| Previous Section | Back to Table of Contents | Lords Hansard Home Page |
The noble Viscount said: The current system of informal approaches from the commissioner has worked well under the existing Act. My amendment seeks to strengthen that system, because from my reading of Clause 41 it looks as though the commissioner may have too speedy a recourse to the rather onerous information notices. We believe that the commissioner should be obliged to make an informal approach before issuing such a notice, and it is that obligation, as it were, that is the purpose of my amendment. That happens now and is the working practice. Informal approaches work well, and I am told that when that happens, in the vast majority of cases, there is no need to go any further. It seemed to me that it was important that the Committee should consider whether that should be included in the Bill, because for the commissioner's sake, and indeed for everyone else's sake, we do not want it automatically going to information notices. I beg to move.
The Earl of Northesk: The three amendments in my name in the grouping attempt to deal with the problem that my noble friend Lord Astor has spoken of, although maybe in a slightly different way. Their purpose is to require the commissioner to have received a request for assessment and to have reasonable grounds for suspicion of contravention of any of the data protection principles before an information notice may be served. The reason for the amendment is that there is concern from business that the commissioner may think it appropriate to publish, inter alia, a specimen letter of request for assessment, which may then form the sole basis for the issue of an information notice without the commissioner having made any determination on the request for assessment or having reasonable grounds for suspecting contravention of any of the data protection principles.
Lord Williams of Mostyn: I shall respond to all these amendments if I may. This power given to the commissioner to serve an information notice is a new power, so the effect of the first amendment in this grouping would be to require the commissioner, when seeking information on the basis of having received a request for assessment as to compliance with the provisions of the Act, to seek first to resolve the issue informally with the controller, as the noble Viscount, Lord Astor, indicated. Only where the informal approach failed would the commissioner then be able to serve the information notice.
We do not see the necessity for this amendment. The information notice itself is in the nature of a preliminary step. We have listened with care to the representations of the registrar, but to weigh this down with mandatory formalities would deprive it of much of its utility. It is for the commissioner to exercise her powers reasonably and for the purposes provided, and it is gratifying indeed to hear the complimentary remarks addressed to the registrar and her staff on various occasions, and certainly this afternoon, about the way in which she has approached her difficult duties.
The registrar's present procedure for dealing with complaints is that in the great majority of cases--I echo what was said a moment or two ago--complaints are resolved through negotiation. When formal action is subsequently taken by the registrar it is normally only
The remaining amendments address the same point generally, because they would link the requirement for the commissioner having received a request for an assessment to her also having reasonable suspicion of breach. We believe that would limit her powers substantially and unnecessarily. The two limbs are important; each is important in its own right. A request for an assessment under Clause 40 could extend beyond considering compliance with the principles, and indeed potential breaches of the principles may well be brought to the commissioner's attention other than by a request for an assessment. We believe that the independently based grounds of suspicion of the commissioner and the entitlement of individuals to engage her investigative powers in their own cause are important, separate, free-standing bases for investigation. We believe that that is what the directive suggests, as one sees in the detailed provisions of Article 28. I hope that my remarks have proved of assistance.
Viscount Astor: I am grateful for the assurance that the Minister has given today. I beg leave to withdraw the amendment.
Amendment, by leave, withdrawn.
[Amendments Nos. 126 to 128 not moved.]
On Question, Whether Clause 41 shall stand part of the Bill?
Lord Norton: The Bill deserves a better inquiry clause than this. The clause is purporting to give the commissioner powers to serve an information notice to a data controller, requiring the data controller, within the time as may be specified, to provide such information as may be required in order to establish whether or not a data principle has been contravened.
The information notice can be issued on two grounds: if the commissioner has had a complaint from a data subject, or if the commissioner has reasonable grounds for suspecting that a data controller has contravened a data principle; and I emphasise "reasonable grounds".
So far, so good. However, there are two major weaknesses to this clause. The first is that the information notice can be appealed. Under Clause 46(1) the information notice can be appealed on any ground. Appeals to the tribunal at present take months. So here is an inquiry clause that can be frustrated on any ground by an unscrupulous data controller for months, despite the concerns of the noble Viscount, Lord Astor. A data controller with something to hide will probably want to frustrate the inquiry for months, perhaps, so that data can be lost or otherwise rearranged.
An unscrupulous data processor will certainly wish to appeal in order to establish a privilege--the second weakness of this clause. The privilege that the
As drafted, this clause is of very little value and I have been advised that it is very unlikely that it would be used by the commissioner. The notice can be easily appealed and, if there is any likelihood of the commissioner wishing to obtain a warrant to enter the premises of a rogue data controller, the issue of an information notice would be the last course of action because, by issuing the notice, the commissioner would in effect, as I have said, be ring-fencing the unscrupulous processor from the powers of entry of the commissioner. But in order to obtain a warrant, the commissioner must have reasonable grounds. So an information notice is of vital importance and must be defined and operate in the correct manner. That is a very important part of the enforcement regime.
There are plenty of precedents in legislation drafted by the DTI or the DoE that could provide the correct mechanism. One such clause is Clause 93 of the Control of Pollution Act 1974. That clause allows the obtaining of reasonable information and would also control the commissioner from overstepping the mark by virtue of powers conferred to the Secretary of State.
Lord Williams of Mostyn: I am grateful to the noble Lord, Lord Norton, for raising his concerns. Perhaps it is worth revisiting Clause 41 in a little detail for a moment or two.
Clause 41 introduces a power, which is not contained in the 1984 Act, for the commissioner to serve a notice requiring information from a data controller in two circumstances which have already been identified. The notices must specify the grounds on which they are made and the rights of appeal they attract, pending which they need not take effect.
There are two matters here which ought reasonably to attend to the noble Lord's concerns. First, by virtue of Clause 41(6), if there are special circumstances which require urgency, the commissioner can herself include a statement to that effect--a statement of reasons--and in that event subsection (4) does not apply; therefore, the long drawn-out appeal process would not be available. The notice takes effect within seven days.
I take the noble Lord's point that someone who wants to play the appeal system in this context, or indeed any other, is quite likely to be able to be properly advised and properly funded to do that. That is why in paragraph 7(2)(g) of Schedule 6 we have provided for the possibility for appeals to be heard by the tribunal chairman or deputy chairman sitting alone. One intended consequence of that will be to speed up things. We are very conscious that it would be an absurdity for us to have produced this Bill to meet our directive obligations and yet let people manipulate the system.
Those two aspects may be of assistance to the noble Lord. I hope they are. I have not met the Data Protection Registrar on this matter, but have said that we are perfectly willing to look at any appropriate ways of narrowing the grounds of appeal. I am happy to be able to give those assurances.
Clause 42 [Special information notices]:
[Amendment No. 128A to 129A not moved.]
Clause 43 [Determination by Commissioner as to the special purposes]:
[Amendment No. 129B not moved.]
Clause 46 [Rights of appeal]:
Page 23, line 10, after ("data") insert ("and has first made an informal approach which has failed to resolve the issue,").
Next Section
Back to Table of Contents
Lords Hansard Home Page