Examination of Witnesses (Questions 980-999)
Mr Michael Wills MP and Ms Belinda Crowe
25 JUNE 2008
Q980 Viscount Bledisloe: Yes but
you say it cannot be shared for incompatible purposes.
Mr Wills: The second data protection
principle is that it should be processed for limited purposes
and shall not be processed further in any manner incompatible
with the original purpose.
Q981 Viscount Bledisloe: Incompatible
with, yes.
Mr Wills: I am sorry, I am perhaps missing
your concern here.
Q982 Viscount Bledisloe: If you wanted
to give information about who could afford school meals, now the
reason the person gave you information about their income was
not to do with school meals but it is not incompatible to pass
it on.
Mr Wills: The purpose for which the information
about income that was given to the local authority, for example,
was to receive a benefit.
Q983 Viscount Bledisloe: That clearly
is compatible.
Mr Wills: Yes, that is why it would be
compatible. If it was for any other reason than for a benefit
from the state then it would be incompatible but that is why it
is compatible. If, for example—I am straying into very theoretical
territory which I said I would not do here—we had data on
people's income and it was handed over to the school which decided
it wanted a very middle class selection of pupils for it, then
that would be completely wrong. It would be completely wrong if
a local authority had collected data for the purposes of, say,
council tax benefit and then it handed it over the local education
authority because they had decided that, for reasons that they
thought was good, they wanted to concentrate resources on poor
children and they should all be concentrated in one particular
school, in my view that would be incompatible with the purpose
for which that data was collected.
Q984 Chairman: Could I just ask if
you could confirm the use of the statutory override in schedule
two of the Data Protection Act in the context of what you are
talking about?
Mr Wills: I think I will ask Belinda
to do that; it is a rather technical question and I will defer
to the expert on this.
Ms Crowe: I might need to understand
a bit more as to the context.
Q985 Chairman: The Minister has been
saying that the information can only be used for the purpose for
which it was given but there is in schedule two of the Data Protection
Act a statutory override enabling the information to be used more
widely for other purposes.
Ms Crowe: I think we would need to write
with information about setting out specifically how that might
be used. I do not have that answer at my finger tips.
Q986 Chairman: Perhaps we could have
a written note on that.
Ms Crowe: Yes, of course.
Q987 Lord Peston: Am I, as an individual
person, supposed to know what data the Government collects about
me and has?
Mr Wills: You are not supposed to know
but you can know if you want.
Q988 Lord Peston: In my case I do
not have the faintest idea what data you collect on me. I know
some of us fill out an income tax form each year but it is not
my duty to know.
Mr Wills: No.
Q989 Lord Peston: But I am entitled
to know.
Mr Wills: Of course.
Q990 Lord Peston: Who would I write
to? To you?
Mr Wills: To the organisation you think
might hold it.
Q991 Lord Peston: Yes, but I do not
know. Who would I write to to ask what data the Government has
in total on me?
Mr Wills: How would you go about finding
out all the data that is held about you?
Q992 Lord Peston: Yes, that is the
question I am asking you. It is impossible.
Mr Wills: At the moment it is and it
is impossible for perfectly good reasons, for the reasons we have
just been talking about because data sharing is not universal.
There is not a single database where you can just go to and find
everything the state holds for good and proper reasons. There
is an argument which I think I hear you making and this is something
we will want to look at after Walport/Thomas about giving the
public more confidence. This is absolutely essential and if part
of giving people more confidence is to bring out into the light
the fact that the state does not hold all these murky secrets
and all these bits of information that you have probably forgotten
about yourself but someone somewhere in Whitehall has got it,
then I think that is clearly something we must look at. How we
do that exactly is going to be quite difficult mechanically because
I do not think anyone wants to see gigantic databases where anyone
can go and search. The security implications of that are horrendous.
Again one has to be cautious about how one does this. There are
probably ways in which we can go a long way towards meeting that
kind of requirement; that is one of the key outcomes, we hope,
from the Walport/Thomas review when they have reported which is
about how we balance data sharing and all its advantages with
privacy. That question of public confidence is absolutely central.
If the public have no confidence in the way data is being handled
they will feel much less sanguine about taking the opportunities
of data sharing and society as a whole will be poorer. If they
have confidence because the systems are robust and transparent—which
is also crucial—then of course we can reap the benefits.
Q993 Lord Peston: You are aware that
what I am really asking you about is privacy, but my problem is
that I do not know whether the data on me is accurate. I remember
the first time I went as a student to America 50-odd years ago
and I was asked what I did. I said, "I'm an economist"
and the chap wrote down "He is a communist". I just
managed to catch that he was writing it down when I said it was
not quite the same thing. The real point I would have thought
the ordinary person is worried about is partly data sharing but
if you are also sharing dodgy data then they are even more worried
about it.
Mr Wills: Yes, and you have a right to
correct the data. The crucial point is that you only have the
right to correct it if you know it is wrong.
Q994 Lord Peston: You have to know
it is there.
Mr Wills: You have to know it is there
and you have to know where to go. We are in an imperfect world
in this and that is absolutely right. If we are worried in a specific
area then the remedies exist. If you have access to it then the
remedies exist to correct it. The problem is that not everybody
knows everything that is held and I accept that point. That may
turn out to be crucial to public confidence and I expect it will
play an important part in generating public confidence. There
is a great unease about the spread of people holding data about
you but it produces huge benefits in the private as well as the
public sector and it is not just the public sector we are talking
about here. Your credit references are also very important as
well, but people tend to worry about that and that tends to be
brought to light quite quickly and that culture is changing. There
is a job there and after Mark Walport and Richard Thomas have
reported that is clearly an issue we are going to look at.
Q995 Lord Rowlands: There is a growing
movement towards the application of privacy impact assessments
(PIA) and the Information Commissioner is keen on them as long
as they are not just tick box. Some of us went to the United States
and had a meeting with the Chief Privacy Officer and his team
in the Department of Homeland Security. There is a mandatory requirement
for PIAs in the United States. First of all, what are your thoughts
about the development of PIAs and, secondly, what about the mandatory
requirements?
Mr Wills: We are very keen on it and
every major gateway project in Government will now have a privacy
impact assessment attached to it. We are keen to see them rolled
out; we think they will perform a very valuable function.
Q996 Lord Rowlands: Will these be
in the public domain?
Mr Wills: Yes.
Q997 Lord Rowlands: What about the
mandatory requirement? Do you think we should go further?
Mr Wills: I think in essence we have
said we have now pledged to do this so every major project will
have one.
Q998 Baroness Quin: Will pieces of
legislation have a privacy impact assessment?
Mr Wills: We have not gone as far as
that yet and it will depend I think on the piece of legislation.
There will be legislation which is just not relevant. My own personal
view is that Government should be doing this. Again, we want to
take stock of Walport/Thomas which is looking at precisely this
area but it is quite clear that where the privacy impact assessment
is at a place that we want to be—in other words it highlights
the importance of this and it is crucial to keeping public confidence
in the way that Government holds data—without wishing to
commit precisely to every piece of legislation having it, we are
wholly sympathetic to the purpose of it and depending on exactly
what the Walport/Thomas review says we will be meeting those objectives
in some form or other.
Q999 Lord Rowlands: On the back of
this may I ask a supplementary question and that is that we have
received quite a lot of evidence from a considerable number of
witnesses who expressed the view that the Information Commissioner
is under-funded and indeed also needs further powers. Is the Walport/Thomas
report going to review himself and his resources and power?
Mr Wills: We constantly review his resources
and he is actually funded directly by the data protection fee.
I think when he talks about under-funding he is referring to his
freedom of information work. This is quite a complex issue, I
have to say. We have found, since I have been in this position,
a lot of extra money for him. It has gone up by over ten per cent
this year.
| 
