Examination of Witnesses (Questions 60-79)
25 JANUARY 2005
MR FRANCIS
ALDHOUSE AND
MR JONATHAN
BAMFORD
Q60 Chairman: May I welcome you to the
second session this afternoon? May I ask you to identify yourselves
for the record?
Mr Aldhouse: Chairman, I am Francis
Aldhouse. I am one of the two Deputy Information Commissioners
and I have with me, Jonathan Bamford, one of the Assistant Commissioners
who specialises in some of this work.
Q61 Chairman: Do you want to say anything
by way of introduction, or are you happy for us to go straight
to questions?
Mr Aldhouse: May I just say something
very briefly by way of introduction? The first is to thank you
and the two committees for the opportunity to give evidence and
the second is to extend to you the apologies of the Commissioner
for being unable to be present himself. When the invitation to
give evidence came to us, the Commissioner was already committed
to give evidence yesterday to the Education and Skills Committee
and he felt that he could not properly do justice to your work
by cramming the two together so he asked me if I would undertake
the duty. I hope that I am able to help you adequately.
Q62 Mr O'Brien: As you know, we are looking
at individual registration. Do you believe that making individuals
responsible for their own electoral registration is the right
principle?
Mr Aldhouse: In principle we are
strong supporters of individual registration, from a data protection
point of view. The idea is that if you are collecting information
about individuals, you should, whenever possible, try to obtain
it from that individual; you are obtaining it from a more reliable
source. We do recognise—and I listened to the previous evidence
from the Electoral Commission—that there are other issues
to be taken into account. I can try to help you about how to weigh
the data protection issues; I do not say that they should prevail.
Q63 Mr O'Brien: Moving away from the
household submission for registration to individual registration,
does this raise any particular problems for data protection? Would
you require any additional safeguards for individual registration
over the household registration?
Mr Aldhouse: That is why I said
that this is a complex matter where you have to weigh things.
Yes, one of the issues would be what sort of identification was
required when somebody registered. At the moment, I suppose the
assurance an electoral registration officer has is that a household
is a reasonably fixed entity based on a location and, by other
means, you can usually identify who the senior person is who says
he or she is the householder. There is a difficulty if an individual
gets in touch with the electoral registration officer by whatever
future means are contemplated and what assurances will be required
that this is a genuine individual entitled to be on the register.
That still needs to be thought through to safeguard as much as
anything the democratic process, rather than the specific individual.
Accurate identification is a data protection need.
Q64 Mr O'Brien: Could I just press you
on a matter which was submitted in your written evidence, paragraph
14? When you referred to the move from the household to the individual
registration, and I quote, you said "This would in effect
constitute a compulsion for individuals to provide information
about themselves, and therefore to appear on the electoral register,
with the likely effect that the information would be more accurate.
The benefits of the most complete electoral registration in a
democratic society carry great weight. Parliament might wish to
count these benefits more highly than the loss of individual freedom
caused by compulsion". Are you referring to compulsory registration
there?
Mr Aldhouse: We are assuming that
registration would be compulsory, just as, in a sense, it is at
the moment in that householders are bound by law to make a return.
We are assuming that there would be a similar duty on individuals.
Looked at from a purely narrow data protection point of view,
requiring individuals to give information about themselves is
an important issue which has to be thought about. It might well
be that the democratic process is so important that it should
be done in this case. That is why we put it the way that we did
in the paper.
Q65 Mr O'Brien: But it is not an offence
now if the head of the household, or whoever completes the forms,
does not provide all the information. Are you saying that it should
be an offence if all the information being sought by the electoral
registration officer is not provided?
Mr Aldhouse: We have not constructed
a specific offence. It is of course a duty on the householder
to make a return when canvassed and we had assumed that, by analogy,
such a duty would fall on the individual. Of course it would have
slightly different consequences, but if our assumption were correct,
then it would in effect mean that the individual was bound to
make an accurate return about him or herself and one should weigh
whether that is the right course to adopt. We suggest to you that
you might think that it is right, even though it is a strong form
of individual compulsion.
Q66 Mr Clelland: The Commissioner is
apparently a fan of on-line and telephone registration under certain
circumstances. Should a paper-based system ever become solely
electronic? Could you say something to the Committee about the
advantages and disadvantages of each, in data protection terms?
Mr Aldhouse: The reason why we
are supporters of electronic and new technology ways of collecting
information, I suppose goes back to the origins of data protections
in that they were safeguards for individuals in a new technology
world and we certainly do not believe that data protection is
a reason why you should not adopt new technology ways of achieving
these old processes. Indeed, if the safeguards are adequate, it
should make it possible to adopt these new means. That, as it
were, is a philosophical standpoint that yes, in the way that
you put it, we are a fan of these new methods. The problems in
this context of the new methods will be as much as anything to
do with the fact that we are talking about individual rather than
household returns and issues about the identification of the individual.
I suspect that that will prove to be the most difficult issue.
How do you identify individuals at a distance through electronic
communication means? Some of this is dependent on other issues.
If we were to go the route in this country of identity cards with
chips on them, then one could contemplate a technology which would
provide on-line identification. There are other ways of providing
on-line authentication: the sort of systems which have been adopted
by the Inland Revenue, for example.
Q67 Mr Clelland: I am sorry for interrupting
you, but we understand all the possibilities of technology. What
we are concerned about from your point of view is the data protection
implications involved in this.
Mr Aldhouse: The data protection
implications are that you should identify people as well as you
can. It is important that you identify people well, partly to
protect their identities and partly to avoid identity theft. That
is probably the principal implication is this case. The other
important element I am reluctant to claim as a data protection
issue is the accuracy of the register. You would probably want
to see that as a democratic issue rather than specifically a data
protection issue.
Q68 Mr Clelland: For instance, what security
safeguards and what checking procedures could be used in order
to allow telephone registration?
Mr Aldhouse: We have not set about
constructing a way of implementing a system. We could point to
systems used by other people, such as, for example, those who
run telephone banking. I was talking about the sort of system
used by the Inland Revenue, where you have user identification
and passwords. Whether these are appropriate in the particular
context, particularly bearing in mind the issues I know the Committees
are anxious about of disadvantaged groups, might be debatable.
One could construct security measures. We have not actually set
out to do that yet.
Q69 Mr Clelland: So despite the fact
that the Commissioner and the Commission have made it clear that
they are in favour of on-line and telephone registration, you
do not seem to have looked very deeply into what the security
implications of that might be.
Mr Aldhouse: We are, in principle,
in favour. We do not think that the security issues as such are
distinguishable from the identification issues. They are issues
which are the subject of fairly extensive debate at the moment
in technical IT circles. We would not see it as our job to construct
a system.
Q70 Mr Clelland: What about people who
are unable to register unaided and need to give information to
a third party in order to register individually? What are the
implications of that in data protection terms?
Mr Aldhouse: We see that as perfectly
legitimate. In principle there is no data protection problem about
using anyone as an agent to help you. You could construct scenarios
in which the information was abused by the person to whom it was
given to help, but I cannot say that we are greatly anxious about
that. This is an issue which arises in many circumstances and
it is perfectly acceptable from a data protection point of view
to ask somebody to help you.
Q71 Adrian Sanders: In your evidence
you support anonymous registration, comparing it to telephone
subscribers choosing to opt out of the phonebook. Is there not
a problem there in balancing your requirements for public scrutiny
of the register with the rights of individuals who do not wish
to have their records recorded?
Mr Aldhouse: On reflection, I
wish we had perhaps not used that example. I think we made it
clear in our evidence, at least in the conclusion, that we do
not believe that full anonymisation is possible, nor indeed proper.
At the end of the day, you, the individual, have somehow or other
got to demonstrate to the electoral registration officer that
you are entitled to vote and be on the register. We believe that
there are several classes of people who have a very good claim
to protect their address. You can think of those who are perhaps
the subject of a witness protection programme or battered wives
or others who are trying to hide their address entirely legitimately.
We really quite strongly believe that there is an argument for
seeking to protect them by what would be pseudonymous registration.
They would register under some code or something like that, but
some means of keeping off the publicly available register the
name linked to the address of these people who do have a good
claim for protection. That has consequences, because once you
create a group like that, that information of itself has a value,
has importance and needs to be protected. In the light of our
experience, we know that there are investigators out there who
would be trying to obtain the information.
Q72 Adrian Sanders: Are there any other
types other than the ones you have described for trying to enhance
the privacy of people other than setting p a category of people
which could eventually be identified? Is the reality actually
not that there is no answer to this question?
Mr Aldhouse: There is not a cut-and-dried
answer. It is a case where you have to weigh considerations. I
can try to help the Committee, as I do not think it is for the
Information Commissioner to force a view on you. We do think that
the categories I mentioned look as though they are very good candidates.
You might well take the view that those who just do not wish to
be on the public register, just as they do not wish to be in the
telephone directory, are at the weaker end of the case. It depends
how the register is used. This comes to a general position of
the Commissioner that the electoral register exists to assist
the electoral process and our democratic processes. It should
be used for that purpose and only for other purposes where strictly
necessary and justifiably so.
Q73 Adrian Sanders: If that is the case,
if your view is that the electoral register is there for electoral
purposes first and foremost, then surely people who do not engage
in the electoral process, Jehovah's Witnesses for example, have
a complete right not to be upon the electoral register.
Mr Aldhouse: That might be so.
We would not want to express a view on that, because it is not
particularly a data protection issue. I could well see how that
position could be maintained and we would certainly not see anything
objectionable about it in data protection terms. You might well
see it as assisting some other issues, but I do not think the
Commissioner has a data protection viewpoint on that particular
matter.
Q74 Adrian Sanders: We have a restricted
register at the moment and under freedom of information legislation,
the public do not have access to it. Should the freedom of information
legislation be amended to allow the public the right to look at
the restricted electoral register?
Mr Aldhouse: Freedom of information
legislation of course is another balanced piece of legislation
with a general principle and a number of exceptions. There are
some very good reasons why the restricted information is kept
restricted. I would not want to argue to you today that those
restrictions should be abandoned.
Q75 Chairman: Is it really kept restricted?
As I understand it, any political party has a right to see the
full list, do they not? So presumably, if you decide to stand
as an independent in an election, you have the right to see the
full list.
Mr Aldhouse: Chairman, you are
doing two things: you are taxing my knowledge of electoral law
beyond its capacity and strength and, secondly, you have raised
one of the inherent difficulties. Yes, a lot of the practices
about access to the electoral register can be worked round and
of course there is some anxiety given the position we have taken,
which I expressed earlier.
Q76 Mr Clelland: Without going into any
of the complexities of the electoral law, do you have any difficulties
in principle, if there is going to be a requirement on electors
to give personal information such as their date of birth, their
National Insurance number, addresses and signatures in order to
be registered? What safeguards should exist in order to protect
the rights of individual in those circumstances?
Mr Aldhouse: These safeguards
that I am going to mention are based on classic data protection
approaches. The first safeguard is why you want the information,
what the purpose is and it is to construct an electoral register.
You have a narrow purpose and that enables you to minimise the
amount of information you need to construct the register. You
do not obtain information because it might come in handy or because
it might be convenient for some other secondary distant user of
the register. The sort of information which you are talking about
is potential information to help identify the individual more
accurately; that might be necessary. Is it necessary to keep it
on the register itself? That is another issue: it does not necessarily
have to be there. I think that that would be the way we would
go about suggesting safeguards, that is: narrowness of purpose,
minimisation of the information and minimising the information
that appears on the public register and, as a sort of corollary
of that, adequate security safeguards and access rules about obtaining
the remaining information.
Q77 Sir Paul Beresford: Evidence from
one interested group in this particular area says that there is
an opportunity for scope for additional information to be stored
on that database. In other words, rather than just going for the
minimum required information, they look for somewhat more. Have
you any thoughts on that?
Mr Aldhouse: Wrong in principle
from a data protection point of view.
Q78 Mr Clelland: If a requirement were
introduced for pin numbers, signatures or photo cards, what would
be the key issues that would have to be considered?
Mr Aldhouse: I am sorry, but I
think I end up repeating myself because it does not necessarily
matter what specific information it is. The question you would
have to ask is: given the limited purpose and trying to make the
purpose as narrow as possible, do we really need this information?
It might be that you take a balanced view about what is necessary,
what is proportionate in order to identify the individuals. You
suggested a pin number system, perhaps a new system like that
would be necessary. In that case, I think we would be saying:
how is this information going to be stored, is there a risk of
it becoming available so it permits another form of identity theft
and it permits people to quote this number and people will tend
to assume that the person quoting the number is indeed the person
to whom it refers, as has happened with pin number systems abroad?
However, it is very difficult to construct a system or a set of
rules in isolation from a specific proposal for a system.
Q79 Chairman: I cannot remember my pin
number from one week to the next when I use it for my credit card.
How would someone really be able to remember their pin number
if they only voted once a year?
Mr Aldhouse: Chairman, I am not
trying to urge upon you a pin number system. I was merely trying
to respond to the suggestion that this might be one way of doing
things. The issue does arise about the practicalities of that
and if you did have a pin number system, is that in order to assist
the voting process when someone has actually got onto the register,
or how would it actually relate to identifying the individuals
in order for them to get onto the register? For that, you need
to look at other information. Here at the moment we are faced
with a difficulty, a certain circularity. One of the principal
elements in identifying individuals at the moment is the electoral
register. I do not think either we in the Information Commissioner's
office or others have yet properly addressed how we are going
to avoid that circularity.
| 
