Surveillance: Citizens and the State - Constitution Committee Contents

Examination of Witness (Questions 841-859)

Dr Chris Pounder

18 JUNE 2008

  Q841  Chairman: Dr Pounder, good morning. Welcome to the Committee. It is very good of you to come. We are not being televised this morning but we are being recorded, so could I ask you, please, to formally identify yourself for the record, and if you would like to make a short opening statement, please do.

  Dr Pounder: My name is Dr Chris Pounder. I am currently employed by Pinsent Masons solicitors, law firm. I have been in data protection for as long as I can imagine, and I am ready to go, so to speak.

  Q842  Chairman: Thank you very much indeed, and thank you very much for the paper which you sent us. Perhaps I could kick off by asking how confident you are that the development of jurisprudence through cases decided in British and European courts, particularly with reference to European Convention rights, can provide effective protection for the personal information of United Kingdom citizens? Is a consistent privacy and data protection jurisprudence in your opinion already being developed?

  Dr Pounder: The short answer is I am not confident that Article 8 will provide satisfactory jurisprudence because there are very few cases going to the courts. Those cases that tend to go into the courts primarily involve, as you say, people who have celebrity status, and some of the celebrity status cases involve awkward issues. For example, in the Douglas v Hello! case there was a privacy case in relation to one magazine doing a spoiler for another magazine. Article 8 privacy cases I do not think are a satisfactory jurisprudence; it is a sort of celebrity endorsement, but in relation to the other cases, for example, Marper, which is to do with the DNA database, I think it is an unequal struggle. Anybody who is trying to take an Article 8 case on has to take on the unlimited resources of the state. For example, in the case of Marper, the fees obtained by Marper's team for the whole case, taking it from admissibility to the Human Rights Court was £1,350 whereas on the Home Office side there were 11 lawyers and a leading silk. It is an unequal struggle. What needs to be done, in my view, is a means by which Article 8 cases become more accessible to the public, and it can be done by the Data Protection Act.

  Q843  Lord Morris of Aberavon: Is there no legal aid available for persons like Marper?

  Dr Pounder: The legal aid budget is very tight and yes, there is legal aid money. In the Data Protection Act there is this word "necessary", necessary, for example, for a statutory function. The word "necessary" has been interpreted by the courts to have the same meaning as "necessary" in terms of Article 8. So if you made an explicit link between the Data Protection Act and the Human Rights Act, you can use a very simple mechanism in the Data Protection Act to take it to the Human Rights Court and it makes it more accessible to members of the public. Yes, there is legal aid, but some of the cases do not qualify for legal aid because the legal aid budget is so stressed.

  Q844  Lord Lyell of Markyate: Your written evidence is critical of the weaknesses of the Data Protection Act, and you draw attention to the European Commission's unease about the Act's compliance with the terms of the EU Data Protection Directive. I note you also say at paragraph (g) on page 7 that the Information Commissioner is not a powerful regulator. You point out that he has not all the powers of other regulators. What changes to the Act are required in order to bring it in line with the Directive, and what are the chances of this happening?

  Dr Pounder: This might be, in a sense, a red herring, because the European Commission and the Government have disagreements about the Data Protection Directive. In total, 11 articles are under question. What the Commission is worried about, in my estimation, is the meaning of "personal data" following the Durant decision, which narrowed the scope of personal data, the extent to which manual files held by the private sector are covered by the legislation, the fact that the courts have assumed that they have an unfettered right to deny subject access in addition to the other exemptions in the Act, and the powers of the Commissioner. I do not know what the problems with the other articles are. There are other reasons for the dispute between the Commission and the Government because no information is being made public. Will these changes come into effect? No, I do not think so, unless the EU start infraction proceedings and the Government, for example, cave in on those.

  Q845  Lord Lyell of Markyate: Can I just follow that up? While I was a barrister I paid £35 a year to register for the Data Protection Act, declaring another interest with a very small business running a house in France where we did not sign up and I am sure we were right not to; it would have been a perfect pest and a waste of £35. What is the real problem here? What is the real mischief that the subject is going to suffer, or is it just another bit of bureaucracy? I may say I am very much in favour of the Information Commissioner. I think he is excellent. What is the real problem with the Data Protection Act? Does it serve a useful purpose?

  Dr Pounder: There is no real problem with the Data Protection Act. The real problem is with the structure in which it operates. For example, if you assume that Parliament has a role to scrutinise the executive when it proposes interference with private and family life, you have to assume also that Parliament is informed as to the justification for the various interferences. If you have a Commissioner, for example, a regulator, who has difficulty naming and shaming organisations that transgress the Act, then enforcement mechanism is weak. If you have, for example, a data subject who cannot, shall we say, protect their own privacy, then there is a need to put into the Data Protection Act a right to respect the processing of personal data in accordance with family life, et cetera, in relation to Article 8. That does not disturb the relationship with the press but it does give the ease with which individuals who have a grievance can raise matters with the regulator. So I think it is not the Act that is the problem; it is the infrastructure that supports the Act.

  Q846  Lord Lyell of Markyate: The difficulty of enforcing it.

  Dr Pounder: The difficulty of enforcing it and also, for example, when Ministers want to propose legislation in relation to interference, the justifications given to Parliament. This lack of scrutiny causing a great deal of unease.

  Q847  Lord Norton of Louth: I would like to pick up on the point about the Information Commissioner. You have mentioned in your evidence that the Information Commissioner's Office is too limited in its powers to be an effective regulator. What is it that is missing? What would you do that is specific to the Commissioner?

  Dr Pounder: This would be a long wish list but I will limit it to four. The first one, I think, is that the Commissioner has to be given the resources to do the job. At the moment £10 million is the money that the Commissioner generates, not from public sources but from registration fees. This compares unfavourably with the hundreds of millions of pounds in the budget of the FSA or the Health and Safety Executive or even the Food Standards Agency. So the ability to do the job is important, but in relation to powers, my top three would be the ability to serve what I would call an Article 8 notice, so if there is a Statutory Instrument enacted by Parliament—and, as you know, SI procedures are not particularly strong—then the Commissioner can by notice approach the courts to strike out a Statutory Instrument, and that would give reassurance to those that perhaps when you have primary legislation which has wide-ranging things, like the Secretary of State may by order do something else, that those powers are not misused. The second one is basically the ability to refer matters to Parliament. Can I give you an example? The Audit Commission has a code of practice going out for consultation at the moment. This code of practice will be laid before Parliament. There is going to be a consultation process with the Commissioner. If there is a disagreement, the sort of procedure that I would like to see is that such a code of practice has to be approved by, say, a Statutory Instrument procedure by Parliament. That gives the opportunity for the Commissioner to identify what the problems are and the ability to Parliament to identify and take a view as to what public policy should be. It is that kind of mechanism I am looking for.

  Q848  Lord Norton of Louth: So there are powers you would vest in the Commissioner which he does not have at present, and on the resource side, you are talking in terms of giving more resources per se but in terms of the specificity of those resources, is one of the problems in relation to the technical know-how that is available to the Commissioner in order to keep abreast of all the changes in surveillance that take place?

  Dr Pounder: That might be an issue, but if the Commissioner has resources, he might be able to buy them in. I do understand from what the Commissioner has said publicly that he has difficulty retaining staff that he has skilled up, and obviously that is part and parcel of the resource issue.

  Lord Norton of Louth: That is one of the existing limitations, the nature of those committed resources.

  Q849  Lord Rowlands: As you have raised the issue of Statutory Instruments and primary legislation, do you think there could be some value in having a robust privacy impact assessment that any government department drafting legislation would have to, as it were, put that test and publicly announce when that is done, and what for, to identify at the beginning the privacy issues in any Bill or in any Statutory Instrument?

  Dr Pounder: Yes, that might help, but privacy impact assessments as currently viewed by the Commissioner are a technique for once you have the project design up and running, to make sure that the project operates within the law and within the data protection regime. Taking a step back, it is justification. I would like, and the Joint Committee on Human Rights has mentioned this, for Parliament to have, say, for example, a Human Rights Memoranda. That is what the Joint Committee on Human Rights want. Also, I am not convinced that the legal advice in relation to a Bill's compliance with human rights cannot be published. The Government published this legal advice in relation to the use of the National Identity Register as part of the Citizens Information Programme. That advice is on the website. If they are publishing that kind of legal advice for, say, the Citizens Information project, it is difficult to understand why it cannot reassure Parliament that essentially it has considered the human rights element practically and this is the legal advice demonstrating how it is compliant with it.

  Q850  Lord Rowlands: Would the value of such an assessment right at the beginning in the preparation of a Bill or of an Order at least flag up to anybody interested in parliamentary terms that they would see that there was an issue or there could be an issue at an earlier stage? All your evidence suggests we do not see it.

  Dr Pounder: No, I am not saying that at all. The privacy impact assessment is a risk assessment, and part of the risk assessment is, I would have thought, what the value is of the interference. For example, if you take the Audit Commission code of practice, it said, "Before we do a data-matching exercise we will do a pilot study." It does not say that in the code of practice but it could do: that pilot study could identify the costs involved in the interference, the amount of money involved in the interference, how the interference is done, and the outcomes, so that people could see whether or not the interference was worth its weight in gold or whether the data-matching exercise has worked. I agree with you there is an important stage here in making sure that people take account of the risks, but when the Government takes account of the risks, you have an extra step here in relation to legislation which is that Parliament has to scrutinise. If Parliament is to scrutinise what the Government is saying, and Parliament is going to authorise interference, at least the parliamentary authority needs a fully informed debate. Obviously, a privacy impact assessment could form part of that but it is not what the Commissioner thinks a privacy impact assessment is.

  Q851  Lord Lyell of Markyate: As we know, Ministers put their name to Bills saying they are compliant with the Convention but you are suggesting that their Department should publish an opinion which indicates that it has considered the issues, the pros and cons, and setting out the legal reasons why it thinks it is compliant. It sounds a good idea to me.

  Dr Pounder: Absolutely. I think the Joint Committee on Human Rights has actually expressed that, and from what I understand, the Joint Committee on Human Rights is going "quietly spare" that it has not been done.

  Q852  Lord Morris of Aberavon: On the same point, these statements of compliance with the Convention are made. Are there any examples in your field where, the statement having been made, it is found subsequently that they are not in compliance?

  Dr Pounder: It is very difficult. Say, for example, the identity card legislation. As you know, it is a paving Bill with wide-ranging powers. The only way to challenge in human rights is, first of all, to have a Statutory Instrument, then somebody to put their head above the parapet to take a human rights case. It is a long way down the chain. If you look, for example, at the Copland case, which I thought was "slam dunk", the Copland case was the woman from a West Glamorgan further education college, and her communications were interfered with. The case was well before RIPA, yet it took round about eight to ten years to get to the Human Rights Courts, by which time it is too late. What you need is something more immediate, more accessible. If somebody can raise a valid human rights case, I can go to the Information Commissioner and say, "Look, I think this is unlawful because of so-and-so," and if the Commissioner agrees, he can start a mechanism that could strike the order out.

  Q853  Lord Morris of Aberavon: What you want is an early mechanism to prove the value of the ministerial assurance.

  Dr Pounder: Yes, absolutely. There are a lot of parliamentary Committees, certainly the Joint Committee on Human Rights, saying "We can't perform our scrutiny job if we don't have this information." Ministers argue that you do not need to worry about the Statutory Instruments because if they get it wrong, the courts will strike them out, but who is going to put their head above the parapet and when? Ten years down the line. Such litigants are going to put their house on the line against, for example, the unlimited resources of the taxpayer. It is an unequal struggle. There needs to be something far more accessible where these things can be tested. I am quite happy for Ministers to say, "Look, I don't need to bother Parliament about the detail but if we get it wrong, the SI is going to be struck out" if there is an easy mechanism whereby that can be challenged. The ability of having that mechanism would mean, I think, that civil servants would be very mindful of the Human Rights Act when they drafted their Statutory Instrument because they would not want the Commissioner to strike it out.

  Q854  Lord Smith of Clifton: Dr Pounder, in your evidence you gave a detailed case study of how scrutiny of the purpose of the National Identity Register was in effect prevented by Ministers. You say that this raises a constitutional question about the Government's plans for this database. Without rehearsing the NIR case, could you please elaborate on this view and explain how the case "raises questions about Parliament's ability to scrutinise any legislation effectively"?

  Dr Pounder: Just to go into the history, when I wrote that analysis, I became more and more shocked as to the discrepancies between what Parliament was told and what the officials had decided. I do not know whether it is deliberate or not but I just reported the facts to the Department. What is the use of the NIR for a public administration purpose really about? It is about efficient and effective public services, yet Parliament was—how shall I say—not informed as fully as it should have been. If you go back over the years and if you look at, for example, Supergun, Matrix Churchill, the war in Iraq, BAe, what should Parliament be informed of? Those sorts of cases have a problem—it may be trade, it may be national security, it maybe foreign affairs overtones which make it difficult for Ministers to respond. The worry for me is that my evidence on the NIR and public administration is that there is nothing about national security, nothing about foreign affairs; it is about effective public service delivery. There should be no prohibition on releasing information to Parliament. So now we have two extremes. If, for example, it is something like Supergun, one where Parliament is not informed, then essentially, in relation to the NIR uses for public administration, Parliament is not informed—what happens to everything in the middle? That is the question it raises. That is the reason why I say it does raise this particular question. My own view is that Ministers drip-feed information to Parliament when it is appropriate. For example, in that evidence I showed that there was a written statement prepared just after the General Election which was not published for nine months, a written statement saying the NIR would be used for public administration purposes. Before the Bill came before Parliament, the Government knew that 20 per cent of the business case for the identity card relied upon the use of the database for public administration purposes. They knew that the identity card had to be compulsory to get that 20 per cent. I have not found any ministerial statement, apart from the written statement that was produced after the legislation passed through Parliament. This Constitution Committee was worried about the relationship between the state and the individual in relation to the NIR and published two reports. Did it know that the Government were planning to use the identity card database as an information resource? The other fact of course is David Blunkett had produced two public statements, documents of 150 pages each, which assured members of the public that the database was not going to be used for this purpose. There are lots of constitutional issues around this, and what I would like you to do is not see that evidence as knocking the use of the NIR as a public information resource or a population register. I think there are good arguments for it. What you should look at is how Parliament was informed, if Parliament was not informed, how can it scrutinise?

  Q855  Baroness Quin: Just following up the question relating to scrutiny, the evidence in paragraph 17—this is written in May 2007 -talks about "the next Prime Minister has signalled his intention to grant parliament more powers of scrutiny." Presumably, the next Prime Minister was Gordon Brown at that point. Has anything happened, and in what context was that commitment given?

  Dr Pounder: The draft Constitutional Renewal Bill is now being debated. I think the Prime Minister gave a speech where he said that he was looking at the ability to balance the two. That is why I picked up on that speech saying proposals would come forward, which I assume now is the draft Constitutional Renewal Bill.

  Q856  Baroness Quin: Is there anything in there that gives you comfort?

  Dr Pounder: No, not on this particular issue. We are talking about general interference and the ability of the executive to be scrutinised. Parliament has to have the information to allow that scrutiny to occur. That is what I am really worried about. I see nothing that requires Ministers to provide information to Parliament. Yes, they will give assurances; yes, there might be problems in producing certain information, but Parliament has committees that deal with sensitive matters and there are always sensitive data procedures. But the fact that information is, shall we say, withheld from Parliament on something as mundane as public administration I think is shocking, to put it bluntly.

  Q857  Lord Rowlands: On first reading the appendix to your evidence I thought it was a devastating critique. This is over a year old. Has there been a rejoinder? Have they engaged you in argument or debate on your assessment?

  Dr Pounder: No. All I laid out was the evidence. I tried to withhold the comments that I could have made.

  Q858  Lord Rowlands: There has not been a response to this?

  Dr Pounder: There has not been a response. I do not know whether there has been a miscommunication between the civil servants and Ministers but I think the evidence should be seen as, is this how Parliament is treated for every single thing? It is rather as if Parliamentary management and news management are the same thing.

  Q859  Lord Peston: I am still a bit lost on this. Like Lord Rowlands, I was very impressed with the criticisms you offered but, as a long-time supporter of identity cards—and I declare an interest—it seems to me obvious that identity cards, to be of any use, have to be compulsory and the notion of an optional identity care seems to me ridiculous, but equally, I had always assumed that the identity card had both a public sector side to it and a private sector side, because a great deal of a person's life dealing with private sector matters is establishing who they are. Given that, and ignoring totally the fact that people like me thought it was going to be a simple scheme—and it has got so complex that we all know it is going to be a disaster—what troubles me is this business of Ministers, in a sense, misleading Parliament. Is not the purpose of the register perfectly obvious? What is the Government concealing here? I put this to you to raise the difficulty: what do you want the Government to be saying to us, if you like? What information are they withholding from us?

  Dr Pounder: They are not withholding information; they are just revealing it at a time which is very convenient for the scrutiny process. To go back to the Written Statement, it was prepared before the Second Reading of the Identity Card Bill. It could have been issued. Parliament could have debated whether or not the National Identity Register should be used for public administration purposes but that was withheld for some reason.

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2009