§ Mr. WaddingtonI beg to move amendment No. 7, in page 9, line 43, leave out from 'user' to end of line 2 on page 10 and insert—
'(a) to rectify or erase the data and any other data held by him and containing an expression of opinion which appears to the Registrar to be based on the inaccurate data; or(b) in the case of such data as are mentioned in subsection (2) of section 22 below, either to take the steps mentioned in paragraph (a) above or to take such steps as are specified in the notice for securing compliance with the requirements specified in that subsection and, if the Registrar thinks fit, for supplementing the data with such statement of the true facts relating to the matters dealt with by the data as the Registrar may approve.'
§ Mr. Deputy Speaker (Mr. Ernest Armstrong)It will be convenient to discuss at the same time Government amendments Nos. 19 and 20.
§ Mr. WaddingtonThis group of amendments deals with the rectification and erasure of inaccurate personal data. This is one of the more intricate parts of the Bill, but, because the amendments improve the rights of data subjects at no great cost to scrupulous data users, no apology is required for bringing them forward.
As the Bill stands, data which the user has received, either from the subject or from a third party, are treated differently from other data in terms of their accuracy. Many data users receive large amounts of data either from the data subject himself or from third parties. Obviously, users have an interest in ensuring that the data which they hold are accurate, but equally obviously they cannot, realistically, be expected to verify every item of information which they receive from someone else; they must take certain things on trust.
For this reason, we have taken the view — a view which, I think the House will agree, is generally reasonable—that users should not be held responsible for the accuracy of such data, provided that they take 223 certain precautions designed to safeguard the interests of the subject. Thus, the Bill in clause 22, says that a user will not be obliged to pay compensation to a data subject who suffers damage as a result of inaccurate "received" data, now will a user be liable to a court order for rectification or erasure of such data provided that he has marked the data to indicate their status and, in effect, to indicate that he is not vouching for their accuracy.
In addition, if the subject has disputed the accuracy of the data, the user must, if he does not accept what the subject tells him, include in the data an indication of the dispute if he wishes to benefit from this special protection. In other words, the user is afforded a certain immunity, but, in return, he must ensure a certain degree of protection for the subject by making sure that anyone else looking at the data knows their true status and will treat them with suitable caution.
All of this is entirely sensible so far as clause 22 and compensation for inaccuracy are concerned. But we have, on reflection, come to the view that it may not be so sensible so far as clause 24 and rectification and erasure are concerned. While I remain convinced that, provided he has taken all the appropriate precautions, a user should not be made to pay for the shortcomings of others and be held liable to pay compensation if "received" data prove to be inaccurate, I confess that the arguments against making him liable to a court order for rectification or erasure do not seem convincing.
Generally speaking, if data can be shown to be inaccurate, most data users will be only too happy to correct them. After all, it is in their interest to do so. But there may be cases where a user, for whatever reason, decides to ignore a data subject who tells him that data which he is holding are inaccurate; perhaps he thinks that the data subject has a good reason for wishing to deceive him. In these cases, as the Bill stands, if the user marks the data properly, there is nothing that the data subject can do to have his claim validated and to have the date rectified or erased.
I accept that that is hard to justify, and I do not believe that data users would be seriously inconvenienced or could reasonably object if a court were to be given power to adjudicate in such cases and to order rectification or erasure of any data which were shown to be inaccurate. Indeed, those data users whom we have consulted share this view. They agree that the situation is not likely to arise often, but that, when it does, there is no good reason why a court should not be able to intervene.
The amendments to clause 24 seek to achieve that result. They provide, in effect, that the powers that the court already has in respect of "unmarked" inaccurate data shall apply equally to "marked" data which are shown to be inaccurate. In other words, the court may order rectification or erasure of marked data or the addition of a corrective statement, whichever appears in the circumstances to be the most appropriate response. I hope that the House will feel this to be a valuable increase in the rights of the individual.
§ Mr. Kilroy-SilkWe welcome these clarifying and drafting amendments. As the Minister will readily accept, one of the most repeated complaints in Committee, and so far in today's proceedings, related to the damage and/or distress that can be caused to individuals by inaccurate or misleading information contained in files about them. We have constantly stressed the need to strengthen the ability 224 of an individual to have access to such information, to be able to challenge it, to obtain compensation for any damage or distress that that information may have occasioned, and to be able to correct, rectify or erase it.
We accept that a data user may be an innocent recipient of information which is misleading, inaccurate or mischievous, and we do not necessarily blame him for that. We accept that many users will accept information in good faith believing it to be accurate. The person. supplying the information may be doing so in the belief that it is accurate. However, we know, too, that on many occasions such belief is unfounded and that the individual. when challenging the information about him, cart demonstrate its inaccuracy.
In those circumstances there is no reason why the data subject, the individual who has been wronged, should not have the opportunity to be able to correct the information or to have it erased. When we debated this issue in Committee, we did not believe it to be a sufficient safeguard that there should be a tag alongside the information stating that the subject had denied its authenticity or accuracy.
The Minister has done what we asked him to do in Committee, and for that we are grateful. We shall support the amendment.
§ Mr. NorrisI add my thanks to those of the hon. Member for Knowsley, North (Mr. Kilroy-Silk) to my hon. and learned Friend. I welcome the amendment so far as it goes. However, we are still a long way short of what many of us regard as an important part of the provisions of a proper data protection Bill, which is an audit trail that would allow someone about whom information had been wrongly collated and/or disseminated to have that data rectified and erased in respect of the original data user. It is obviously highly desirable that we should have amendment No. 7 to facilitate that process. In addition, the subject of the information should have the right to say, "You have got something wrong about me. You put it on a file and in the registration particulars that are with the registrar you have suggested those to whom you will transmit the information. May I know from you to whom you have transmitted the information? Even better, will you please tell those to whom you have disseminated the information that you got it wrong? Will you convey to them the same corrections that you have been required to make by the application of the clause?"
I do not want to speak at length on this issue because we still have a considerable portion of the Bill to discuss. I welcome the amendment but I wish to underline that it does not go the whole way towards providing a satisfactory audit trail. There will be a serious loophole in our ability to provide proper protection for individuals against data banks for as long as that trail does not exist.
8.15 pm
My hon. and learned Friend said in Committee that part of the problem is the technical inability of computer systems to be able to record to 'whom information is being disseminated. The logging principle is extremely expensive and some have told me that it can double the cost of a computer system if provision is made to log to whom one has disseminated pieces of information. Be that as it may, I cannot comprehend why it is possible to transmit the information with such speed and facility while it is not possible to issue equally speedy and efficiently 225 produced corrections to data which have been proved to be inadequate and in respect of which the amendment will apply.
I hope that the Minister will have some words of encouragement. I hope, too, that he and his officials will continue to examine all possible avenues open to them and to those within the computer industry to ensure that, if and when possible, we have a proper audit trail for data subjects, which is a vital requirement of a proper data protection Bill.
§ Mr. WaddingtonMy hon. Friend the Member for Oxford, East (Mr. Norris) has invited me to go down an interesting path but one which is not foreshadowed in the amendment. I shall bear in mind what he has said. We had many debates in Committee on audit trails and logging and I do not think that I would be serving the interests of the House if I were now to re-open them.
§ Amendment agreed to.