Previous Section Back to Table of Contents Lords Hansard Home Page

Identity Cards Bill

House again in Committee on Clause 2.

[Amendment No. 54 not moved.]

Baroness Anelay of St Johns moved Amendment No. 55:

"( ) Details of any entry made in the Register must be provided to the person in respect of whom the entry is made."

The noble Baroness said: In moving Amendment No. 55, I shall speak also to Amendments Nos. 167 and 187. Amendment No. 55 is simplicity itself. It guarantees that details of any entry made in the register must be provided to the person in respect of whom that entry is made. What could be unreasonable about that? Without such clarification—without such assurances that information about an individual will not be stored, added to or removed without his knowledge—the citizen would be in a position of insecurity.

Amendment No. 167 inserts a new subsection into Clause 12. That clause sets out how we shall have to notify changes in circumstances to keep the national identity register up to date. If we fail to do that, we face a civil penalty of up to £1,000. It is therefore important that systems are in place to enable us to carry out that duty effectively and easily without facing the threat of a penalty—or a fine. As my noble friend Lord Onslow said earlier today, whatever one calls it, it will feel like a fine. Amendment No. 167 gives every individual entered on the register the right to be sent a copy of the information held on him by the Secretary of State.
23 Nov 2005 : Column 1699

I emphasise that Amendment No. 167 is a probing amendment because I realise the cost implications of doing what it requires. The purpose of the amendment is to probe how the process will take place, particularly because when my honourable friend Patrick Mercer moved this amendment in another place on 14 July, he did not get a reply from the Minister because the Government had put in the knives. So this is the first opportunity for the Government to answer the question.

Amendment No. 187 is in a similar vein to Amendment No. 55. It inserts a requirement in Clause 14 for the Secretary of State to supply an individual with all or any of the information recorded about him on the register, if that individual asks for it. I beg to move.

Lord Phillips of Sudbury: I shall speak to Amendment No. 80, which is grouped with Amendments Nos. 55, 167—which stands in my name—and 187. There is little to add to the succinct and effective explanation of the need for this group of amendments just given by the noble Baroness, Lady Anelay. I hope that it will not be contentious for anyone who wants to know the state of play on his or her data register entry to be allowed to know. In case the Government are going to say that people have that right under the Data Protection Act, I do not think that that is enough. This is classically a case where that right should be in the Bill so that any person reading the Act, as it will then be, can know where he or she stands.

Amendment No. 80 provides that no fee shall be charged for a copy of an entry unless a person has already had a set of copies within the past year. The amendment allows the Secretary of State to make regulations in relation to that. It also spells out the fact that, in getting a full copy of all past and present entries made in the register, a citizen is also entitled to details of authorisations given under Clause 22. As noble Lords will know, Clause 22 entitles the Secretary of State to give public authorities—which are extremely widely defined—the right to all the information on the register, bar paragraph 9 audit trail data where,

which is defined in Clause 1.

We expect that early in the life of the legislation the Secretary of State will make general orders entitling public authorities to call up information under Section 22. It will therefore be important for the individual concerned to know how often and to whom details of his or her particulars have been supplied under the authorisation of Section 22.

Lord Crickhowell: During the short debate on Amendment No. 53, we discovered how wide the
23 Nov 2005 : Column 1700
discretionary power of the Secretary of State to make entries in the register consistent with the statutory purposes is. We know that the statutory purposes are widely drawn. Although the Minister who replied in that debate gave us some limited and persuasive examples, she did not deny the fact that the scope of the clause was much wider. It therefore seems essential that individuals who may be affected should know exactly what the entry will be. Any other situation would be intolerable. That information about an individual that may be of considerable importance should be placed on a register, and placed there because the individual is considered to be infringing national security or some other crucial matter, without the individual knowing about it would be an extraordinary imposition on individual rights and freedom. It has been said the Data Protection Act perhaps provides for such an entry of information, but this amendment must be made to the Bill. My noble friend drew attention earlier to a case that has received publicity which suggests that the Data Protection Act can perhaps be overruled by later action and legislation. So for all those reasons, and I suspect that there would be a good many others if we were to probe the matter at greater length, I strongly support my noble friend's amendment.

The Earl of Erroll: This amendment is entirely logical, because if one does not know what is on the register, how does one correct it? After all, Clause 12(1)(b) states that a person to whom an identity card has been issued,

If you do not know what the information is, you do not know how to correct it.

My second point is on identity theft. EURIM, the all-party Parliament industry group, of which I am a member, has been discussing ID cards for longer than the Labour Government have been in power because they were first mooted under the Conservatives. We became aware that one of the big problems with the scheme is how one detects whether identity theft is taking place. The most likely person to spot that is the citizen himself. If the citizen is unable to find out what is happening, he cannot be aware that his identity has been stolen. EURIM has suggested a triangle or circle of trust, whereby a broker in the middle would make people aware of what was on the register. It would be along the lines of the credit card model, where you can check up on what information is being held about you and what inquiries people are making about you. It is very important that this information is released to the citizen. Otherwise, he will not know what is going on.

Lord Bassam of Brighton: I shall go very carefully through the various amendments and their implications, and the effect of the clause. I apologise in advance for any imperfections in my explanation. I am sure that the noble Baroness, Lady Scotland, will put them right when she reappears at the Dispatch Box at some later stage.
23 Nov 2005 : Column 1701

Amendment No. 55, which relates to Clause 2(4), would require us to notify any person who is registered under that clause with details of his entry. The noble Baroness, Lady Anelay, said that the amendment is very simple, adding that it is not an unreasonable request. On the face of it, the amendment does appear to be very simple and not unreasonable. However, the amendment contains no exceptions to the requirement. In our view, it is unnecessary and inappropriate to add specific provisions to the Bill in this way.

It is important to appreciate that even verification of information on the register would be caught by the effect of the amendment, as any verification would technically count as an entry on the register. By the later stages of the programme, the amendment could require approximately 500 million notifications per year to be sent out to individuals. A lot of discussions about cost have taken place in your Lordships' House during the progress of this Bill, but it would not be going too far to say that the effect of this amendment would present the agency with very significant cost implications.

In many cases, an entry will have been made at an individual's own request. The Data Protection Act already lays down general rules on notification rights; that is, fair collection principles which require data controllers to inform data subjects of, among other things, the purposes for which information about them is being held. To that extent, we argue that the amendment is unnecessary.

The rules under the Data Protection Act have been carefully considered, and drafted in view of the underlying EU directive. It has already been made clear that the DPA will apply to the ID cards scheme. The Act leaves a certain amount of discretion within the data-controlling authorities when it comes to notification. The obligation to notify applies only "so far as practicable". For example, it may not be practicable to notify someone whose details have been added to the register on deportation to prevent re-entry. Why would that be practicable? Nor does the obligation to notify apply in situations where the exemptions relating to national security and the prevention and detection of crime are applicable.

The majority of people will of course know that they are registered, as they will have applied for and have been issued with an ID card. However, any person concerned that they may have been registered without their knowledge would have data-subject access rights, under the Data Protection Act. The Data Protection Act does not impose an absolute obligation to notify. It is sensitive to matters such as national security, as well as practicalities. We argue this Bill should not provide otherwise. In other words, it should not depart from that fundamental principle.

Amendment No. 167 is, as the noble Baroness advised us, a probing amendment. However, it will place a requirement on the Secretary of State to send a copy of the information held against an individual's entry to the individual's address at least once every two
23 Nov 2005 : Column 1702
years. Amendment No. 80 is similar, in that it gives the individual the right to request a copy of their record, including details of all the verifications. It also states that individuals may be provided with this free of charge, as long as they do not make more than one request per annum. These amendments would place a large and costly administrative burden on the new agency. It has been estimated that once the register is fully populated, approximately 20 million records would have to be sent out every year if, as in Amendment No. 167, the Secretary of State was obliged to send each individual a copy of their record at least once every two years. In Amendment No. 80 the numbers could be even greater, as each individual is entitled to a free copy of their record once every year.

I recognise that noble Lords have concerns about how an individual will be aware of the information that is held about them on the national identity card register, and that those concerns also relate to the duty of the individual to keep their entry updated. However, the two main changes that will need to be updated are first, one's address, and secondly any name changes. We accept that there will be individuals who change nationality or gender, and even those who need to amend their date of birth, but in essence name and address changes are going to form the bulk of updating information requests. These changes are those which the agency will have been notified of by the individuals themselves; therefore we see no need for the agency to send individuals a copy of the information held on them every two years, as the information came from them.

It will be made clear on registration which changes of circumstance need to be notified. For example, only addresses used for three months or more will need to be notified. The obligation to notify of errors obviously applies only to errors of which the person concerned is aware. There should be no room for doubt about what the obligations are. In addition, use of the verification services will encourage people to ensure that their record is up to date.

Amendment No. 187, similar to Amendment No. 55, would place a duty on the Secretary of State to provide all or any details requested by an individual included on the register, where those details relate to his own entry. Again, we believe that the amendment is unnecessary. The provisions of the Data Protection Act apply to the database in the same way as to any other database. There is no attempt to exclude or modify subject access rights under Section 7 of the Data Protection Act. Anyone will be able to apply for a copy of their entry on the register and will have a right to be provided with it, subject only to the exemptions contained in the Data Protection Act.

I do not believe that an absolute right to receive all the information, as proposed by this amendment, would be desirable. For example, if information had been provided to the police for a continuing investigation into serious crime, this fact would be recorded under paragraph 9 of Schedule 1 and could
23 Nov 2005 : Column 1703
be monitored by the scheme commissioner, but it would not be appropriate or in the public interest to reveal that fact to the individual under investigation.

In addition to formal subject access rights under the Data Protection Act, it is planned that an individual will be able to read his card and register entry easily. For example, we expect to offer a service whereby an individual could read the information held on his entry securely via the Internet. Individuals will be able to check the detail of their entry on the register and information regarding verification requests made against it in the previous six or 12 months via a secure web portal—and this will be free. Individuals will also be able to telephone the call centre to check their details, which will be free to the individual, apart from the cost of the phone call.

A full subject access request under the DPA would be subject to the reasonable fee allowed for by that legislation, which is currently £10. Although plans have not yet been finalised for requests of information held on the register which are not done via the Internet, it is apparent that they—unlike Internet checks—incur expenditure in terms of human resources to carry out the check. There would be little difference between a manual limited check and the full subject access request under the Data Protection Act in terms of resources used. It is the case that the Internet is becoming more widely available, with many public facilities, such as libraries, offering access. I stress again that no decision has been taken on this, but it is clearly appropriate for the Secretary of State to have the facility to levy an appropriate charge for offline inquiries.

I apologise for the length of my response, but I believe that it has probably answered most of the points that were made in the opening comments. For all those reasons, I suggest that the amendment should not be pressed to a Division.

Next Section Back to Table of Contents Lords Hansard Home Page