---

The Bill must comply with the Data Protection Act, which gives people the right to access their personal data. It imposes an obligation on schools and colleges to provide information about their students to a local authority if they are requested to do so by that authority. Such information could relate to the student’s academic record, to personal problems brought to a tutor’s attention, to financial or health information, or information on behaviour—indeed, anything else that the school or college happens to hold.

Clause 14(4) as it stands allows an opt-out, but our amendment would make it an opt-in approach. We would require the student to give written consent before any information about him could be supplied. That would mean that the local authority would have actively to approach the student to ask for consent so that the student would necessarily know what was going on. We are talking about the most sensitive and private information. It is not unreasonable that we should give individuals a say over what local authorities and others are collecting on them and why. Giving people control over their own personal details should be an uncontroversial measure.

Our amendments would also give the student the right to examine the information and have any inaccuracies corrected. If agreement on the correction could not be reached, the matter would be referred to a neutral body—the Information Commissioner—for adjudication. I cannot see why it should be a contentious proposal. There can be no defence for allowing incorrect information to go unchecked, when the consequences could have such serious repercussions. I beg to move.

3 July 2008 : Column 416

Baroness Sharp of Guildford: We have one small amendment in this large group, Amendment No. 92, which would make sure that inclusion of data on the database had the written consent of the person concerned. All these amendments are on the same subject. As the noble Baroness, Lady Morris, made clear, we are discussing the integrity and use of the databases and the degree to which those who use them adhere to the highest standards of data protection. She reminded the Minister of the lapses that have taken place in the past few months.

We should be aware that as the potential of information technology increases so we are seeing an increasing number of extremely large databases where a great deal of information, some of it highly confidential and personal, is stored. In the case of Her Majesty’s Revenue and Customs and child benefits, the information included the names and addresses of children and the bank account numbers of their parents. Under the Children Act, we are compiling a great national database of children. We know that many active paedophile rings are using the internet constantly. Therefore, one does not want any chance to be given for obtaining data containing lists of names and addresses of children. One does not wish such data to be leaked out and made available to the general public. It is extremely important that all those concerned with handling the data adhere to the strict requirements of the Data Protection Act, in terms of making sure that the data on databases are accurate, that the person concerned knows that they are there and has the chance to make sure that they are accurate and that those handling the data recognise their confidentiality and adhere to proper standards of encryption when passing them over.

Our concern arises from the multiplication of databases. We spoke under earlier amendments about databases currently held by Connexions that would be passed over to local authorities. We may have a duplicate of the national database of children. We know that data will have regularly to be passed on from one person to another. It is therefore extremely important that those concerned with handling the data adhere to the highest standards. One aspect of those standards is the written consent: making sure that those whose data are on a database know that they are there and have given permission for their use.

Baroness Perry of Southwark: Will the Minister answer a factual question? I know that the duty in the Bill is to pass on the information to the local authority, but would it not also have to be to the governing bodies of schools, which are not within local authorities’ purview?

Lord Adonis: For me to answer a question, I need to understand it properly. Much of the information provided to the local authority will have come from the school in any event. Is the noble Baroness referring to schools that have not provided the information having access to it?

Baroness Perry of Southwark: I was thinking particularly of Clause 15, which relates to the passing on of social security data and to which some of the

3 July 2008 : Column 417

amendments refer. Social security data are passed on to the local authority, but what would happen in the case of young people who are at schools that do not come within the local authority’s purview—for example, independent schools and city academies? Would it not be necessary also for them to have the data?

3.30 pm

Lord Adonis: No, they would not have access to those data.

Perhaps I may make two preliminary comments, because I understand the gravity of the issues that we are discussing. I understand that Parliament has an absolute duty to see that personal data are handled appropriately and are not disclosed in an unauthorised way, and that security is paramount. My first general point is to note that the provisions in this Bill are very similar to those to which Parliament has already agreed in respect of Section 117 of the Learning and Skills Act 2000, in terms of duties on educational institutions to provide information; Section 119, in terms of the duties and powers of Secretaries of State to provide information—that particularly applies to Jobcentre Plus—and Section 120, in terms of the powers of other public bodies to provide information. The provisions of the 2000 Act enabled the Connexions databases to be established and the provisions in this Bill substantially replicate those provisions. That is the first general remark that I make. We are not, as we have been in some other contexts—and I appreciate the controversy of some of those proposals—introducing substantially new databases.

My second point is that existing Connexions databases must adhere to national specifications to ensure minimum standards of consistency and to ensure that they have security built into local systems so that individual data are accessible only to those with a need to view the information. All users of the systems are expected to be trained in handling personal and sensitive data and to be aware of the data protection and security procedures in place. To date, I am informed, there has not been a single breach of security involving Connexions data at a local or national level. I make those two preliminary remarks in respect of concerns raised on data.

I can meet most of the specific points raised—and then we have the simple issue of opt-in versus opt-out. The amendments proposed by the noble Baroness, Lady Morris—Amendments Nos. 72, 84, 91 and 105—state that disclosure of information under Clauses 14 to 17 should be subject to the provisions of the Data Protection Act. That is indeed the case. The Act applies to all disclosures of personal data. It is of general application and there is no requirement for explicit references to the Act or its principles on the face of other legislation for this to be the case. Not only would making such references be unnecessary as a matter of law, but it would increase the burden on Parliament every time it scrutinised such legislation to re-enact time and again the said provisions.

We can also meet the noble Baroness’s concerns on her Amendments Nos. 77 and 102, on the right for young people to examine information held on them. Learning providers, public bodies and local authorities

3 July 2008 : Column 418

already have to comply with the Data Protection Act in this regard. This clause is similar to existing arrangements, which are covered by the Data Protection Act. This means that a young person can already request a copy of their personal information held by their school or college, or other public body, and they could put the same request to Connexions or the local authority whenever they wished.

On Amendments Nos. 78 and 103, if a young person believes that the information held on them is inaccurate, they can write to the organisation to set out what they believe is wrong with their information and what should be done to correct it. If the necessary changes are not made, an individual can take the organisation to court and can ask the Information Commissioner to assess whether the processing of their personal data has been carried out in compliance with the provisions of the Act. That was another of the noble Baroness’s concerns.

On Amendments Nos. 83 and 101, the principles of fairness contained in the Data Protection Act already mean that it is necessary to inform a person if personal data relating to him or her are being, or will be, shared, unless such notification is not practicable. The effect of Amendment No. 83 would be that providers would be required to write to each of their students annually informing them of their rights under subsection (4). Learning providers have had arrangements in place to do this with regard to information disclosures to Connexions since 2000, and these have a good track record. Currently, schools write to the parents of all pupils approaching the age of 13, letting them know that information about their children will be shared with the Connexions service unless they request that it should not be.

Parents are provided with a form to sign and return to the school if they do not want additional information about their child to be passed to Connexions. We provide standard templates of these forms to local authorities, which provide them to schools. I can provide them to the noble Baroness. Schools use these letters on a standard basis as pupils approach the age of 13, so parents have the opportunity to opt out of the provision of this information if they so wish. Amendment No. 101 goes too far in specifying that under Clause 16 a local authority would have to notify the young person concerned within seven days of the information being supplied. Setting such a specific time limit within which this must be done would be unnecessarily inflexible and burdensome.

Amendments Nos. 73 and 177 concern written consent for the provision of information. I stress again that information-sharing provisions have been in place since 2000. There is the opportunity now for all parents—and pupils and young people as appropriate—to opt out of the provision of information. These provisions are already in place and have worked well. The amendment would add bureaucracy and unnecessary complexity to the system and reduce the ability of the local authorities and Connexions to ensure that timely and appropriate support can be provided to young people in finding and accessing appropriate courses. Many young people or their parents may simply forget or neglect to sign and send in the necessary form. Only

3 July 2008 : Column 419

those who had actually sent in the form could be covered in respect of the provision of information. As the noble Baroness will appreciate, this will be a particular risk for young people who have—if I may put it this way—chaotic lifestyles. It is precisely such young people whom we are particularly anxious to help in terms of support to continue engaging in education and training.

We believe that Clauses 14 and 57 strike the right balance between enabling the local authority to fulfil its duty of promoting participation, providing the Connexions service and tracking young people effectively to enable that, and respecting young people’s right to prevent certain information about them from being shared. I emphasise again safeguards that are already in place. Under the Data Protection Act, individuals have the right to request a copy of the personal information held on them by an organisation. The organisation must inform the young person if personal data relating to him or her are being shared, if notification is practicable. Furthermore, under subsection (4) of Clauses 14 and 57, young people are able to prevent additional information about them from being passed on to the local authority. Similar arguments apply to Amendments Nos. 79, 80 and 82, which would turn the existing opt-out regime into an opt-in regime in respect of additional information beyond simply name, address and date of birth for post-16 students and their education or training destinations.

The noble Baroness did not speak to Amendment No. 89 but, as she said, I even reply to her amendments when she has not explained what she thinks they are intended to mean. Amendment No. 89 would affect the ability of Jobcentre Plus to provide information. Again, it is important to understand that this provision is not new. There is already a power for the Secretary of State to pass information on to Connexions in this area under Section 119 of the Learning and Skills Act 2000. There are also other powers in social security legislation that permit Jobcentre Plus to provide information on 16 and 17 year-olds claiming benefit. For certain 16 and 17 year-olds, it is a condition of claiming certain benefits that they are in contact with Connexions, so that we can be sure that they are getting the help and support that they need. I imagine that the noble Baroness would support the need for these requirements. Jobcentre Plus has the power to share these young people’s information for benefit purposes without obtaining consent.

Amendment No. 179, in the name of the noble Baroness, Lady Morris, on the disclosure of information to Connexions by schools and colleges, would prevent Connexions services from having access to students and available facilities in their place of learning, unless consent was given by the student. This would make it very difficult for the Connexions service to provide support to young people. It would also create an unhelpful, complicated and confusing layer of bureaucracy for schools and colleges. Good-quality information, advice and guidance are vital to ensure that young people make the right choices about their future. If the amendment were accepted, the Connexions service would be unable to access in their place of learning young people who either failed or refused to give consent. Very often these young people would be the

3 July 2008 : Column 420

most vulnerable. This amendment would effectively bar Connexions from helping the young people who need its support most.

Finally, Amendment No. 178 would require every educational institution, before supplying information on its students in response to a request from the Connexions service, to satisfy itself that it was conforming to Article 8 of the European Convention on Human Rights. Article 8 is the right to respect for private and family life. It is a most important safeguard to the rights of the individual. It is, however, a qualified right. The convention allows for circumstances in which an interference with this right can be justified by the state.

My honourable friend the Minister for Schools in another place wrote to Andrew Dismore, chair of the Joint Committee on Human Rights, in January about the possibility that the duty on educational institutions in Clause 57 to provide information on their students would interfere with this right. The letter extends to 20 closely typed pages. I will copy it to the noble Baroness, but perhaps I may summarise it briefly.

My honourable friend argued that interference with Article 8 in Clause 57 was justified on four grounds. First, what we seek to be protected in requesting this information is the well-being of the young people themselves. The information collected will be used for improving the participation and general attainment in education and training of young people, thereby ensuring a more skilled workforce. Secondly, the provision of relevant information on individual students to Connexions services is necessary so that every young person is identified for whom local authorities have duties to provide support through Connexions.

Thirdly, the measure is proportionate to the aim. Only through the provision of this information by schools and colleges can the full group of young people, for whom local authorities have duties set out in Part 2, be identified. I remind the Committee that the information consists of the student’s name, address, date of birth and other information relevant to Connexions services, but does not go beyond that, except in respect of the name and address of the parents. Fourthly and finally, specific safeguards are in place to ensure compatibility with Article 8. The information, which must be relevant to enabling or assisting the local authority in exercising its Part 2 functions, can be provided only to a person providing Connexions services. The passing of the information is under the control of “the responsible person”—for example, in a school it is the governing body. Under subsection (4) the young person, or, if they are under 16, their parents, can prevent any additional information from being passed to the Connexions service in the way that I described earlier.

In the light of all these considerations, we believe that the qualified right under Article 8 has been satisfied by the limited nature of this duty on the responsible persons in schools and colleges. Furthermore, an educational institution, by virtue of Section 3 of the Human Rights Act 1998, is obliged to read and give effect to the duty in Clause 57 in a way that is compatible with Article 8 and other convention rights. I hope that I have met most of the points raised by the noble Baroness.

3 July 2008 : Column 421

Baroness Perry of Southwark: I am doubly confused about the Minister’s earlier answer to me, because it seems crystal clear that information supplied under Clause 17 to the local authority by, for example, the police, the Probation Service, the youth offending team or whoever must be shared with the service provider; in other words, with a school governing body or whatever. Clause 57, to which the Minister extensively referred, shows absolutely clearly that this information can fly around.

The Minister has generously admitted that we are dealing with very serious matters. I just want to emphasise that the governing body of a school includes the friends and neighbours of the young persons and their parents, and their local shops and local providers. I have heard governing bodies gossiping about young people in the school and reminded them of their duties under existing legislation. In the Minister’s earlier answer to me he said that the governing body would not have this information. Surely it will.

3.45 pm

Lord Adonis: I understand the noble Baroness's confusion. Like me, as a non-lawyer she might have thought that “service provider” in Clause 17(2)(b) might refer to a school. It does not. A “service provider” is defined in Clause 17(7), a huge subsection, which states:

“‘service provider’, in relation to a local education authority in England, means ... where the authority itself provides services”—

we are talking about Connexions services in this regard—

“in exercise of its functions”,

or where,

“in exercise of its functions ... the authority makes arrangements for the provision of services”;

that is, by others providing those Connexions services on contract. In neither of those cases would it be a governing body of a school or a school itself. Those would not be a service provider for the purposes of providing the Connexions services in question under this clause.

Baroness Perry of Southwark: I understand that, and I have read the clause very carefully. However, I have also read Clause 57. I find the Connexions service just as worrying. A local contractor or local school company can provide that sort of information. However, Clause 57 clearly states:

“Relevant information about a pupil or student ... must be provided by the responsible person to a person involved in the provision of services in pursuance of section 54”.

It goes on to say that the “responsible person” can mean the governing body, the local education authority, the proprietor of an independent school or whatever. This flow of information seems to include everyone concerned, whether within schools, the local authority or what replaces the Connexions service.

Lord Adonis: That is not my reading of Clause 57. Clause 57(1) specifically states:

“Relevant information about a pupil or student who is attending an educational institution in England must be provided by the responsible person”.

3 July 2008 : Column 422

That is about the provision of information, not the use of information thereafter; that is, accessing databases and so on. I understood the noble Baroness to raise the issue of the use of the information—who has access to that database and can use it. Of course a school must provide information in the circumstances set out. It will be one of the main providers of information because most of the students, I am glad to say, will be at school.

Baroness Perry of Southwark: Forgive me if I am being exceptionally thick, but how can they provide the information unless they access the database, which will include far more than they themselves know? Surely the database from which they will provide information to anybody else, as this clause requires them to do, will be the one that the local authority has acquired from all these other bodies, including the police?

Lord Adonis: That is precisely the point. The school provides the information to those who maintain the database. The school does not maintain it.

Baroness Morris of Bolton: The school cannot access the database either?

Lord Adonis: No.

Lord Lucas: Perhaps I may ask a question about Clause 14. My understanding is that when a local education authority wants to know what courses a child is doing and whether they are attending them, the source of that information will be the educational institution, and the power to get that information will be under Clause 14(3)(c), a provision under which the child can refuse to allow information to be distributed. So, if a child has exercised that right, the local education authority will know that they are registered with a particular institution but will have no information about what they are doing there. How does that interact with Clause 39(1), on the conditions under which a local authority can take steps to issue an attendance notice?

---