| Previous Section | Index | Home Page |
Mr. Tam Dalyell (Linlithgow): While my hon. Friend is on this subject, may I add to his question? Could we have the reflections of the Home Office on the effect on people in the public sector and people operating in the public sector--in particular Members of Parliament--given the celebrated case of George Strauss v. London Electricity Board? There is a problem here, I think.
Mr. Cohen: My hon. Friend makes a good point, which is also worthy of the Minister's response.
Several options are available to resolve some of the problems. For instance, any public official mentioned in the data could consent to the release of his personal data; but if a freedom of information request is dependent on such consent, it cannot really be called freedom of information. Of course, names, initials or identifiers of individuals can be removed from documents so that they are no longer personal data, but that might push up the cost of access towards the statutory limit. In addition, a public authority could turn a blind eye to the fact that the information is personal data, but the exercise of that blind eye is at the discretion of the public authority.
I am arguing that there are too many unanswered questions and that there needs to be a clear and uncomplicated exposition of how the interface will work. So far, none has been provided.
I shall now explain the benefit of my approach. It avoids the need to consider officials acting in a public versus private capacity and a "serious harm" test, which for some reason seems to strike fear into the Government. Instead of a breach of any of the data protection principles, my amendment makes the test of whether personal information is exempt information dependent on article 8 of the European convention on human rights, enshrined in our law in the Human Rights Act 1998. That approach also requires changes to clause 13 of the Bill.
First, I shall raise a quick point. My amendment does not affect the situation where the requester is the data subject; it deals only with access by an individual who is not the data subject.
My starting point is that before personal data about one individual can be released to another, a public authority must weigh many factors that define whether personal data should be exempt information. Most of those relate to the private life of an individual. By focusing on private life--the person's home, his family, his correspondence--my amendment draws the attention of a public authority to the fact that those private elements have a differential and greater weighting importance than decisions that relate to public life. It gives a clear steer that the protection of private life is the important factor that requires safeguards.
Those factors which protect private life are self-explanatory. They are whether the disclosure of information by the authority is likely to cause unwarranted damage or unwarranted distress to the private life of any individual who is identified by the information;
whether the disclosure of information by the authority is explicitly prohibited by any other enactment; whether the disclosure--
Mr. John Bercow (Buckingham):
I am following the logic of the hon. Gentleman's argument closely. Is he advocating that Members of Parliament should have access to the personal data held on them by the respective Whips Offices?
Mr. Cohen:
I had better not be drawn down that route for several reasons, not least the Whips' information; but of course there is information on the number of times we have voted and the number of times that we have rebelled, and that goes to our constituency parties. That is a welcome bit of freedom of information to our constituency parties.
I wish to make some other points about the protection of private life. My amendment recognises that, in a case of disclosure of personal data to a requester who is not the data subject, other factors might have to be considered. Even when the request relates to exempt information, the amendment would ensure that the disclosure was weighed in the context of the provisions in clause 13. That means that the impact of the Government amendment, which will make personal data exempt from any discretionary disclosure under the clause, has to be removed. My amendment would allow the private life circumstances outlined in it to be considered in combination with the emphasis in the clause in favour of disclosure while allowing for a decision not to disclose where the impact on private life was proven to be unwarranted. That is the correct balance.
My amendment would ensure that the data protection principles would still apply to the subsequent processing by a requester of personal data disclosed by a public authority. That processing would still be subject to the Data Protection Act. Unless there is a Data Protection Act exemption, the transparency rules may oblige the requester to contact the data subject to alert him to the processing. My amendment would help the Government to get off the hook whereby proper freedom of information disclosures of public information could be blocked because of the current loophole in the Bill on personal data.
I wish to speak briefly to two other amendments in the group. Amendment No. 108 would ensure that all personal data, other than those relating to staff, that are collected by a public authority would be eventually subject to all the data protection principles. In effect, that would be from 24 October 2007 in the third consecutive term of the Labour Government.
My amendment would mean that all personal data have the same status as accessible records which are the unstructured, manual, personal files that are held for the purposes of housing, health and social work. In addition, not only would public authorities have until 2007 to prepare for the change, but my amendment would apply only to data collected after 23 October 2007. The change is minimal but important. The amendment probes why the Government have stepped back from their undertaking to subject all personal files to a data protection regime.
It is relevant to compare clause 69 with equivalent provisions in the consultation document "Your Right to Know", Cm 3818. That document stated:
The Data Protection Act 1998 recognises four types of information about individuals as being personal data. They are information processed by automated equipment; information recorded so that it should be processed by such equipment; information recorded to be part of a relevant filing system, most notably information recorded in a highly structured manual filing system; and information recorded as part of an accessible record, which is that information open to access by previous Bills inspired by freedom of information, such as the Access to Personal Files Act 1987 which covered health, social service, housing and education records. It is noteworthy that such accessible records will, by 24 October 2007, be afforded the full protection of the Data Protection Act.
It should also be noted that unstructured information includes a significant file of personal information that many normal people would call structured. That includes papers in date order that all relate to an individual and perhaps have his name on the cover. That is made clear in the explanatory notes that accompanied the Bill and what was then the Data Protection Bill, which provide an example of the new variant of data. The notes refer to
Mr. Nick Hawkins (Surrey Heath):
I am following carefully what the hon. Gentleman has said. I shall, of course, have a chance to respond in detail. He has been talking about the contrast between the White Paper "Your Right to Know" and the Bill. Does he agree with what the Campaign for Freedom of Information has produced? It produced a sheet headed "Anger with the draft Bill as compared with praise for the White Paper?" Has the hon. Gentleman seen that, and does he agree with the campaign's analysis?
Mr. Cohen:
That is a much broader issue that covers many aspects of the Bill. I would probably agree in some instances and not in others. However, as I have been drawn on a specific issue, I shall say that there is clearly a difference between the Bill and the consultation paper. I hope that my hon. Friend the Minister will take it up when he responds to the debate.
Simply put, the Government's approach has some undesirable consequences allowing for such unstructured personal data to be, for example, processed unfairly, to contain irrelevant and excessive personal data, to remain
inaccurate and out of date, to be retained for ever and to be processed insecurely and transferred to any country, perhaps one where a tyrant is in charge. The purpose of the amendment is to place all personal data on the same basis as accessible records. From 2007--when accessible records have to comply with the data protection principles--I want other unstructured personal data to do likewise.
The objective of amendment No.109 is to correct an imbalance in the Data Protection Act. At present, if a member of staff deliberately sets out to flout the law, a number of punishments are available. Section 55 of the Act relates to unauthorised obtaining and disclosing. Alternatively, the provisions of the Computer Misuse Act 1990 may apply. In addition, Government often criminalise unauthorised disclosures directly in official secrets legislation, finance law and social security Acts.
We all recognise that if staff breach the rules, there should be the prospect of criminal sanctions if the situation merits it. I find it surprising that there is no counterbalance if an organisation or a data controller sets out deliberately to flout the same privacy rules. Let us suppose that a data controller knows that there has been a position established by the courts or a data protection tribunal on the need to inform individuals of all processing purposes in advance of any processing. What happens if that controller sets out to keep such details secret? Under the Data Protection Act or any other legislation, there is no effective criminal sanction.
The Data Protection Registrar can huff and puff and stop the processing, but he or she cannot apply a direct criminal sanction. It is a mechanism that allows some controllers to say, "We can process without any regard to data protection laws until we get caught."
If it can be established that an organisation has systematically and deliberately set out to invade privacy, a criminal sanction should be available. I am rather surprised that it is not. If an individual member of staff systematically and deliberately set out to invade privacy, a criminal sanction would be available. If my amendment were accepted, it would be an offence for a data controller deliberately to set out to process personal data in a way likely to cause a serious breach of a data protection principle. I am not defining any deliberate breach of a principle as being an offence, although I was tempted to do so.
4 pm
The Freedom of Information Act will be drafted so that it is compatible with the Data Protection principles.
It gave the impression that all non-automated personal information would eventually be subject to some or all of the data protection principles. It did not say that a freedom of information Bill would be drafted so that it would be exempt from those principles, but that seems to be the case with this Bill. Clause 69 is a long way from the compatibility promised in the consultation document.
a case file about an individual which contains correspondence about a number of matters relating to that individual and is indexed by reference only to the dates of correspondence.
That is why I believe that all personal data, irrespective of structure, should eventually be subject to the Data Protection Act 1998. That Act accords a good deal of protection to the information via its eight data protection principles.
| Next Section
| Index | Home Page |