moment that there is an
FOI Bill, currently under the Data Protection Act one of the key
rights that we keep pushing, that individuals have - and I am
running a publicity campaign at the moment, targeted at individuals,
trying to encourage them to use their right - is the ability for
each of us to see what is held on us. The exemptions are very
few. It is true that national security is there. It is tightly
defined, though I accept that whatever we do there is a problem
about how that is defined. Under data protection law currently
people can, broadly speaking, see anything held on them on computer.
Clearly if the police hold information about something you are
about to do next week, then they are not going to release that
to you and there are certain exemptions of that kind relating
to law and order. When the Data Protection Bill is extended to
manual records, you can either have an unclear definition of manual
records, which still leaves some things outside it, or, it seems
to me and one of the reasons we had hoped these Bills would go
through in parallel, it is open to the Government to say, at least
in relation to public bodies, that by manual records they mean
any personal information held about an individual. You could then,
if you chose to, use the rights in data protection legislation,
to deal entirely with personal files and personal information.
You could leave FOI and the Information Commissioner to concentrate
on what I am in shorthand calling non-personal data. That is an
option.
234. Do you not think it is very unfair for the individual
citizen?
(Mrs France) No, that would be easier for the
citizen, would it not?
235. Do you think so?
(Mrs France) I am only suggesting it is. If it
is not, let us not pursue it.
236. We have two different regimes operating, do we not,
or we will have? The person has first to choose which method they
want to follow.
(Mrs France) No, that way he would not have a
choice. The point is that he would, under the present proposals,
have a choice. He would have to decide whether he was going for
his FOI rights or his Data Protection Act rights. If all access
to personal information is through one legislative route, then
the potential is that it could be simpler for the individual.
He will have one set of rights, one set of appeal mechanisms,
one set of charges, which is consistent and it does not matter
how he phrases his request. If it is for personal information
it will be dealt with in that way. Under the current proposals
there is a risk, but we have to address it and try to minimise
it, that he will be uncertain which legislation he is using and
a risk that if public bodies are not choosing to be cooperative
he could find himself put back to square one, if he has applied
under the wrong legislation, or caused some confusion at the very
least.
237. Part of our responsibility on this Committee is
to act as that individual, is it not, to try to find how we can
influence government to produce the smoothest path and the most
illuminating path which it is possible to achieve in the quickest
possible time. What would you suggest would be the firmest proposal
we could put forward which would achieve that?
(Mrs France) I shall be accused of a vested interest
in proposing the way forward.
238. That is your opportunity today.
(Mrs France) There is a Data Protection Bill before
Parliament, that Data Protection Bill covers an enormous proportion
of the personal information you are talking about. It falls down
if the definition of manual records is narrow, it falls down if
the transition on manual records is a longer period than you had
expected in freedom of information legislation. Both of those
could be remedied within that Bill without taking that Bill off
tracks, but would clearly not be what is currently in the mind
of those who have put forward that legislation.
Chairman
239. I am sorry to hark back to the Gulf War veterans'
issue again but could I ask you a very simple question? If a Gulf
War veteran wants to know what anti-biological and chemical warfare
preparation was administered by their army doctor at Sharmelsheikh
or Sidi ben Abas or at whatever the base was just before the Gulf
War started, can they now come to you and say they want to exercise
their rights under subject access under the data protection file,
it is probably on computers with the army medical records team,
can you get that information?
(Mrs France) If they do it now, then the first
question will be whether it is held on computer. If it is not,
I cannot help them currently.
240. Has any Gulf War veteran made an enquiry to your
office as far as you know?
(Mrs France) Not to my knowledge.
241. That is fascinating.
(Mrs France) What we would tell him to do is to
go away and make a formal subject access request under section
21 of the 1984 Act, wait for his reply from the Ministry of Defence
- the Ministry of Defence has 40 days in which to reply. If they
tell him they have no information on computer, then there is nothing
I can do to assist. I have to accept what they say currently.
There is very little I can do with the powers I have.
Mr Hancock
242. If it was, what could you do to help them?
(Mrs France) If it was and they refused to give
it, then the Ministry of Defence would be breaching a data protection
principle and also, if they fail to reply under section 21, allowing
an individual the right to go to the courts.
243. What would be their get-out for not giving it to
you?
(Mrs France) The national security exemption.
244. I think you will find that is what they have done.
(Mrs France) Under the Data Protection Act, I
can require a certificate from the Minister, can I not?
(Mr Aldhouse) The old-fashioned certificate procedure
is only produced when you end up in court at the end of the day.
Chairman
245. Is this a PII certificate?
(Mr Aldhouse) No, it is one of these special national
security certificates.
Mr Hancock
246. The individual would have to take it to court, only
to have that slapped on.
(Mrs France) There is some comfort in the new
Bill I think, though my Deputy may correct me because the new
Bill is pretty new to us and we are finding our way through it
ourselves. My understanding with the new Bill would be that if
the individual made such an application it would then also cover
manual as well as computer records. I will, under the new Bill,
have something called an information notice power which will allow
me to ask to see what is held, a power I do not currently have.
That would allow at least some pressure to be put on once we had
seen what was held. In addition, if the national security exemption
were called into play under the new legislation, it would still
be open to the individual to challenge that in the courts. There
is some improvement, as I understand the drafting of the new Bill.
Miss Johnson
247. Coming back to the question of consistency, obviously
the legislation could be consistent or inconsistent and you are
arguing that there is a danger it might be inconsistent. But supposing
the legislation, the subsequent Freedom of Information Bill, is
consistent with what has gone through on data protection, then
is not one possible answer that all the privacy, personal information
elements of both bits of legislation fall to you to act on, to
be responsible for, and the remaining parts of the Freedom of
Information Act fall to the Information Commissioner? What would
the possibilities be of that answer to this particular dilemma?
(Mrs France) That would go a long way to resolving
the sorts of tensions we have talked about because in a sense
you internalise the resolution at an early stage. It does not
mean that the courts would not still have the opportunity, if
you have two sets of legislation you obviously still have the
opportunity for the courts to decide you have interpreted one
bit or the other incorrectly. Certainly that is an option which
I canvassed quite widely and you will find that I have written
papers to that effect, though they pre-date the drafting of this
White Paper.
248. From the public's point of view that would provide
a seamlessness. Wherever the request was sent, if it related to
personal information it could be channelled through to your office
and one of the points about which we have the greatest concern
is how difficult it is going to be for the public to work with
all of this given the complexities. That might make it an awful
lot simpler.
(Mrs France) I share those concerns.
Mr Bradley
249. Back to the questions about the Gulf War syndrome.
Can we be confident that those organisations which wish to escape
the provisions of legislation do not simply wipe their information
or simply deny that they hold it? Is there anywhere a requirement
to register the information or categories of information which
you hold?
(Mrs France) No, there is no requirement to register
detailed information, but there is a requirement under data protection
legislation to notify me if you process sensitive data and sensitive
data includes health data. That would be a very broad notification.
It would not say we hold the records of X, Y, Z who are Gulf War
veterans: it would simply say that the Ministry of Defence holds
and processes health information about members of the Services.
I do not think that would help.
| 
