Coroners and Justice Bill - Justice Committee Contents

3  Information Commissioner

18.  The Coroners and Justice Bill contains a number of provisions relevant to data protection and the role and powers of the Information Commissioner. Principal amongst these are:

  • power for the Information Commissioner to carry out an independent assessment to determine whether a public body has complied, or is complying, with data protection principles and issue an assessment notice which will require the relevant body to take remedial action if necessary;
  • responsibility for the Information Commissioner to issue a code of practice covering the new process of assessment of compliance with data protection principles;
  • power for Ministers to make "information sharing orders" to enable a data-controller to share information that consists of, or includes, personal data (for example when information collected by one Government department for one purpose is desired to be used for another purpose by another department);
  • responsibility for the Information Commissioner to issue a data-sharing code of practice containing guidance promoting good practice in the sharing of personal data, including, but not limited to, compliance with the requirements of the Data Protection Act 1998; and
  • adding to the Information Commissioner's existing powers of entrance, search, inspection, examination, operation and seizure, the ability to require persons on the premises to provide an explanation of any document or other material found there and to provide other information reasonably required for the purpose of determining compliance with data protection principles.

In a complementary development, the Government intends to increase the Information Commissioner's income stream from data-controllers by moving from a flat-rate £35 per notification to a variable rate depending on size of organisation.

19.  In our most recent report on data protection—undertaken in response to HM Revenue and Customs' loss of personal data belonging to child benefit claimants—we said we were "extremely concerned" at the Information Commissioner's prediction of further cases of Government losing personal data which had yet to come to light[16]. In January 2009, the Information Commissioner summarised the situation as 277 data breaches, some minor, some serious, of which he was investigating 30 under his system of prioritisation.[17] In our original report, we drew the following conclusions:

  • there was an anomaly in the fact that the same annual data protection notification fee, £35, was paid by each data-controller whether an individual, small business, large company or government department and a graduated rate would be more appropriate and effective in providing resources for the policing of data protection;
  • there was evidence of a widespread problem within Government in establishing and operating effective systems for data protection;
  • there was a consensus that the Information Commissioner needed a substantial increase in powers to enable the effective review of systems of data protection and their application; and
  • there was a difficult balance to be struck between the potential value of exchanging information between Government departments and the risks of such practices for effective data protection[18].

20.   We welcome the Government's acceptance of our recommendation on data protection fees and look forward to the announcement of a scheme that will, in the words of the Ministry of Justice, "better reflect the level of work and provide additional funds" for the Information Commissioner.[19] We would hope that this 'additional funding' is not just to cover further increases in workload as a consequence of the Coroners and Justice Bill. We note that the Government estimates that the bill's provisions will give rise to additional costs for the Information Commissioner's Office of £8.5 million in 2009-2010, £6 million in 2010-2011 and £6 million in 2011-2012. We believe that it would be most helpful if the details of the resources to be available to the Information Commissioner via graduated data protection notification fees were to be published before the second reading of the Coroners and Justice Bill and we recommend that this information be made available at the latest before the relevant provisions in the bill are reached in public bill committee.

21.  The provisions in the Coroners and Justice Bill on data-sharing appear to grant Ministers fairly sweeping powers, via secondary legislation, to grant anyone holding information that consists of, or includes, personal data the authority to share that information with anyone else; albeit for purposes that are necessary and proportionate in relation to the policy objective and strike a fair balance between the public interest and those of affected individuals.[20] This secondary legislation will come under affirmative resolution procedure, thus guaranteeing debate in delegated legislation committee, if not the floor of the House, on each occasion.

22.  We note two safeguards to be operated by the Information Commissioner. The first is that he must prepare the data-sharing code of practice (described above)—to be approved by the Secretary of State and not disapproved by Parliament under the procedures for negative resolution. Given the significance of the proposed data-sharing code of practice in governing the practical application of policy in this area, we recommend that the Government bring forward amendments to the Coroners and Justice Bill to provide for Parliamentary scrutiny of any draft data-sharing code of practice, or amendments thereto, under affirmative resolution procedure, thus ensuring the opportunity for debate and a vote in both Houses.

23.  The second safeguard, relating to specific cases, is that the Commissioner may submit a report to Ministers on whether or not he is satisfied that the effect of a proposed order would be proportionate to its policy objective, and that the order strikes a fair balance between the public interest and the interests of any person affected by it.[21] Such a report must be laid before Parliament alongside the relevant draft order.

24.  In scrutinising the provisions of the Coroners and Justice Bill relating to data-sharing, we recommend that the House pays particular attention to:

  • the scope of the data-sharing order-making powers granted to Ministers and the potential for safeguards in relation to such scope to be included on the face of the bill;
  • the likely practical effects of a data-sharing code which will not be legally binding but may be taken into account by a court, tribunal or the Commissioner, in determining a relevant matter; and
  • the likely capacity of the Information Commissioner, within the resources available, to undertake effective investigations, analyses and consultations, as well as the production of reports, within the 21 days notice set out on the face of the bill in relation to individual draft orders.

25.  In addition, it is unclear whether the bill deals with the situation where it may be in the public interest for the personal data in question to be shared, but the body holding that data makes no application to do so.

26.  In 2005-06, the Constitutional Affairs Committee concluded that there was merit in the Information Commissioner becoming directly responsible to, and funded by, Parliament and this should be considered when an opportunity arose to amend the relevant legislation.[22] The Government noted our predecessor's conclusion and replied that it was satisfied that the present arrangements provided for independent decision-making by the Commissioner while permitting the proper scrutiny of public resources.[23]

27.  We agree with the case put forward by the previous Committee and, in the light of a suitable opportunity having arisen to amend the legislation, we recommend that the Government bring forward amendments to the Coroners and Justice Bill to allow for consideration of the case for making the Information Commissioner directly responsible to, and funded by, Parliament.

16   Justice Committee, First Report of Session 2007-08, Protection of Private Data, HC 154 Back

17   Oral evidence from Richard Thomas, Information Commissioner, 13 January 2009, uncorrected transcript (to be published as HC 146-i) Back

18   HC (2007-08) 154 Back

19   Ministry of Justice Press release 24 November 2008 Back

20   Bill 9 - Explanatory Notes, 54/4, paragraph 694 Back

21   Ibid, paragraph 712 Back

22   Seventh Report from the Committee, 2005-06, Freedom of Information-one year on, HC 991, para 108 Back

23   Cm 6937, October 2006 Back

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2009
Prepared 23 January 2009