Mr.
Kidney: When Parliament passed the Data Protection Act
1998, it was contemplated that data might be shared after the Act was
passed. There are exemptions and exceptions in the Act to permit data
sharing. The House of Commons research paper for the Bill, number
09/06, says that few of the exemptions and exceptions are blanket in
nature. That suggests that some of them are blanket in nature.
Exceptions are not something new in terms of allowing data sharing.
However, until now, when Parliament has felt the desire to allow data
sharing, it has had to pass specific permission through an Act of
Parliament. That same research paper talks about such provisions in the
Digital Switchover (Disclosure of Information) Act 2007, the Serious
Crime Act 2007, last year’s Education and Skills Bill and the
Pensions Bill.
I was at the
annual meeting of the parliamentary warm homes group at the end of last
year, where members of energy companies said to me, “If only we
could have access to information on who gets pension credit, we could
tell them that they could have energy efficiency measures done to their
homes completely free of charge. It would certainly reduce their Bills
and may actually save their lives.” They asked me whether I
thought that that was a desirable policy objective, and I must admit
that it is a tempting aim to want to save people’s lives and cut
elderly people’s fuel bills. Against that, do people in receipt
of pension credit want, without their permission, other people to know
that they are in receipt of it? That one example shows us how difficult
the issue
is. I
take exception to some of the comments that have just been made and to
some of the newspaper reports about the provision, because of the
complete absence of the Information Commissioner from the debate,
when his report started the entire enterprise.
Recommendation 8(a) of his report was
for “a
new statutory fast-track
procedure” to
allow data sharing. “Primary legislation”—it has
turned out to be the Bill—should
grant “the
Secretary of State...a power by Order...to remove or modify
any legal barrier to data sharing...or creating a new power to
share information where that power is currently
absent.” That
is an eye-opening recommendation, but it is the recommendation of an
office that the official Opposition find so trustworthy that he alone
among the organisations of this country should have the power, as we
heard this morning, to enter premises without a warrant, and yet so
trustworthy that in the afternoon his opinion is completely disregarded
and trashed. There should be some balance in the debate. The
Information Commissioner’s report and recommendations wrestled
with serious issues such as whether we can save the lives of elderly
pensioners at Christmas
time. The
commissioner went too far in his recommendations. The Government have
been given an inch and taken a mile—clause 152 is
unsatisfactory. I am happy to be on the record saying that. However,
the intention behind the clause is entirely honourable and probably
desirable. I would like there to be a section 152 in the final Act
after Royal Assent, but not in this
form.
Mr.
George Howarth: I want to identify with the point of my
hon. Friend. I do so with a particular apology to the Committee: having
taken part in the debate, I have a meeting at the Department for
Business, Enterprise and Regulatory Reform with a local firm shortly,
so I may not be able to stay for the entire debate. However, I make it
clear that my hon. Friend’s last point is a good
one.
Mr.
Kidney: Although I have not had a huge number of
representations from constituents, they have expressed concerns about
the clause as drafted—two in total, although one mentioned the
British Computer Society, which apparently also opposes the clause in
its present form. I assume that the society has a reasonable number of
members whom it is accurately representing in its objections to the
present provision.
When I became a
member of the Committee, it crossed my mind that I would want to table
amendments to the clause. I e-mailed the Information Commissioner
asking for a briefing to enable me to understand the issues and perhaps
identify what the right amendments would be. I do not criticise his
reply, but it was that, as I was a Member, I would hear his evidence in
Committee and get his memorandum like everyone else. I heard his
evidence and asked him whether he expected the Government’s
provision to enable a Minister to repeal by order the Data Protection
Act or the Human Rights Act. He said no, he had not appreciated that
that might be the consequence. I listened to his evidence and read his
memorandum, but together they did not quite give me the feel for what
the amendments should do to make some sense of the
clause. In
my exchange with the hon. Member for Cambridge, I asked if he thought
his amendments quite did it, and he said that he did not think that
they did. I have come to the conclusion that there will have to be
nothing less than a rewrite. When completed, the clause will have to
have a less complex definition of data sharing, a more agreed basis for
the weighing of different policy objectives—with the example I
gave about pension credit, one can see how two desirable things come
into conflict with each other—and something about how far the
order-making power can go in repealing primary legislation. Perhaps the
Information Commissioner did not appreciate what he was unleashing when
he made that suggestion in his
report. I
hope that the Minister will say that she understands the objections,
that she wants a provision such as this in the final Act, but that she
agrees it should be in a different
form.
Alun
Michael: My hon. Friend makes a valid point, and I agree
with a lot of what he is saying. However, he referred, as others have
done, to the capacity for repealing primary legislation, as if somehow
whole swathes of legislation could be removed as a result of the
clause. My reading of the intention is that it would merely remove
obstacles to data sharing where it is necessary to do so. Like him, I
think that there is probably a need for some redrafting, but is it not
right that there should be some capacity for removing unintended
obstacles that may occur in legislation from time to time, as long as
it is done in a manner consistent with data sharing
principles?
Mr.
Kidney: This is my final point. My right hon. Friend is
absolutely right. Certainly, the Information Commissioner thought that
there might be obstructions to data sharing at the margins of Acts of
Parliament that were not contemplated at the time, and that it would be
neat and tidy to put them out of the way now that we see that that is
desirable. He did not anticipate that an entire Act of Parliament such
as the Data Protection Act 1998 itself could be repealed by an order.
Does that mean that on a legal challenge, if the Government ever tried
to do such a thing, the court could say, adopting the purposive
interpretation of the Act, “I don’t think Parliament
intended the Minister to have that power”? Maybe. Of course now,
as a result of Pepper v. Hart, the judge could read the
contributions to our debate and say, “I’m sure
that’s not what was intended,” but it would be better if
the Bill imposed limitations to make it clear that that could not
happen.
Mr.
Boswell: I apologise to the Committee for my absence this
morning, which, sadly, resulted in my missing some useful prior
exchanges on this matter and related issues. However, we occasionally
have clashes, as was acknowledged by the right hon. Member for
Knowsley, North and Sefton, East, who is now leaving the Committee. I
do not take an absolutist view. I think that there are, properly,
arguments on both sides of the issue. I have listened to them with some
interest. I
start by declaring an interest, which I share with the right hon.
Member for Cardiff, South and Penarth. I am a member of the
Parliamentary Information Technology Committee, PITCOM, and now a
director of EURIM. I hasten to say—I exempt the right hon.
Gentleman from this—that I am not at the high-tech end of the
spectrum. I am at the end that concerns itself with the application of
public policy. When one considers the measures in the round,
one finds areas of concern on both sides, which is why I say that the
issue is one of
balance. As
the right hon. Member for Cardiff, South and Penarth said powerfully to
the Committee, there may well be national security implications. In
some interesting cases, data mining may be appropriate. I remember
reading a fascinating article that started with what one might call a
conventional appraisal. If someone is accessing jihadist material and
information about self-made explosives on the internet, they might well
be of some interest to the security services. On the other hand, one
can launder such interest by putting oneself down for an awful lot of
pornographic websites, which somehow throws people off the scent. I say
that because I have some idea of the
complexity. The
hon. Member for Stafford, reasonable as ever, made a point about a
cause that I share with him, which is warm homes. It would be nice if
one could just give the various fuel charities access to the pension
credit database so that they could give money to pensioners at
Christmas. At that point, one must realise that it is not always
necessary to break the principles of the Data Protection Act 1998 in
order to assess them.
My hon. Friend
the Member for Rugby and Kenilworth will be aware of a controversy
involving constituents of both his and mine and relating to admissions
to schools in his constituency. I have been approached on that case by
a number of parents. As they came from different sources, I have not
thought it proper to say, “Get in touch with Mrs.
X.” I have thought—I am sure that Members have different
practices—that the right way to do it is to say, “If you
wish to get in touch with a number of people who are organising
parents, I will supply that information if you like.” In other
words, the direct approach—“Who’s on pension
credit?” or “Who has said they’re worried about
the Rugby schools’ admission policy?”—is not
immediately transferable but passes through the membrane of consent.
That is a first and prior
defence. 2.30
pm Having
said that, consent is certainly not a sufficient solution to our
problems. The major area of concern, and why we should condition the
clause, is this. People are not concerned about criminality—we
do not expect the criminal to give consent for information to be
shared—but, on the other hand, in our day-to-day lives, we
implicitly give consent for our information to be shared in ways that
are sometimes a little sinister or even
eerie.
I have two
cases in mind. Like many people, I use the online system for renewing
my road tax, which works well. It suddenly occurred to me that the tax
people knew with which insurers I had concluded a contract. I also did
not know that I had given any consent to the Government to know that.
No doubt it was somewhere in the small
print. The
second case is similar. Because of a geographic anomaly—I live
in a different county from my postcode—for years, my wife had
not been able to get a protocol for online internet supermarket
shopping. When she eventually broke through, the supermarket said,
“Don’t worry, we’ll fill in your first
week’s order because we know exactly what you have”. They
knew the exact pattern of her shopping because, like many of us, she
holds a loyalty card from the supermarket. Nothing of that is improper,
and it does not directly involve the Government, but it is the kind of
thing that makes us sit up and
worry. The
important principle of consent must be balanced against the principle
of fighting crime and terrorism, and other major Government
policies—I agree with what was said on how wide those principles
have been taken. On the other hand, there is the feeling of public
unease and distrust. That is not simply about what data have been lost,
but, overall, that the general public may be losing control of the
situation. Having
mentioned the right hon. Members for Knowsley, North and Sefton, East,
and for Cardiff, South and Penarth, who are on the Government side, I
should like to mention my colleagues on the Opposition Front Bench. I
was wondering whether it was possible to call my hon. Friend the Member
for North-West Norfolk a Dave Spart-type radical, let alone my hon. and
learned Friend the Member for Harborough. I did not detect Dave
Spart-style radicalism in anything that they said, only in the passion
with which they expressed their reservations, which I
share. I
do not wish to detain the Committee as many of the issues have been
rehearsed, but I would like to make two or three points. The first is
on the question of discretion, which appears on page 101 of the Bill,
which uses the
words, “provide
for a person to exercise a discretion when dealing with any other
matter”. I
am anxious not to trespass on your indulgence, Mr. Gale, by
talking about another piece of legislation—my Exercise of
Reasonable Discretion Bill will shortly have its Second
Reading—which the hon. Member for Stafford, who I praised
earlier, has sponsored. The purpose of that Bill is to allow Ministers
to use their common sense. The difficulty is when the conditioning
under which that is done—the fact that Acts can be set aside or
whatever—is so fundamental that it might be considered a power
too far. I will be interested to hear any arguments that Ministers make
against that Bill on Second Reading because they could relate to this
issue. From
what I have seen of it, historically, one of the protections for the
citizen has been what I might loosely call the inefficiency of the
structure of government. Government has been organised in silos, and
substantially remains that way. Information does not readily and
totally flow across departmental boundaries, nor automatically between
Government and public authorities such as local authorities. Although
that is irritating, and
has given rise to some of the problems in both crime fighting and wider
areas of public policy that Government Members have talked about, it
has stopped the whole thing getting out of
control. As
technology changes and the information can be transferred quickly and
electronically and perhaps with insufficient safeguards under the
clause and its amendments, so it opens a much wider access to
information. Something that I have banged on about twice before in this
Committee, but I will say again, is that I am concerned about what the
private sector will do when information is passed. Should it be
conditioned to enclose only those fields of information that are
appropriate?
There is a
danger, at the moment, that if it is agreed between Department A and
Department B that this information should be passed and that there
should be an information sharing order which overrides legislation, at
that point they get the crown jewels, the whole lot, not the relevant
portion of the
file.
Alun
Michael: The hon. Gentleman referred earlier to membership
of PITCOM and other parliamentary bodies. I am not sure that that is a
declaration of appropriate interest, although I agree that they exist.
Does he agree that there is information that sometimes ought to be
shared across public bodies and does not flow because of the
difficulties of getting that information across? Does he also agree
that there should be a capacity for requiring those bodies to share
appropriate information and to do so in accordance with data sharing
principles?
Mr.
Boswell: I would need to look at the small print, but the
way the hon. Gentleman expressed it—as reasonably as
ever—is acceptable. However, he has conditioned it within the
data sharing principles and not as subverting those principles. One
should not subvert primary legislation unless there is a specific
reason for doing so. I am not an absolutist; there are arguments for
instances where we should share more information, and that is what the
Thomas and Walport review was about. We need to find sensible,
practical conditions, which are not completely set by the
clause.
I have
suggested one condition that can be dealt with in a data-sharing order.
There should be field protection—not necessarily the whole file
passing, but only those relevant portions. The second point that
concerns me is passing on information. Again, the Bill provides for the
sharing of information, including the private sector, and its being
passed on to third parties. There is no doubt that when people join the
public service and become civil servants they sign the Official Secrets
Act and are conditioned. However, those protections tend to become
attenuated outside the public sector, let alone outside the
jurisdiction and overseas.
My third
point—I am not sure whether it has already been made and forgive
me if it has—is the question of any financial nexus involved. I
see no reference to finance—I may have missed it—and
whether a designated authority might, in pursuit of its policies,
charge for information and if so, on what basis. Would it be a cost
recovery charge, or would there be an attempt to make a commercial
profit? It could be argued that, if the public expenditure survey had
been particularly tight and the authority was a bit short of money,
securing a relevant policy objective might include raking in some
value. If such commercial purposes were allowed, that would put a
rather different construction on the motives for transferring the
information.
We all share
some disquiet about the specific drafting, some understanding that
there is probably a need for change in this area, and some wish to
produce a less enabling provision that is better conditioned as to the
type of information, occasion and safeguards. We will all express that
to different effect and we look forward to the Minister’s
response.
This is not an
issue affecting only the United Kingdom. A number of Committee members
are involved in the Parliamentary Assembly of the Council of Europe. I
have started putting toes into the water as to whether we might try to
press for a European-wide convention on data sharing. We would want it
to be pretty wide, like most Council
conventions. My
motive in putting it forward is that I have been reading articles on
the French concern about the so-called EDVIGE system, which concern
what information can be kept together. In virtually all Western
countries where liberties are regarded as important, one finds that
these issues are around. In the end, they came back to my wife’s
feeling of unease about the supermarket knowing what she spent her
money on. She understands why that happens, and she certainly
understands that she has implied consent for it. However, if we feel
that people are taking over from us, we lose all
faith. The
convenience and exigencies of Government, and even the real issues
about terrorism, do not by themselves justify selling civil liberties
lightly. If we have to do it—it is a sad analogy, but I will use
it—I would much rather that we gave ground like a first world
war general, fighting for every inch, making every bit of the case. We
should not have the general enabling powers in clause 152, which might
be used appropriately in some cases by present and future Ministers,
but, sadly, we can be fairly certain that in some cases they will
not.
| 
