Clause 21
Use for correcting inaccurate
or incomplete information
Mr. Allan: I beg to move amendment No. 177, in page 19, line 22, at end insert—
'(2A) In such a case, the Secretary of State shall notify the individual in writing that he has taken action under subsection (2).'.
The Chairman: With this it will be convenient to discuss the following amendments: No. 194, in page 19, line 22, at end insert—
'(2A) The Secretary of State shall notify the individual concerned in writing and within 30 days.'.
No. 179, in clause 23, page 20, line 14, leave out 'and'.
No. 180, in page 20, line 17, at end insert
(c) notifying the individual of the fact that the information has been provided.'.
Mr. Allan: Amendment No. 177 seeks to ensure that where the Secretary of State is correcting information, he will notify the individual in writing. I hope that we will get some additional clarification on that from the Minister and examples of where it might occur. For example, I understand that if somebody comes forward with some evidence about their registrable facts, perhaps because they have applied for a passport or something else, and some of the information held by Departments is incorrect, that information will be corrected. It would be helpful if the Secretary of State could authorise that information to be corrected on behalf of the individual.
It would also be helpful to understand the scope of the clause. Is it intended simply to relate to the information that the individual has provided to demonstrate the registrable facts, or will it be broader? If an error is picked up, can the Secretary of State go to a range of Departments that might be using the identity register and seek to correct their information? We have sought in this group of amendments—particularly in amendment No. 177—to ensure that the individual is told where that occurs.
Amendment No. 177 is important in the context of the data protection principles, which are clear: an
Column Number: 337
individual has a right to have data about them corrected if it is inaccurate and the data subject, the person, has a set of rights in relation to the data that is held about them. We are concerned that the clause would allow the Secretary of State to amend an individual's personal data—potentially across a range of Departments—without them being told about it. That would be in breach of the principles of data protection.
The amendment seeks to ensure that the individual is told in writing that a correction has been made. Amendments Nos. 179 and 180 would ensure that the rules that will be established by regulation on how an individual's data is used without consent, to which we will come in clause 23, also ensure that an individual is told about that.
It is important in data protection and potential legal liability terms that when we come to clause 30 we discuss the provision of false information. An individual is liable to prosecution if they knowingly, recklessly, or in some way, with some criminal intent, present registrable facts incorrectly. There has to be a question as to whether the Secretary of State's correcting data about registrable facts will lead to criminal proceedings against an individual. An individual needs to be able to clarify whether they are seen as an innocent party who simply inadvertently provided inaccurate information, or whether they will be treated as potentially a criminal suspect under clause 30 and prosecuted for the provision of that inaccurate information. From the individual's point of view, it is important that there is transparency and clarity. If the Minister is unable to accept our amendments, it would be helpful if he would give a little more detail about how the measure will work in practice.
10.15 am
Mr. Browne: I do not want to make a mountain out of molehill in relation to this. Clause 30(2) states that a person is guilty of an offence of providing false information only if the circumstances at the time of the provision of that information are that he
''(a) knows or believes the information to be false; or
(b) is reckless as to whether or not it is false.''
The answer lies in clause 30.
Mr. Allan: I am grateful to the Minister for that explanation. However, there are difficulties with the test of knowing or believing that the information is false, and we will discuss that later.
Let us start with the facts. An individual presents some information to the authorities and that information is deemed to be incorrect. Someone then needs to determine whether the individual knew or believed it was incorrect when they presented it. There is a potential interaction with clause 21, which says that the Secretary of State must ascertain that the information is incorrect. The question that our amendment poses is, should the individual be told at that point, so that whether there was knowledge or belief can be clarified by the individual engaging in a
Column Number: 338
discussion with the Secretary of State about that false information in an open and transparent process? Of course, if the Secretary of State comes to the view that the individual knew or believed the information to be false when they presented it, the Secretary of State might wish to pass that on to the Crown Prosecution Service.
However, our concern is that a considerable process of correction and examination of inaccurate data might take place without the person about whom that inaccurate data has been presented being told. It would be more consistent with data protection principles if they were told up front. That would in no way preclude the Secretary of State from launching a prosecution if it turned out that the clause 30 threshold had been reached, but in order to establish that, the individual would need to be in a dialogue about the inaccurate data at an early stage. Our amendments would ensure that that dialogue took place. That would be a better regime to have than one in which the Secretary of State was arbitrarily, or without the individual's knowledge, correcting data about them. That might create problems.
I hope that the Minister can at least accept the principle that, in ideal circumstances, an individual should be engaged in discussion about their inaccurate data. I hope that he can clarify further how things will work in practice when I or you, Mr. Conway, or anyone else, has presented a document and the Secretary of State feels that it is inaccurate and wishes to use the clause 21 powers to correct it. What information will be provided to the individual?
Mr. Malins: The hon. Gentleman has done the Committee a service by tabling his own amendment to this clause, but I want to speak to my amendment.
Amendment No. 194 would insert:
''The Secretary of State shall notify the individual concerned in writing and within 30 days.''
The Minister will take the view, which many people will understand, that there must be occasions when information is provided about an individual—to the security services, perhaps—and that individual is not informed about it; reasons of national security might be involved. However, this clause addresses a different matter. It deals with correcting inaccurate information about an individual, which is an entirely different scenario. It strikes me as exceedingly odd that the one person who is kept blissfully unaware of any such transaction, which is merely a correction in terms of accuracy, is the individual concerned. They are kept completely out of the loop.
My amendment would rectify that unfortunate omission. I firmly believe that the correction of something inaccurate on the register, is—I use the word perhaps not in its true meaning—an innocent exercise. There can be nothing sinister behind that or, if there is, the Minister has a duty to tell us. Therefore, plainly, the individual should be told.
I feel strongly about the amendment. Opposition Members speak, as so often in debates in this House, on behalf of the individual. That is what we strive to do, and the hon. Member for Sheffield, Hallam has a similar distinction. He too has tried to represent the
Column Number: 339
interests of the individual against the interests of the state on many occasions.
The Minister has a great deal of explaining to do to justify not accepting our amendment. Looking at the history of amendments tabled during consideration of the Bill, my hon. Friends and I regret that many have not been accepted. This could genuinely be accepted by the Minister. He could simply say, ''Yes, all right, if we are correcting inaccurate information on the register, we can see no justification for not telling the individual in writing what we have done.'' After all, it might reassure the individual.
Mr. Browne: It would be opportune if I gave slightly more information than I have hitherto been able to about my understanding of the Data Protection Act 1998 and its interaction with this Bill, and I will do so at the appropriate point in my remarks.
Amendment No. 177 would make it a requirement to notify an individual in writing if information has been provided about him to another person under clause 21. Amendment No. 194, which is similar in effect, would require the written notification to be given within 30 days. In principle, both of these amendments are much the same. Amendment Nos. 179 and 180 together would add a power to make regulations about notifying an individual if information has been provided without his consent under clauses 19 to 22.
First, I will take the two amendments on the correction of information. The clause was drafted so that where the identity checking process has identified inaccuracies or omissions concerning information provided, the Secretary of State may notify the person or organisation who provided that information of the details of those inaccuracies or omissions.
Dealing with one of the points of the hon. Member for Sheffield, Hallam, corrections can be made only to the person or organisation who provided the information and not across Government. The relationship of communication is between the organisation that provides the information and the register. It may be as simple as if a person gives a proper spelling of a name and, in verification, an organisation has another spelling. That can then be corrected and the organisation told which spelling of the name is appropriate—for example, ''Allan'', with two l's, not one. That is logical and not disputed. The concern is whether or not the person involved should be notified that that communication has taken place.
The Government's position is that any person concerned that information has been provided without their knowledge or consent, or, indeed, any information provided at all, has data subject access rights under the Data Protection Act. That is entirely appropriate. At this stage I will explain to the members of the Committee what those obligations under the Data Protection Act are. I will show what already pertains in plain language—the Act is not always the most immediately accessible piece of legislation.
Under the Data Protection Act, the obligation to notify applies ''so far as practicable''. Where the
Column Number: 340
information has not been obtained from the data subject, the obligation does not apply where the provision of information would involve a disproportionate effort, or the recording of the information to be contained in the data by, or the disclosure of the data by, the data controller is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.
Furthermore, the obligation to notify is subject to the general exemptions under part IV of the Act. I refer, for example, to the first data protection principle, to which the hon. Member for Sheffield, Hallam referred, including the right to notification, which does generally not apply where non-compliance is necessary for the purpose of safeguarding national security or for the prevention and detection of crime. The Government are content to rest with that obligation being on those who have responsibility for the register because the obligations to notify have already been enacted by Parliament in the legislation to comply with the European Union directive. The standards have been set for such organisations and it would not be appropriate therefore for a series of different standards to apply to data in respect of the register, when complying with the Data Protection Act could be the appropriate standard.
| 
