Examination of Witness (Questions 841-859)
Dr Chris Pounder
18 JUNE 2008
Q841 Chairman: Dr Pounder, good morning.
Welcome to the Committee. It is very good of you to come. We are
not being televised this morning but we are being recorded, so
could I ask you, please, to formally identify yourself for the
record, and if you would like to make a short opening statement,
please do.
Dr Pounder: My name is Dr Chris Pounder.
I am currently employed by Pinsent Masons solicitors, law firm.
I have been in data protection for as long as I can imagine, and
I am ready to go, so to speak.
Q842 Chairman: Thank you very much
indeed, and thank you very much for the paper which you sent us.
Perhaps I could kick off by asking how confident you are that
the development of jurisprudence through cases decided in British
and European courts, particularly with reference to European Convention
rights, can provide effective protection for the personal information
of United Kingdom citizens? Is a consistent privacy and data protection
jurisprudence in your opinion already being developed?
Dr Pounder: The short answer is I am
not confident that Article 8 will provide satisfactory jurisprudence
because there are very few cases going to the courts. Those cases
that tend to go into the courts primarily involve, as you say,
people who have celebrity status, and some of the celebrity status
cases involve awkward issues. For example, in the Douglas v
Hello! case there was a privacy case in relation to one magazine
doing a spoiler for another magazine. Article 8 privacy cases
I do not think are a satisfactory jurisprudence; it is a sort
of celebrity endorsement, but in relation to the other cases,
for example, Marper, which is to do with the DNA database,
I think it is an unequal struggle. Anybody who is trying to take
an Article 8 case on has to take on the unlimited resources of
the state. For example, in the case of Marper, the fees
obtained by Marper's team for the whole case, taking it from admissibility
to the Human Rights Court was £1,350 whereas on the Home
Office side there were 11 lawyers and a leading silk. It is an
unequal struggle. What needs to be done, in my view, is a means
by which Article 8 cases become more accessible to the public,
and it can be done by the Data Protection Act.
Q843 Lord Morris of Aberavon: Is
there no legal aid available for persons like Marper?
Dr Pounder: The legal aid budget is very
tight and yes, there is legal aid money. In the Data Protection
Act there is this word "necessary", necessary, for example,
for a statutory function. The word "necessary" has been
interpreted by the courts to have the same meaning as "necessary"
in terms of Article 8. So if you made an explicit link between
the Data Protection Act and the Human Rights Act, you can use
a very simple mechanism in the Data Protection Act to take it
to the Human Rights Court and it makes it more accessible to members
of the public. Yes, there is legal aid, but some of the cases
do not qualify for legal aid because the legal aid budget is so
stressed.
Q844 Lord Lyell of Markyate: Your
written evidence is critical of the weaknesses of the Data Protection
Act, and you draw attention to the European Commission's unease
about the Act's compliance with the terms of the EU Data Protection
Directive. I note you also say at paragraph (g) on page 7 that
the Information Commissioner is not a powerful regulator. You
point out that he has not all the powers of other regulators.
What changes to the Act are required in order to bring it in line
with the Directive, and what are the chances of this happening?
Dr Pounder: This might be, in a sense,
a red herring, because the European Commission and the Government
have disagreements about the Data Protection Directive. In total,
11 articles are under question. What the Commission is worried
about, in my estimation, is the meaning of "personal data"
following the Durant decision, which narrowed the scope
of personal data, the extent to which manual files held by the
private sector are covered by the legislation, the fact that the
courts have assumed that they have an unfettered right to deny
subject access in addition to the other exemptions in the Act,
and the powers of the Commissioner. I do not know what the problems
with the other articles are. There are other reasons for the dispute
between the Commission and the Government because no information
is being made public. Will these changes come into effect? No,
I do not think so, unless the EU start infraction proceedings
and the Government, for example, cave in on those.
Q845 Lord Lyell of Markyate: Can
I just follow that up? While I was a barrister I paid £35
a year to register for the Data Protection Act, declaring another
interest with a very small business running a house in France
where we did not sign up and I am sure we were right not to; it
would have been a perfect pest and a waste of £35. What is
the real problem here? What is the real mischief that the subject
is going to suffer, or is it just another bit of bureaucracy?
I may say I am very much in favour of the Information Commissioner.
I think he is excellent. What is the real problem with the Data
Protection Act? Does it serve a useful purpose?
Dr Pounder: There is no real problem
with the Data Protection Act. The real problem is with the structure
in which it operates. For example, if you assume that Parliament
has a role to scrutinise the executive when it proposes interference
with private and family life, you have to assume also that Parliament
is informed as to the justification for the various interferences.
If you have a Commissioner, for example, a regulator, who has
difficulty naming and shaming organisations that transgress the
Act, then enforcement mechanism is weak. If you have, for example,
a data subject who cannot, shall we say, protect their own privacy,
then there is a need to put into the Data Protection Act a right
to respect the processing of personal data in accordance with
family life, et cetera, in relation to Article 8. That does not
disturb the relationship with the press but it does give the ease
with which individuals who have a grievance can raise matters
with the regulator. So I think it is not the Act that is the problem;
it is the infrastructure that supports the Act.
Q846 Lord Lyell of Markyate: The
difficulty of enforcing it.
Dr Pounder: The difficulty of enforcing
it and also, for example, when Ministers want to propose legislation
in relation to interference, the justifications given to Parliament.
This lack of scrutiny causing a great deal of unease.
Q847 Lord Norton of Louth: I would
like to pick up on the point about the Information Commissioner.
You have mentioned in your evidence that the Information Commissioner's
Office is too limited in its powers to be an effective regulator.
What is it that is missing? What would you do that is specific
to the Commissioner?
Dr Pounder: This would be a long wish
list but I will limit it to four. The first one, I think, is that
the Commissioner has to be given the resources to do the job.
At the moment £10 million is the money that the Commissioner
generates, not from public sources but from registration fees.
This compares unfavourably with the hundreds of millions of pounds
in the budget of the FSA or the Health and Safety Executive or
even the Food Standards Agency. So the ability to do the job is
important, but in relation to powers, my top three would be the
ability to serve what I would call an Article 8 notice, so if
there is a Statutory Instrument enacted by Parliament—and,
as you know, SI procedures are not particularly strong—then
the Commissioner can by notice approach the courts to strike out
a Statutory Instrument, and that would give reassurance to those
that perhaps when you have primary legislation which has wide-ranging
things, like the Secretary of State may by order do something
else, that those powers are not misused. The second one is basically
the ability to refer matters to Parliament. Can I give you an
example? The Audit Commission has a code of practice going out
for consultation at the moment. This code of practice will be
laid before Parliament. There is going to be a consultation process
with the Commissioner. If there is a disagreement, the sort of
procedure that I would like to see is that such a code of practice
has to be approved by, say, a Statutory Instrument procedure by
Parliament. That gives the opportunity for the Commissioner to
identify what the problems are and the ability to Parliament to
identify and take a view as to what public policy should be. It
is that kind of mechanism I am looking for.
Q848 Lord Norton of Louth: So there
are powers you would vest in the Commissioner which he does not
have at present, and on the resource side, you are talking in
terms of giving more resources per se but in terms of the
specificity of those resources, is one of the problems in relation
to the technical know-how that is available to the Commissioner
in order to keep abreast of all the changes in surveillance that
take place?
Dr Pounder: That might be an issue, but
if the Commissioner has resources, he might be able to buy them
in. I do understand from what the Commissioner has said publicly
that he has difficulty retaining staff that he has skilled up,
and obviously that is part and parcel of the resource issue.
Lord Norton of Louth: That is one of the existing
limitations, the nature of those committed resources.
Q849 Lord Rowlands: As you have raised
the issue of Statutory Instruments and primary legislation, do
you think there could be some value in having a robust privacy
impact assessment that any government department drafting legislation
would have to, as it were, put that test and publicly announce
when that is done, and what for, to identify at the beginning
the privacy issues in any Bill or in any Statutory Instrument?
Dr Pounder: Yes, that might help, but
privacy impact assessments as currently viewed by the Commissioner
are a technique for once you have the project design up and running,
to make sure that the project operates within the law and within
the data protection regime. Taking a step back, it is justification.
I would like, and the Joint Committee on Human Rights has mentioned
this, for Parliament to have, say, for example, a Human Rights
Memoranda. That is what the Joint Committee on Human Rights want.
Also, I am not convinced that the legal advice in relation to
a Bill's compliance with human rights cannot be published. The
Government published this legal advice in relation to the use
of the National Identity Register as part of the Citizens Information
Programme. That advice is on the website. If they are publishing
that kind of legal advice for, say, the Citizens Information project,
it is difficult to understand why it cannot reassure Parliament
that essentially it has considered the human rights element practically
and this is the legal advice demonstrating how it is compliant
with it.
Q850 Lord Rowlands: Would the value
of such an assessment right at the beginning in the preparation
of a Bill or of an Order at least flag up to anybody interested
in parliamentary terms that they would see that there was an issue
or there could be an issue at an earlier stage? All your evidence
suggests we do not see it.
Dr Pounder: No, I am not saying that
at all. The privacy impact assessment is a risk assessment, and
part of the risk assessment is, I would have thought, what the
value is of the interference. For example, if you take the Audit
Commission code of practice, it said, "Before we do a data-matching
exercise we will do a pilot study." It does not say that
in the code of practice but it could do: that pilot study could
identify the costs involved in the interference, the amount of
money involved in the interference, how the interference is done,
and the outcomes, so that people could see whether or not the
interference was worth its weight in gold or whether the data-matching
exercise has worked. I agree with you there is an important stage
here in making sure that people take account of the risks, but
when the Government takes account of the risks, you have an extra
step here in relation to legislation which is that Parliament
has to scrutinise. If Parliament is to scrutinise what the Government
is saying, and Parliament is going to authorise interference,
at least the parliamentary authority needs a fully informed debate.
Obviously, a privacy impact assessment could form part of that
but it is not what the Commissioner thinks a privacy impact assessment
is.
Q851 Lord Lyell of Markyate: As we
know, Ministers put their name to Bills saying they are compliant
with the Convention but you are suggesting that their Department
should publish an opinion which indicates that it has considered
the issues, the pros and cons, and setting out the legal reasons
why it thinks it is compliant. It sounds a good idea to me.
Dr Pounder: Absolutely. I think the Joint
Committee on Human Rights has actually expressed that, and from
what I understand, the Joint Committee on Human Rights is going
"quietly spare" that it has not been done.
Q852 Lord Morris of Aberavon: On
the same point, these statements of compliance with the Convention
are made. Are there any examples in your field where, the statement
having been made, it is found subsequently that they are not in
compliance?
Dr Pounder: It is very difficult. Say,
for example, the identity card legislation. As you know, it is
a paving Bill with wide-ranging powers. The only way to challenge
in human rights is, first of all, to have a Statutory Instrument,
then somebody to put their head above the parapet to take a human
rights case. It is a long way down the chain. If you look, for
example, at the Copland case, which I thought was "slam
dunk", the Copland case was the woman from a West
Glamorgan further education college, and her communications were
interfered with. The case was well before RIPA, yet it took round
about eight to ten years to get to the Human Rights Courts, by
which time it is too late. What you need is something more immediate,
more accessible. If somebody can raise a valid human rights case,
I can go to the Information Commissioner and say, "Look,
I think this is unlawful because of so-and-so," and if the
Commissioner agrees, he can start a mechanism that could strike
the order out.
Q853 Lord Morris of Aberavon: What
you want is an early mechanism to prove the value of the ministerial
assurance.
Dr Pounder: Yes, absolutely. There are
a lot of parliamentary Committees, certainly the Joint Committee
on Human Rights, saying "We can't perform our scrutiny job
if we don't have this information." Ministers argue that
you do not need to worry about the Statutory Instruments because
if they get it wrong, the courts will strike them out, but who
is going to put their head above the parapet and when? Ten years
down the line. Such litigants are going to put their house on
the line against, for example, the unlimited resources of the
taxpayer. It is an unequal struggle. There needs to be something
far more accessible where these things can be tested. I am quite
happy for Ministers to say, "Look, I don't need to bother
Parliament about the detail but if we get it wrong, the SI is
going to be struck out" if there is an easy mechanism whereby
that can be challenged. The ability of having that mechanism would
mean, I think, that civil servants would be very mindful of the
Human Rights Act when they drafted their Statutory Instrument
because they would not want the Commissioner to strike it out.
Q854 Lord Smith of Clifton: Dr Pounder,
in your evidence you gave a detailed case study of how scrutiny
of the purpose of the National Identity Register was in effect
prevented by Ministers. You say that this raises a constitutional
question about the Government's plans for this database. Without
rehearsing the NIR case, could you please elaborate on this view
and explain how the case "raises questions about Parliament's
ability to scrutinise any legislation effectively"?
Dr Pounder: Just to go into the history,
when I wrote that analysis, I became more and more shocked as
to the discrepancies between what Parliament was told and what
the officials had decided. I do not know whether it is deliberate
or not but I just reported the facts to the Department. What is
the use of the NIR for a public administration purpose really
about? It is about efficient and effective public services, yet
Parliament was—how shall I say—not informed as fully
as it should have been. If you go back over the years and if you
look at, for example, Supergun, Matrix Churchill, the war in Iraq,
BAe, what should Parliament be informed of? Those sorts of cases
have a problem—it may be trade, it may be national security,
it maybe foreign affairs overtones which make it difficult for
Ministers to respond. The worry for me is that my evidence on
the NIR and public administration is that there is nothing about
national security, nothing about foreign affairs; it is about
effective public service delivery. There should be no prohibition
on releasing information to Parliament. So now we have two extremes.
If, for example, it is something like Supergun, one where Parliament
is not informed, then essentially, in relation to the NIR uses
for public administration, Parliament is not informed—what
happens to everything in the middle? That is the question it raises.
That is the reason why I say it does raise this particular question.
My own view is that Ministers drip-feed information to Parliament
when it is appropriate. For example, in that evidence I showed
that there was a written statement prepared just after the General
Election which was not published for nine months, a written statement
saying the NIR would be used for public administration purposes.
Before the Bill came before Parliament, the Government knew that
20 per cent of the business case for the identity card relied
upon the use of the database for public administration purposes.
They knew that the identity card had to be compulsory to get that
20 per cent. I have not found any ministerial statement, apart
from the written statement that was produced after the legislation
passed through Parliament. This Constitution Committee was worried
about the relationship between the state and the individual in
relation to the NIR and published two reports. Did it know that
the Government were planning to use the identity card database
as an information resource? The other fact of course is David
Blunkett had produced two public statements, documents of 150
pages each, which assured members of the public that the database
was not going to be used for this purpose. There are lots of constitutional
issues around this, and what I would like you to do is not see
that evidence as knocking the use of the NIR as a public information
resource or a population register. I think there are good arguments
for it. What you should look at is how Parliament was informed,
if Parliament was not informed, how can it scrutinise?
Q855 Baroness Quin: Just following
up the question relating to scrutiny, the evidence in paragraph
17—this is written in May 2007 -talks about "the next
Prime Minister has signalled his intention to grant parliament
more powers of scrutiny." Presumably, the next Prime Minister
was Gordon Brown at that point. Has anything happened, and in
what context was that commitment given?
Dr Pounder: The draft Constitutional
Renewal Bill is now being debated. I think the Prime Minister
gave a speech where he said that he was looking at the ability
to balance the two. That is why I picked up on that speech saying
proposals would come forward, which I assume now is the draft
Constitutional Renewal Bill.
Q856 Baroness Quin: Is there anything
in there that gives you comfort?
Dr Pounder: No, not on this particular
issue. We are talking about general interference and the ability
of the executive to be scrutinised. Parliament has to have the
information to allow that scrutiny to occur. That is what I am
really worried about. I see nothing that requires Ministers to
provide information to Parliament. Yes, they will give assurances;
yes, there might be problems in producing certain information,
but Parliament has committees that deal with sensitive matters
and there are always sensitive data procedures. But the fact that
information is, shall we say, withheld from Parliament on something
as mundane as public administration I think is shocking, to put
it bluntly.
Q857 Lord Rowlands: On first reading
the appendix to your evidence I thought it was a devastating critique.
This is over a year old. Has there been a rejoinder? Have they
engaged you in argument or debate on your assessment?
Dr Pounder: No. All I laid out was the
evidence. I tried to withhold the comments that I could have made.
Q858 Lord Rowlands: There has not
been a response to this?
Dr Pounder: There has not been a response.
I do not know whether there has been a miscommunication between
the civil servants and Ministers but I think the evidence should
be seen as, is this how Parliament is treated for every single
thing? It is rather as if Parliamentary management and news management
are the same thing.
Q859 Lord Peston: I am still a bit
lost on this. Like Lord Rowlands, I was very impressed with the
criticisms you offered but, as a long-time supporter of identity
cards—and I declare an interest—it seems to me obvious
that identity cards, to be of any use, have to be compulsory and
the notion of an optional identity care seems to me ridiculous,
but equally, I had always assumed that the identity card had both
a public sector side to it and a private sector side, because
a great deal of a person's life dealing with private sector matters
is establishing who they are. Given that, and ignoring totally
the fact that people like me thought it was going to be a simple
scheme—and it has got so complex that we all know it is
going to be a disaster—what troubles me is this business
of Ministers, in a sense, misleading Parliament. Is not the purpose
of the register perfectly obvious? What is the Government concealing
here? I put this to you to raise the difficulty: what do you want
the Government to be saying to us, if you like? What information
are they withholding from us?
Dr Pounder: They are not withholding
information; they are just revealing it at a time which is very
convenient for the scrutiny process. To go back to the Written
Statement, it was prepared before the Second Reading of the Identity
Card Bill. It could have been issued. Parliament could have debated
whether or not the National Identity Register should be used for
public administration purposes but that was withheld for some
reason.
|
