---

Lord Mackay of Ardbrecknish: The position on this Bill is that we are here providing a clear legal basis for the data-matching exercise under the Bill so that the disclosure of information for this purpose--say, from the Inland Revenue to the DSS--will be lawful under the Data Protection Act. As regards the powers of the registrar, the Data Protection Registrar can issue enforcement notices against a department if she believes that the data protection principles are being breached. She has existing powers. As I have said, we shall co-operate with her, as we do, and we shall be co-operating with her in the production of the code. She has the power to report to Parliament on any matters about which she is concerned in relation to data protection, including the use of data protection by the Government. I am not sure whether that helps the noble Lord, Lord Carter, but it is as far as I can go at the moment.

Baroness Hollis of Heigham: We obviously welcome the Minister's support of the principle that there needs to be a code of practice. It would be churlish not to recognise that the Government have moved a

11 Mar 1997 : Column 184

considerable way in our direction, which we welcome. We also welcome his reaffirmation that such a code of practice shall embody the highest standards of confidentiality and security. That is splendid. The Government had a choice. I am perfectly willing to accept that our amendment may be technically flawed. We do not have the department's resources behind us at the moment.

The Government could have opted for a version of our amendment or brought back a revised and valid one, which put the drawing up, handling and monitoring of a code of practice in the hands of the data registrar. Instead the Government have chosen to go down the path whereby the DSS will draw it up, after consultation, which we welcome. It will draw up a code of practice and monitor compliance with it.

I am still not clear why the Government have chosen that path rather than the one indicated in our amendment. The examples that the Minister gave in his helpful answer relate much more to issues that are normally dealt with by the appeals procedure; for example, benefits sanctions. In other words, they deal with ends rather than means. The code of practice is about methodology and not about the outcome. It is meant to be about implementation and workable practice for organisations like local authorities who have not hitherto dealt with such issues. It will translate the principles of the Data Protection Registrar into a working code of practice. That is the point of it. So local authorities entering into a new field with new powers and new support as well as an inspection by the DSS, know how to carry out the measures with the appropriate, fair and scrupulous methodology. According to the Minister's reply the Government have splintered the principles for which the data registrar is responsible, and the code of practice which gives effect to those principles and for which the department will be responsible. Why? Why is he refusing to allow the Data Protection Registrar to translate the principles under the Data Protection Act into the code of practice, the day-to-day guidelines, which she will expect local authorities to observe?

If anyone has a complaint, not about outcomes, which are properly the job of the appeals procedures and the tribunals, but about the methodology, where will that person go? Will he or she go to the DSS so that that department is both judge and jury in its own cause, and so that Ministers will simultaneously be handling an appeals procedure, paralleled by a code of practice, or will that person go instead to the Data Protection Registrar? Will that person argue to the Data Protection Registrar that the Government's observance of the code of practice is not in accord with the registrar's shopping list of principles?

I am sure that the Minister was attempting to be helpful. I am sure that it was genuinely well intentioned and I am not suggesting otherwise, but I do believe that the Minister has opened up for himself far more problems than he has resolved. Surely the easiest and simplest way to translate the principles which we want to see observed into a working code of practice for local authorities and similar bodies is to have the person

11 Mar 1997 : Column 185

responsible for the code of practice the person who is also responsible for monitoring the principles. If that is not the case, I am sure that there will be huge confusion.

Lord Mackay of Ardbrecknish: I am a little puzzled by that argument. The noble Baroness seems to be complaining that the code of practice that I have suggested will be drawn up by the Secretary of State and the Department of Social Security, but the very first line of her amendment, Amendment No. 18, states:

"The Secretary of State shall prepare a Code of Practice",

so I really do not see how the noble Baroness can make a major difference between us on that point. In both cases, it will be the Secretary of State who will prepare the code of practice. I have made it clear that in preparing that code of practice the Secretary of State will discuss these matters with the registrar, will take her views on board and will very much stand alongside her when translating the principles into the code of practice. That seems perfectly sensible. Therefore, there is no division between us and I cannot imagine why the noble Baroness has attempted to create an artificial division by saying that in my example it was somehow wrong that the Secretary of State should draw up the code of practice, yet in line 1 of Amendment No. 18, the noble Baroness has suggested that,

"The Secretary of State shall prepare a Code of Practice".

The difference between us is that the noble Baroness wants a statutory code whereas I think that there are considerable advantages in it not being statutory because, as I have said, with the passage of time and learning, we shall then be able to make changes without having to come back through all the statutory hoops in relation to a system of data matching which is very new to us all.

Lord Carter: I now have with me a copy of the Data Protection Act, which perhaps I should have had when I started to deal with this amendment. The Government are in a real fix here. I am advised that the Government will have to be a registered user under the Act and that in that sense they are governed by the Data Protection Act. So the principles bind the Government. However, the Data Protection Registrar is not able properly to enforce them against the Government because of Section 38 which states:

"(1) Except as provided in subsection (2) below, a government department shall be subject to the same obligations and liabilities under this Act as a private person; and for the purposes of this Act each government department shall be treated as a person separate from any other government department and a person in the public service of the Crown shall be treated as a servant of the government department to which his responsibilities or duties relate.

(2) A government department shall not be liable to prosecution under this Act but".

There is then a list of various provisions. The Minister must deal with the point because it is absolutely crucial. If the Act stops the Government being prosecuted, how can the registrar enforce the provisions of the voluntary code as the Minister has described?

Lord Mackay of Ardbrecknish: The noble Lord is making rather a mountain out of a molehill here. The

11 Mar 1997 : Column 186

Data Protection Registrar always seeks to persuade any organisation which she sees contravening the data protection principles to change its ways. That is clearly how she takes her role. Enforcement notices are in every sense a last resort where such persuasion has failed.

The interesting point is that the registrar has never had to take out an enforcement notice against any government department. Clearly, therefore, any point brought to the attention of a government department by the registrar has been satisfactorily resolved. As far as we are concerned, if any matter was brought to our attention we would certainly note the registrar's views and take them on board. If the registrar issued such a notice against my department, we would certainly act on it. We must also remember that there would be the necessary consideration of it by the data protection tribunal also, so it is not just a matter for the registrar.

The noble Lord asked why the Government are somehow protected from the law. Although some Members of the Committee will know a good deal more about the legal niceties than I do, I must advise the Committee that it is quite normal in our law that the Crown cannot be prosecuted. However, by convention, the Government act within the law and I can assure the Committee that we would always seek to do that--

Baroness Hollis of Heigham: Except when you do not!

Noble Lords: Oh!

4.15 p.m.

Baroness Hollis of Heigham: This has been a useful discussion and we shall obviously want to take further advice on whether to pursue the matter further. We welcome the fact that the Government have moved somewhat in our direction. However, I am still not persuaded on the point about the statutory code. What sanctions exist if someone breaks the code? If the code is not statutory, it is merely a code of guidance. If a local authority fails to observe it, what sanctions may be deployed against the authority if the code is not statutory?

Lord Mackay of Ardbrecknish: As far as we are concerned, if an individual breaches the code, we would certainly take firm action against that person. I suspect that if the breach was deliberate, the individual would no longer have a job in that department.

---