| Previous Section | Back to Table of Contents | Lords Hansard Home Page |
Lord Falconer of Thoroton moved Amendment No. 56:
The noble and learned Lord said: This is another amendment designed to fill a gap in the Bill. Clause 12(1) provides for individuals to go to court to seek an order requiring controllers to rectify, block, erase or destroy data about them which are inaccurate. Clause 12(3) complements this provision. It deals with the situation in which, before the rectification and so on, the data were disclosed to third parties. It allows courts which make an order under subsection (1) for rectification to make a further order requiring the controller to tell such third parties of the rectification and so on.
However, as the provision stands at present it is not comprehensive. It does not deal with the situation in which the controller rectifies inaccurate data otherwise than in pursuance of a court order but then refuses to tell third parties to whom the accurate data have already been disclosed of the rectification. The directive requires such third parties to be told of the rectification, whether or not the rectification was done in response to a court order. The purpose of the amendment is to correct this small deficiency. It means that courts will be able to make an order requiring controllers to tell third parties of rectification of personal data whether or not the rectification was made following an order under Clause 12(1).
A feature of this Bill is that individuals will be able to seek redress either by going to court or by seeking the assistance of the Data Protection Commissioner. Clause 38 of the Bill provides a power for the Data Protection Commissioner to issue an enforcement notice requiring the data controller to tell third parties to whom previously inaccurate data have been disclosed of rectifications which have been made. That clause mirrors the provision in Clause 12. Unfortunately, however, it also mirrors the deficiency. The purpose of the amendments to Clause 38 is to make a similar change to the enforcement notice power of the commissioner to that which I have already described in relation to the courts' order-making power. I beg to move.
Viscount Astor: My amendment is grouped with the noble Lord's and it was put down purely to ask a question of the noble Lord. The clause, as it stands, would result in a situation where the wider the dissemination of the data, the lesser the duty to notify third parties of the rectification. Have the Government considered in what circumstances and how that would
Lord Skelmersdale: Before the Minister responds to my noble friend, I am not quite sure whether this is a data processing gremlin or whether I am getting tired a little early this evening. The amendment says:
I have looked very carefully at page 9, line 1, and I cannot find (a). Is this in fact felicitously drafted, or is it, as I suggested, a gremlin? If it is infelicitously drafted, perhaps these words should appear a little later in subsection (3), rather than in line 1. It might read rather more happily, but I am sure that the Minister would like to take this away and think about it.
Lord Falconer of Thoroton: I am obliged. Let me deal first with the point of the noble Viscount, Lord Astor. First of all, the more you disseminate the error, the more people you may have to contact. As far as the court is concerned, it must consider whether it is reasonably practicable to make an order for correction. One thing it must bear in mind is the number of people who have been told. It is a provision that is put in specifically to assist data controllers, and it is a factor to be borne in mind in considering whether to make such an order. We think it is sensible, but in certain cases it would be an almost impossible task to get in touch with everybody, and then the court has to consider in those circumstances whether it is practicable to impose such a burden on a data controller. We think that is sensible and that is why it is there.
As far as the point made by the noble Lord, Lord Skelmersdale, is concerned, it is a good point, but I am told the point is taken care of in the new printing of the Bill. But I am grateful to the noble Lord for raising it.
Lord Skelmersdale: I am grateful to the noble and learned Lord. I shall study the reprint of the Bill avidly before Report stage.
Lord Falconer of Thoroton: If the noble Lord has time after putting the addresses on all the envelopes he was dealing with!
On Question, amendment agreed to.
Clause 12, as amended, agreed to.
Clause 13 [Automated decision-taking]:
[Amendments Nos. 58 and 59 not moved.]
On Question, Whether Clause 13 shall be agreed to?
Viscount Astor: I wonder whether I could ask the Minister at this stage what the Government's view is about the report of the Select Committee on Delegated Powers and Deregulation. It recommended that the Bill
Lord Williams of Mostyn: Yes, it is intended that it should be dealt with when we discuss Clause 16 this coming Wednesday.
Viscount Astor: I am grateful to the Minister.
Clause 14 [Jurisdiction and procedure]:
Lord Falconer of Thoroton moved amendment No. 60:
The noble and learned Lord said: These are two technical improvements to the description of the powers of the courts in proceedings for the enforcement of the rights of subject access. The first identifies the data in question as being,
rather than "held by" a data controller. The amendment reflects the wording of the subject access right in Clause 7 itself, as it properly should. According to the definition of "processing" in Clause 1, the holding of data is only one aspect of processing, and it is not our intention so to limit the data to which Clause 14(2) refers.
The second amendment deals with a slight gap in the power conferred on courts by Clause 14(2). Where a subject access right is disputed, it may be important for the court itself to have sight of the data in question so that it can form its own view as to whether access should be given to a plaintiff. But it is clear that, pending the court's decision, the plaintiff himself should not have access to that data, whether under the rules of discovery or otherwise; that would be to give de facto subject access before the existence of the right itself had been properly determined.
The Bill as drafted gives that essential protection to "information constituting data". "Data" is a term which is defined in Clause 1 of the Bill, but the subject access right in Clause 7 is not just in terms of data. It also, in Clause 7(1)(d), extends to information as to the logic of certain decision taking. That information may or may not constitute data for the purposes of the definition in Clause 1. For example, the information may not be recorded in any form, it may simply lie in the knowledge of the data controller. It may be important, if subject access to such information is contested, for a court to be able to ask for and consider that information before deciding whether a plaintiff should be given access to it. The second amendment provides that missing power. I beg to move.
On Question, amendment agreed to.
Lord Falconer of Thoroton moved Amendment No. 61:
The noble and learned Lord said: I have already spoken to this amendment. I beg to move.
On Question, amendment agreed to.
Clause 14, as amended, agreed to.
Clause 16 [Prohibition on processing without registration]:
Viscount Astor moved Amendment No. 62:
The noble Viscount said: Clause 16(3) seems to give the Secretary of State quite wide powers to disapply Clause 1 where it appears to him that the processing is likely to prejudice the rights and freedoms of data subjects. Concerns had been expressed about the width of the power, so I simply put down the amendment to give the Minister the opportunity to explain slightly more concerning the circumstances under which they would be used. I beg to move.
Lord Falconer of Thoroton: As the noble Viscount, Lord Astor, has indicated, subsection (3), which his amendment would delete, allows the Secretary of State to make notification regulations specifying exemptions from the prohibition on processing without a register entry. Such processing, therefore, would not need to be notified to the commissioner. It is the Government's wish that the notification arrangements should be as simple as possible for the data controllers.
One of the perceived problems for the present registration arrangements is that they are unnecessarily burdensome. I know that the Data Protection Registrar has already taken steps within the constraints of the present law to make the arrangements more user friendly. I very much welcome that, but I hope that we shall be able to devise arrangements for notification under the Bill that take that process further.
One of the ways in which notification can be simplified is to remove some processing from the requirement to be notified. The Bill already provides that the processing of manual records does not need to be notified (except that to which the preliminary assessment procedure under Clause 21 applies). There is also an exemption for processing whose sole purpose is the keeping of a public register. But the key provision for exemptions is Clause 16(3), to which the noble Viscount's amendment relates.
The Committee might well ask what categories of processing the Government intend to exempt under this provision--the very question the noble Viscount asked. No firm decisions have yet been taken. The Bill provides for the notification regulations to be drawn up in consultation with the data protection commissioner. Of course, the commissioner does not yet exist, but the Government are already in discussion with the Data Protection Registrar about the content of the notification regulations. The scope of the exemptions from notification is one of the important matters that are
Page 9, line 1, leave out ("it may also") and insert ("or
(b) is satisfied on the application of a data subject that personal data of which he was the data subject and which have been rectified, blocked, erased or destroyed were inaccurate,
it may").
"insert ("or (b)".
6.45 p.m.
Page 10, line 5, leave out ("held by") and insert ("processed by or on behalf of").
"those processed by or on behalf of",
Page 10, line 5, after ("controller") insert ("and any information as to the logic involved in any decision-taking as mentioned in section 7(1)(d)").
Page 11, line 13, leave out subsection (3).
Next Section
Back to Table of Contents
Lords Hansard Home Page