Modern Slavery Bill

Written evidence submitted by the Information Commissioner (MS 37)

1. The Information Commissioner has responsibility for promoting and enforcing the Data Protection Act 1998 (DPA), the Freedom of Information Act 2000 (FOIA), the Environmental Information Regulations (EIR) and the Privacy and Electronic Communications Regulations (PECR). He is independent from government and upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The Commissioner does this by providing guidance to individuals and organisations, solving problems where he can, and taking appropriate action where the law is broken.

2. Clause 44 of the Modern Slavery Bill (‘the Bill’) stipulates a duty on public authorities to notify the National Crime Agency (NCA) of cases when there are suspected victims of slavery or human trafficking. This model is based on the consent of the suspected victim (in the case of adults aged 18 and over) being provided in order for the information to be shared with the NCA. The situation is different for children in that the information will be disclosed in any event.

3. The disclosure to the NCA will be based on public authorities possessing a ‘reasonable belief’ that an individual is a victim of slavery or human trafficking. It is important to highlight that, in cases where a reasonable belief exists, the DPA should not be regarded as a barrier. So, for example, in the case of children, if the disclosure is lawful, necessary and justified then that information could be disclosed and be fully compliant with the DPA. It is important that any guidance that may be issued in regard to disclosure will need to be clear so that there is no risk of excessive or irrelevant information being disclosed to the NCA, in keeping with the third Data Protection principle which requires that data should be relevant and not excessive.

4. The disclosure will be based on the consent of victims in the case of adults. For consent to be valid it must be specific, freely given and informed. It must also be capable of being withdrawn at a later date. There may be substantial difficulties in meeting this test if a victim fails to understand the information provided to them, to what it relates and whether they believe they have a realistic choice now or in the future. Given those who may be victims may not have English as their first language and not understand the UK law enforcement system or the role of the NCA, there may be practical difficulties in adopting this approach. Any model which is based on consent can cause potential difficulties in terms of the issues which arise when the victim does not consent to the sharing of data. If this processing is to be based on consent, then consideration will have to be given to those cases where the individual has not consented. In this context we would anticipate that consent may be difficult to achieve, and therefore may not be the most effective condition to rely upon for the disclosure of information. Alternative conditions for processing are likely to be available under the DPA, which would obviate the need to rely on consent in those cases where there is a reasonable belief that an individual is a victim of slavery or human trafficking.

5. Not having consent could be limiting if public authorities are not able to share when there may be other overriding public policy justifications for doing so. Consideration should therefore be given to whether basing the model on consent is really an effective safeguard, bearing in mind those cases (which may be serious and warrant sharing) when a victim does not consent.

6. It appears that personal data may also be shared with the new Anti-Slavery Commissioner (‘the Commissioner’). The Commissioner will therefore potentially become a data controller in their own right (if they are independent of the Home Office) and consideration will need to be given to what information they will be processing and for what purpose. It will be important that they are aware of their responsibilities both under the DPA and FOIA as it appears that the Commissioner will be subject to FOIA.

7. The practical implementation of these provisions will need to be given careful consideration to ensure that appropriate and effective safeguards underpin these provisions. However, if the sharing is carried out on a case by case basis, based on guidance on what is a ‘reasonable belief’ together with supporting information in the Regulations which will be laid by the Home Secretary, then this may ensure that the sharing is a proportionate response to the problem which is trying to be addressed.

8. We would always advise that a Privacy Impact Assessment (PIA) should be undertaken when a new initiative is being introduced which involves the sharing of personal data. We would suggest that one is undertaken in terms of these provisions so that all the potential privacy risks are identified at an early stage and to ensure that these are addressed or managed as this initiative proceeds.

Christopher Graham

Information Commissioner

October 2014