| Previous Section | Back to Table of Contents | Lords Hansard Home Page |
Baroness Nicholson of Winterbourne: My Lords, I oppose the noble Viscount's amendment and seek reassurance from Her Majesty's Government. I am concerned lest paper files which hold potentially damaging information about individuals without their knowledge may not be covered even by the government amendment. I wish it to be possible for those paper files to be accessed by the individuals concerned.
I do not wish to name any specific organisation, but there is one which I have in mind. I shall not name it but I shall define it. That organisation has been
investigated by the police. I am sorry to say that one particular major political party has used it on a regular basis in order to target political opponents.Given that the police investigation disclosed, I believe, nothing improper, I had understood that that organisation was no longer targeting people who were political opponents of one political party. I am sorry to say that that is not so. There are people who may be shop stewards, who may belong to unions and who may disagree with management, whose personal files are still being held by that organisation and whose job prospects are still being harmed.
I met a person involved in such a case on Friday. His job prospects have been harmed during the past two weeks. That man has had his name on a file of that organisation for eight years, and he can give a record of jobs for which he has been blacklisted because of the situation. If he had access to that information, he could at least tell whether the information that the organisation holds on him, or purports to hold on him, is accurate. He could then raise the matter with the personnel officers of the companies to which he has applied for jobs. I am concerned about this; I want to make absolutely sure that ordinary working men and women do not have their job prospects harmed through invisible mechanisms which this Bill is surely designed to stop.
Lord Skelmersdale: My Lords, before my noble friend responds, perhaps I might point out that, although this is the Report stage, we seem to be getting into a slight muddle because of this particular grouping. However, leaving that issue aside, I should very much like to comment on the Government's amendment, Amendment No. 3.
In Committee I declared an interest as the holder of a manual records set. As such, I think I am grateful to the Minister for the Government's amendment. As I understand it, any collection of paper documents which cannot be accessed by a particular subject would be covered by that amendment. However, I am not so sure as regards the position on a manual address list, where it involves purely the person's name, his address and a continuing set of order numbers.
Clearly, if one is given the order number over the telephone one has to look up the invoice and then refer to the reference. However, if one is given the name, one can then do the operation the other way round. I am not sure whether this is "specific". I gain the impression from what the Minister said that it almost certainly is not. Perhaps the Minister would care to confirm that either today or in writing before the Third Reading debate. I should be most grateful.
Viscount Astor: My Lords, before the noble Baroness replies, I should like to express my thanks to the Minister for Amendment No. 3, which I believe actually deals with all the questions that I put forward in Committee. Indeed, it also appears to deal largely with the content of Amendment No. 4, which is tabled in my name. Obviously I shall have to read carefully what the noble Lord said because his introduction was somewhat complicated. However, I have one brief
question. Does the result of his amendment mean that the Government and the registrar are now agreed on the definition of what are and what are not relevant manual records?
Lord Williams of Mostyn: My Lords, as I believe I set out in my introduction, I cannot say that there is perfect agreement on the matter. There are shades of meaning here and much will depend on good sense in practice. We have taken on board the legitimate concerns raised by the noble Viscount and others, especially as regards large organisations--some of them governmental--which may have carried an intolerable burden over many years when dealing with manual records. I should like to research the point raised by the noble Lord, Lord Skelmersdale, and write to him extremely promptly on the matter.
I take note of the concerns expressed by the noble Baroness, but I do not believe that they relate to the amendment for which I was contending. We are looking for a word which expresses the concept that we are all trying to find; namely, that one should have access to specific material which is readily accessible. I believe that what I have said deals with the questions put forward. I trust that I dealt earlier with the troubles which worried my noble friend Lady Turner of Camden.
Baroness Turner of Camden: My Lords, I thank my noble friend the Minister for his explanation. I had not appreciated that the directive gave the Government so little scope to do what was proposed in my amendment. However, I am grateful for my noble friend's assurance that it is not the Government's intention to impose additional burdens on individuals. On that basis, and with thanks again to my noble friend for his explanation, I beg leave to withdraw the amendment.
Amendment, by leave, withdrawn.
Lord Williams of Mostyn moved Amendment No. 3:
On Question, amendment agreed to.
Schedule 1 [The data protection principles]:
Lord Williams of Mostyn moved Amendment No. 5:
The noble Lord said: My Lords, this amendment relates to contracts between data processors and data controllers and picks up a point raised by my noble and learned friend the Solicitor-General when responding to Amendment No. 26 in Committee.
Paragraph 13 in Part II of Schedule 1 provides that processing by a data processor on behalf of a data controller shall not be regarded as complying with the seventh data protection principle, which relates to security measures to prevent unauthorised processing or
That may equally well be done by a contract made in writing or a contract evidenced in writing.
Amendments Nos. 6 and 7 are grouped with this amendment. They are tabled in the name of the noble Viscount, Lord Astor, and perhaps I might, therefore, allow him to take what course he thinks appropriate in that respect. In the meantime, I must point out that I have spoken only Amendment No. 5. I beg to move.
Viscount Astor: My Lords, it may be convenient for me to speak now to Amendments Nos. 6 and 7, which are included in this group. We find ourselves in a complicated area which deals with transfers of data between this and other countries, especially as regards the United States. I am grateful to the Minister for the meetings that have taken place between the Committee and Report stages. We do not seem to have reached a conclusion on the matter, although I believe that there are some pointers.
We are dealing with an extremely important area because it particularly affects American countries with operations in this country, or, indeed, British companies with substantial dealings in the USA. One of the difficulties is that the United States does not have a federal data protection Act of general application, although a number of states do have such protection. However, there is a wide range of codes of conduct and also contractual restrictions and individual business requirements which provide many of the protections provided for in the new data protection legislation. It was presumably for that reason that the registrar came out so firmly for allowing the broadening of paragraph 14 of Schedule 1.
There is a large number of cases where it is essential for American and British companies--for example, airline companies, pharmaceutical companies and software companies--to transmit massive amounts of data which are entirely appropriately protected in the United States. As one of the largest trading partners of the United Kingdom, the United States cannot be cut off from the flow of data from this country. If that were to happen, there would be serious disruption in day-to-day business and in the legitimate exchange of information.
Obviously, those whose data are transferred have to be protected. I read again, with care, the argument proposed by the noble and learned Lord the Solicitor-General in Committee that it can all be brought within Schedule 4. However, paragraph 2 of Schedule 4 deals only with the transfer of information between the data subject and the data controller which typically is not the subject of cross-border data flows. An American or British airline needs to be able to transfer information about bookings and seats, flight schedules and pilot and
At Committee stage the Minister also relied for his argument on paragraph 3 of Schedule 4. This initially seems to suggest that contracts between a data controller and a person other than the data subject can be enforced, but only if it is possible to prove that they were entered into at the request of the data subject or are in the interests of the data subject. Once again I believe this could impede any reasonable day-to-day handling of the kinds of business data that I have mentioned and would make it extraordinarily difficult for a British pharmaceutical company, for instance, to transfer information to obtain FDA permission for its drugs to be sold in the United States. The Minister did not point out in connection with paragraph 3 of Schedule 4 that contractual provisions are insufficient unless the contract is entered into at the request of the data subject or they are,
This provision would in reality make it possible to hold up any transfer of information to the United States indefinitely.
Paragraph 8 of Schedule 4 allows the transfer to be made on terms approved by the commissioner. If these were made in general terms it would be possible to handle some of the issues that I have raised. However, the effect of globalisation of trade means that the nature of contracts that are needed is constantly changing. American financial institutions have to transfer data constantly about accounts and various other matters to their head offices in New York or any other American city. British banks and financial institutions which hope to continue trading in the American market will also experience difficulties in having to clear every new arrangement--the nature of derivatives, for example, changes daily--with the registrar.
The principal problem with the Schedule 4 approach is that it assumes that countries such as the United States will have inadequate data protection in virtually every case, and that data can be transferred to the United States only in the "force majeure" situations listed in the schedule. My amendment recognised that contractual protections may be one factor of many listed in Schedule 1 in determining that in appropriate cases data transferred to the United States may have the adequate protections that the law requires.
This is a complicated area. I have mentioned the United States because institutions in this country, particularly financial institutions, do so much business with that country. However, the matter could apply equally to other countries. I moved this amendment in Committee. While we have made progress in some of the discussions which have taken place as regards explaining the problem, I do not think we have made any progress in finding an answer. That is why I have spoken to this amendment again today. I look forward to the Minister's reply to determine whether he can help me in this difficulty.
Page 2, line 19, leave out ("particular") and insert ("specific").
3.45 p.m.
Page 41, line 2, leave out ("in writing") and insert--
("(i) which is made or evidenced in writing, and
(ii)")
"for the purposes of keeping proof".
"in the interests of the data subject".
Next Section
Back to Table of Contents
Lords Hansard Home Page