§ Mr. WaddingtonI beg to move amendment No. 6, in page 5, line 32, leave out subsection (3) and insert—
'(3) A servant or agent of a person to whom subsection (2) above applies shall, as respects personal data held by that person, be subject to the same restrictions on the use, disclosure or transfer of the data as those to which that person is subject under paragraphs (b), (d) and (e) of that subsection and, as respects personal data to be held by that person, to the same restrictions as those to which he is subject under paragraph (c) of that subsection.'.This amendment was not foreshadowed in our Committee proceedings. Indeed, the point that it addresses was not raised directly. However, even when a point is not directly raised, it sometimes happens that something else 222 that is said triggers off a train of thought. That is what happened here, and that train of thought led to the amendment.
As presently drafted, clause 5(3) makes it clear that a servant or agent of a registered person can be prosecuted for any of the offences listed in subsection (2)(c), (d) and (e). Thus, if he knowingly or recklessly obtains data from a unregistered source, or discloses or transfers data to a person or country not described in the register, he commits an offence.
However, clause 5(2)(b), which says that data must not be held or used other than for a registered purpose, is not covered in this respect. The reason for that is clear so far as the "holding" of data is concerned. As hon. Members will know, "holding" has a precise meaning in terms of the Bill and implies the notion of ultimate control over data. Only a data user can, in terms of the Bill, "hold" data. As a result, only a data user can reasonably be held liable for holding data for an unregistered use of data, and it is clearly possible for the servant or agent of a registered person to use personal data held by that person for an unregistered purpose. That gap in the Bill had to be closed, and we have closed it.
§ Amendment agreed to.