| Previous Section | Back to Table of Contents | Lords Hansard Home Page |
Lord Williams of Mostyn: I guarantee it.
Clause 1, as amended, agreed to.
Clause 2 [Sensitive personal data]:
4.30 p.m.
Viscount Astor moved Amendment No. 17:
The noble Viscount said: In moving Amendment No. 17 I shall also speak to Amendments Nos. 18 and 19. I have tabled Amendments Nos. 17 and 18 purely because in the Crime and Disorder Bill I happened to notice that Clause 26 defines "racial group" with reference to nationality and national origins. I wonder therefore whether, for consistency of legislation, that should be included in this Bill.
I turn to Amendment No. 19. I looked, first, at the directive and then at the Bill and thought what a very unattractive way it was of dealing with legislation. Someone has thought of the word "orientation", which is almost as bad as the words in the Bill. It seems to me that we are getting into a strange kind of legislation. Is there no all-encompassing term that could be used? I am not sure how one defines sex life in law: what does that include; or what does it not include? It might include lots of different things in Scotland that it might not include in England, as we know!
Is there not an all-encompassing legal term that the Minister could suggest which would say that people's private lives remain their private lives--a more general thing--rather than this laborious way of saying what it might include? Looking at this rather extraordinary list, it seems to me that it is a recipe for wrangles in the future. I look forward with interest to the Minister's reply. I beg to move.
Lord Williams of Mostyn: I shall speak to Amendments Nos. 17, 18 and 19 together. The noble Viscount asks what is sex life and what does it include. I do not think I should venture too keenly into that territory; otherwise we shall both be sharing an unfortunate headline. What I say is that we have amply covered those areas that need to be covered--or, indeed, uncovered--in this context because we have put in Clause 2(f) the general description of "his"--which includes her--"sexual life". Therefore, sensitive personal data relate to data which are information as to sexual life. We believe that that is the best definition we can get.
Certainly one is dealing here with sensitive personal data. We have tried to get the definitions right. In other contexts--certainly the Crime and Disorder Bill or in race relations legislation--nationality is included. What we have to look at here is sensitive personal data. We believe that the fact, as a matter of information, that an individual is of a particular nationality (though it will give no indication of his racial or ethnic origin) is not sufficiently sensitive to require the application to that information of the more restrictive regime (which is the personal data), which is the sensitive regime, rather than the general personal data regime. We have reached that
The third matter relates to colour or nationality, so colour is included here. We think that the issue of colour ought to be regarded as in itself information as to racial or ethnic origin. It is not the same thing, but it does seem to be information as to racial or ethnic origin, which is already within the Bill's definition. I do not believe there is a real ambiguity there, and I hope I have been able to satisfy the noble Viscount as to his queries and questions.
Viscount Astor: I am grateful to the Minister for his reply. I note that the Bill virtually copies out word for word what Article 8 of the directive says, except for one interesting gap. Article 8 says "religious or philosophical beliefs", whereas the Bill says "religious or other beliefs". Presumably the Home Office believes you can have philosophical beliefs and you can also have other beliefs, and that is therefore the only word which is not the same. However, I am grateful for the noble Lord's explanation and I beg leave to withdraw the amendment.
Amendment, by leave, withdrawn.
[Amendments Nos. 18 and 19 not moved.]
Schedule 1 [The data protection principles]:
Viscount Astor moved Amendment No. 20:
The noble Viscount said: Amendment No. 20 is a probing amendment. I wonder why the word "necessary" is there because it seems not to be necessary. I wonder whether the Minister could explain for whom and what purpose "necessary" is included.
I see that Amendment No. 22 is grouped with this amendment. This amendment attempts to strengthen the provision. Subparagraph (1)(b) states:
But qualifying this requirement by stating,
seems to weaken the provision. I wondered why that was that case. I have put this amendment down so that we can elucidate an answer from the Minister. I beg to move.
Baroness Turner of Camden: I shall speak to Amendment No. 23, as it is grouped with Amendment No. 20. This follows up what a number of noble Lords said at Second Reading in relation to insurance fraud and fraudulent claims. It will be recalled that at Second Reading I and several other noble Lords referred to the difficulties that could arise if it was not possible to retain statistics against future fraudulent activity. It is believed essential, as a safeguard against fraudulent activities of
I am advised that the ability of insurers to avoid payment of fraudulent claims is very much dependent upon their being able, often with the assistance of loss adjustors, to assess details of earlier claims made by policy-holders who would otherwise falsely be able to maintain that no such earlier incidents had occurred.
The amendment that has been drafted is fairly self-explanatory. It says that it,
In other words, the responsibility in relation to authorising the retention rests clearly with commissioner, and it is felt that that in itself would give sufficient protection in terms of data protection.
Incidentally, while speaking on the issue of fraudulent claims, I take this opportunity to thank the Minister for his kindness in writing to me and to my colleagues on the whole issue of fraudulent claims. I beg to move.
Lord Skelmersdale: I have a related point to make. In the cards to which I referred a few moments ago, I might very well come across one which said "give no credit" on the basis that in previous years the customer had not paid. How long would I be expected, or be allowed, to keep that on the card? I might want to keep it until I discovered that the person had moved and therefore the information was irrelevant. I might want to keep it for two years, until they had settled their bill. In all this, there must be a length of time, I suspect, which the Government have in mind.
The Earl of Northesk: I note that Amendment No. 26 is in this grouping, so I shall speak to it now. Part II of Schedule 1 sets out the interpretation of the data protection principles appearing in Part I of the schedule, against which the legitimacy of data processing is tested. In respect of the seventh principle--that requiring the proper integrity of processing systems--the Bill seeks to transpose the provisions of Articles 17.3 and 17.4 of the directive. However, it seems that in this transposition the specific provisions have been changed. My amendment seeks to return the interpretation of the directive's provision on to the face of the Bill.
Article 17.3 of the directive states:
However, as currently drafted in the Bill, paragraph 13(a) of Schedule 1 requires contracts with the processors of personal data to be in writing and on strict construction; that is to say signed. To my interpretation, the provisions in the directive were directed towards securing evidence of the terms of the contract under which the data controller authorises and legitimises processing on his behalf by the data processor. In effect, the Bill as drafted goes beyond the requirements of the directive and seeks a more prescriptive approach. I believe that this will have unforeseen and unwelcome consequences which, if enacted, will cause the Bill to operate to the great disadvantage of many traders.
In particular, the British Retail Consortium has raised concerns about the effect that these provisions will have on the agency mail order trade in the United Kingdom and the millions of women who act as informal agents for the industry. According to the analysis of the industry conducted by the Monopolies and Mergers Commission and set out in its report on the proposed merger between the Littlewoods Organisation plc and Freemans plc in 1996, the agency mail order sector had sales of £3.25 billion, primarily conducted through non-commercial agents. On the commission's analysis, these agents were described as being predominantly women aged between 25 and 55, overwhelmingly not in employment or even part-time employment, with 62 per cent of their number drawn from socio-economic group C2, D and E.
The commission also estimated that agency mail order was used by 20.75 million people in the UK, 7.4 million of whom were acting in the capacity of agents. Of these, it was further estimated that some 2.5 million were described as "traditional agents", buying for more than one customer--that is to say, likely to be buying for persons outside their own households.
One of the strengths that has characterised the way in which mail order has been conducted throughout this century is its informality. The requirement for agency mail order companies suddenly to suspend operations with their agents while some 7.4 million processing contracts are issued and returned duly signed by the agent is a burden being imposed by the Bill as drafted, and yet the directive itself does not seek this. My amendment would ensure that it would be sufficient that processing was conducted on the terms of a written memorandum of agreement tendered in the regular and periodic communications with agents rather than requiring the company to refuse to do business with them in the absence of a signed copy of a written agreement. This would seem entirely equitable and completely within the original intention and spirit of the directive.
Lord Falconer of Thoroton: There are four amendments in the group. They are all slightly different from one another and I shall deal with them one at a time.
The noble Viscount, Lord Astor, moved Amendment No. 20. At present Principle 4 in Schedule 1 says:
The noble Viscount wants to replace "where necessary" with "where appropriate". Why, he asks me, is it "where necessary" rather then "where appropriate". As the noble Viscount knows, the reason we are bringing in this legislation is in large measure that we have to give effect to the directive. We are required to make provision at the level set by the directive. This provision of the Bill, the fourth data protection principle, follows the corresponding provision of the directive (Article 6.1(d)) word for word. It would not therefore be appropriate for us to delete the word "necessary" and put in the word "appropriate". I hope that that answers the noble Viscount's first amendment.
His second amendment, Amendment No. 22, seeks to reduce the flexibility that a data controller has in giving information to the data subject about the information that the data controller holds on the data subject. The extensive interpretive provisions in paragraphs 2 and 3 of Part II of Schedule 1, which the noble Viscount seeks to amend, are intended to give effect to certain transparency requirements in the directive. It may help if I briefly explain how they work.
Articles 10 and 11 of the directive require certain information to be provided to individuals about whom data are collected. Essentially, the information is the name of the controller, the purposes of the processing and any other information needed to make the processing fair. Article 10 deals with data which are collected from the data subjects themselves. Article 11 deals with data collected from persons other than the data subjects. That is the situation covered in paragraph 2(1)(b) to which the amendment relates. Paragraph 2(1)(b) requires the information to be provided to the data subjects before the relevant time,
The noble Viscount wishes to delete those last words.
The "relevant time" is defined in paragraph 2(2). It means the time when the data controller first processes the data or, in essence, the time when the data are first disclosed by the controller, if he has the intention to disclose them.
I return to the noble Viscount's amendment. I do not think it is desirable to make this change. It would make it very difficult, if not impossible, for controllers to comply with the requirements of the paragraph. The Committee will remember that the Bill is concerned here with data which are collected otherwise than from the data subject: they may be collected, for example, from some sort of public register. If the controller collects them by entering them directly from the register on to his portable computer, he is already processing them. Without the words which the noble Viscount's amendment would remove, the controller would be required already to have given the relevant information to the data subjects.
It is difficult to see how that would work in practice. We should be putting controllers in the position of having to choose between not collecting the data from third-party sources and doing so but not complying with the law. We believe, therefore, that the wording that is already in the Bill is essential to the practical operation of this provision. Having explained that, I respectfully invite the noble Viscount to withdraw the amendment.
I turn to the amendment moved by the noble Baroness, Lady Turner of Camden. As I understand her point, the insurance industry is concerned that it should be able to keep information about claims so that when a person makes a further claim one would be able to refer back to that particular information that one already has. The basic principle is that you are entitled to keep the information for as long as necessary. If the position is that it is necessary to keep that information against another claim being made, there would be no infringement of the relevant data protection principle. I cannot tell the Committee how long is necessary because that will depend on a particular case; nor I imagine would the Data Protection Registrar be able to say how long is necessary because it will depend upon the individual case concerned. However, I would like to emphasise that the data protection principles permit the retention of information for as long as necessary, which we believe meets the point made by both the noble Baroness, Lady Turner, and the noble Lord, Lord Norton. We believe that the position is covered.
There is a separate provision in the Act, Section 32(5), which permits material to be held purely for statistical purposes and then there is no limit in time. But although I may have misunderstood it, I do not believe that is what the noble Baroness has in mind. If it is purely statistical and does not relate to an individual person, then the data protection business would not apply and one would not be worried about it. But I believe it is the first situation. I hope that puts the minds of the noble Baroness and the noble Lord at rest and in those circumstances they will withdraw their amendment.
Finally the noble Earl, Lord Northesk, seems, with the greatest respect, to be operating under a significant misapprehension, although I may have misunderstood the position. He says that in paragraph 13 of Part II of Schedule 1 to the Bill, where it says,
that means the contract must not only be in writing but must also be signed. That is not my understanding of the Bill, nor is it the understanding of the Bill of those who were responsible for giving instructions for its drafting. The concern which underlay much of the very good speech made by the noble Earl in support of his amendment is probably misplaced. Speaking as a lawyer, I can tell the Committee it is absolutely right that where it says "contract in writing" you do not need to have it signed, so that is a genuine misapprehension.
Having said that, there may be a point which we should consider, where one has a contract which was evidenced in writing but was originally made orally. We may not have to deal with that, but there are a number of points on paragraph 13 which we could usefully consider without giving any guarantee of coming back with anything. The point which underlay the noble Earl's concern was probably, with respect, misplaced and I hope in those circumstances he will withdraw his amendment.
Page 2, line 46, after ("racial") insert (", national").
Page 38, line 16, leave out ("necessary,") and insert ("appropriate,").
"the data controller ensures that ... the data subject has, is provided with, or has made readily available to him, the information specified".
"so far as practicable before the relevant time",
"as soon as practicable after that time",
"Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes".
"shall be permitted for whatever period is deemed appropriate by the Commissioner".
"The carrying out of processing by way of a processor must be governed by a contract or legal act binding the processor to the controller".
"For the purposes of keeping proof, the parts of the contract or the legal act relating to data protection and the requirements relating to the measures referred to in paragraph 1 shall be in writing or in another equivalent form".
23 Feb 1998 : Column CWH20
4.45 p.m.
"Personal data shall be accurate and, where necessary, kept up to date".
23 Feb 1998 : Column CWH21
"or as soon as practicable after that time".
"the processing is carried out under a contract in writing under which the data processor is to act only on instructions from the data controller",
Next Section
Back to Table of Contents
Lords Hansard Home Page