| Previous Section | Back to Table of Contents | Lords Hansard Home Page |
Lord Teviot: I thank the noble and learned Lord very much for his comments on my Amendment No. 38. Obviously the word "communicated" is not appropriate. However, I shall read in Hansard every word he says, and, if necessary and if it is not covered, try to improve the wording at the next stage of the Bill. I beg leave to withdraw the amendment.
Amendment, by leave, withdrawn.
Baroness Nicholson of Winterbourne moved Amendment No. 39:
The noble Baroness said: These are two probing amendments. I ask the Minister and my noble and learned friend the Solicitor-General to look at the principle underlying them. I accept that the wording may not be adequate. Nonetheless, there is a point here that the Government should consider in the light of their manifesto and their correct statements of empowerment of the individual citizen.
I speak on this amendment only about government records. The Minister will see at once that I have excluded, because I have not included them, the records held by such government agencies as the police, the Inland Revenue and so on. I speak of the commonality of government records which reflect a government service to the individual citizen such as records of the National Health Service, social security and much of the work carried out by local authorities.
If I comment a little critically on the accuracy and security of those records, it does not mean that I do not fully recognise that accuracy and security, in particular
The purpose of the amendments is to look at who owns those records and who controls their dissemination; and to put a marker down for citizens' ownership, or possibly citizen control, in terms of the organisation of the movement of that material. In other words, my amendments seek to shift the burden of authorisation from the Government to the individual. When one answers a beguiling advertisement to buy something by post through the newspapers, one ticks a box if one does not want one's name to go forward. It would be perfectly possible to achieve such a situation, for example, with National Health Service records.
Let me give support to what I am offering in these probing amendments from the Audit Commission. In its report last week, A Ghost in the Machine, published on 19 February 1998, the commission found that:
I am not commenting on the cost, but only on the accuracy and in particular on the security of the Government's records. The Audit Commission goes on to claim that:
The commission also found that:
That caught my eye because I was the person who framed the computer hacking legislation and obtained the mechanism for getting that into law. Perhaps I may consider again unlawful access of government-held material on behalf of citizens' personal data. I quote here from someone senior in a higher level security organisation. There is reference to a number of accounts and records being accessed and then this unlawfully gathered information offered for sale. I am sure that is also true.
We address the problems of merging information later on in the Bill. I do not intend to move into that particular group of amendments and materials at this inapposite moment, save to say that I came across in the other place the way local authority material could be unlawfully accessed. In other words, it has become so attractive that it is now a magnet for unlawful access. I found with the poll tax that data from different sources on pensioners that had not been drawn together before under the data function were being put on records and held in local treasurers offices. Some resultant records were almost instantly accessed by hackers. If one looks at the way in which local authorities organise their material, naturally
When we turn to national government records, I believe that the best example is the National Health Service. I came across the problems myself with CJD when I sought a health Minister's approval and his agreement to release the knowledge to CJD victims of child growth hormone, as to which young people have been treated with child growth hormone which might trigger CJD which was derived from human cadavers and with which young people had been treated by the scientifically created material a little later on in the 1970s who were therefore not at risk. The Minister refused to release those health records to the families. I then asked a range of Parliamentary Questions on who in the UK owned the National Health Service records; and in 1992 I was given the knowledge that in fact it was the state. At that time it was deemed on a Treasury QC's advice to be the Secretary of State. Now that ownership has been passed down to the chairmen of National Health Service trusts.
When I look at how medical records are being used internationally, I see on 16th February an excellent article in the Washington Post which tells us that there has been an intrusion into medical records with,
In other words, USA citizens are now receiving letters from drug companies asking them to refill their prescription or to vary it or to try a new drug that has been found--a probable breach of medical ethics.
In Europe, we take these things just as seriously. Commissioner Mario Monti, who is seeking his brief from the Council of Ministers on guidelines for the protection of individuals with regard to the Internet, describes a most important premise. As he states, the Commission will pay particular attention to:
That is the basis of my probing amendments.
As I mentioned at Second Reading, I am well aware, from the work I did on the access to medical records Bill, the computer hacking Bill, the Copyright Act, the access to employee and access to schools records legislation, that in Britain we have not had a right to privacy. Certainly personal privacy rights at the moment, at least for the print media, appear to revolve around curtains. I am not attempting to find rats in the arras when I say that it is very important to take the decision that a measure of personal privacy is inherent in this Bill and that we do not have a right as a member of the European Union to push that aside. We have to accept and honour it. Certainly, if I have identified correctly the coming Internet Commission investigation, it also rests on the right personal privacy and data rights.
I believe, therefore, that the authorisation of the use of personal information, when held by government on citizens for services for which citizens pay through their tax bill, should rest with the citizens themselves.
Medical records offer the best example. I do not criticise hard-pressed medical professionals or suggest that they are in any way acting outside their duty of confidentiality; I am sure that they are not. My point, however, is that medical professionals no longer have effective ownership or control or authorisation of use of patient records as the patients' data are now so widespread on a number of different computer systems. Although the National Health Service, particularly through the excellent Caldecote Report, which came out in November 1997, offers the new National Health Service number as a protective measure, this is too simplistic. With IT, the patient record has passed on from general practitioners to be held and processed by a very wide variety of staff. I doubt very much whether the patient's doctor would feel that he or she had the capacity to control use of the record any more.
It is difficult to contain information in the modern world, but the person who cares most about accuracy and use is the citizen himself. I suggest therefore that whether it is a question of record ownership, control, authorisation of use, or accuracy and security of the records, the citizen's rights should predominate. The European convention states that our citizens have rights of privacy. To exercise that right with government records such as health, we should move choice from the state to the individual.
I say again that this is a probing amendment. I would ask the Government to give the serious philosophy of my point active consideration. I beg to move.
Lord Falconer of Thoroton: The right of a data subject to obtain details on the information on him or her being processed by a data controller is fundamental to data protection. At present the Bill treats all data controllers, whether they are private or public, in exactly the same way as regards subject access requests. The amendment would introduce special rules for subject access requests made to government departments. It seeks to do it on the basis that government departments, when confronted with a request, set out to develop their procedures on the basis of treating all data subjects making such requests as having a prima facie claim to ownership of any personal data relevant to those requests.
I have listened genuinely carefully to what the noble Baroness has said in moving the amendment, but I do not fully understand the purpose lying behind the first limb of the amendment. It will be the case, I believe, that, subject to any subject access exemptions that apply, individuals will be entitled to gain access to all personal data held about them by government departments, and indeed any other bodies. I am not sure or clear how the question of ownership affects that position. They do not need a reference to ownership to get all of the rights that are referred to in the Bill.
My belief is that the question of ownership does not arise in relation to information. Ownership of information per se is not a concept that is known to English law. The whole data protection regime proceeds on the basis of that premise. We should therefore be
As to the second limb, which relates to the price to be paid for information, in the White Paper on our proposals for data protection published in July last year we made it clear that we would be maintaining the £10 maximum subject access fee, which we believe to be by no means onerous. That is still our intention. It will, of course, be open to data controllers to charge a lower amount or nothing at all. We shall be setting fees in an order to be made by the Secretary of State once the Bill has been passed. I do not believe that we are proposing anything other than very modest fees in this respect.
In the light of what I have said, I hope that the noble Baroness will not press her amendment.
Page 5, line 15, at beginning insert ("Subject to subsection (2A) below,").
"Soaring levels of computer fraud within the NHS, schools and London town halls are costing the taxpayer at least £4 million a year."
"More than half of the capital's councils and hospitals suffer from hacking and other forms of computer abuse and the problems will get worse with the growth of the Internet."
"senior employees are responsible for up to a quarter of such crimes.
"Losses per incident have gone up by 25 per cent in the past four years ... as hacking has trebled."
"the great computer in the sky having a list of every drug you take from which can be deduced your likely diseases".
"The practical enforcement of the right to be informed of data processing operations involving oneself and of the right to object to any processing".
6 p.m.
Next Section
Back to Table of Contents
Lords Hansard Home Page