§ 'If the Registrar is satisfied that any person has required an individual to make a request under section 21 as a condition for entering into any agreement with him or conferring any benefit or advantage on him (hereinafter known as a "wrongful request") the Registrar may serve him with an enforcement notice under section 10 above.—[Mr. Kilroy-Silk.]
§ Brought up, and read the First time.
191§ Mr. Kilroy-SilkI beg to move, That the clause be read a Second time.
§ Mr. Deputy Speaker (Mr. Ernest Armstrong)With this it will be convenient to take new clause 8—Code of Practice—
- `(1) It shall be the duty of the Registrar to make and publish Advisory Codes of Practice for guidance to data users in order to give effect to the Data Protection Principles.
- (2) Before any such Advisory Code is made, the Registrar shall:—
- (a) Consult trade associations or other bodies representing data users.
- (b) Consult bodies representing data subjects.
- (c) Give public notice of any draft Code of Practice by inviting objections and representations.
- (d) Consider any such objections and representations.'.
§ Mr. Kilroy-SilkThe purpose of the clause is to attempt to deal with issues of the sort which apparently arose in Washington in the United States after the enactment of legislation similar to that which we are considering. I am told that employers in that state required of prospective employees that they furnished them with a printout from the local police computer to show that they had no criminal record of convictions. That may seem to be a reasonable request but it is my understanding that the criminal records office of Scotland Yard is concerned, given the experience of the enactment of similar legislation in Washington, that it may be overwhelmed by similar requests.
Parliament has already laid down that an offender's previous convictions shall be expunged from the record under the terms of the Rehabilitation of Offenders Act 1974, which states in part that anyone's offences committed over 10 years ago shall be spent. It is clear that Parliament does not believe that a series of convictions should be held against an individual in the way in which it could be if experience in Washington were to be replicated in Britain.
When we had a brief debate on this issue in Committee the Minister said that he was sympathetic to the purpose behind the Bill. That is to be found in column 468. The hon. and learned Gentleman then adduced arguments against our proposed amendment on the ground that the criminal and civil law were not the appropriate means to deal with the perceived nuisance. In that amendment we suggested that it should be a criminal offence to require of a person that he obtains information about his record from the police or from other organisations. We accepted in Committee that the civil law and the criminal law were probably inappropriate means of dealing with the nuisance. That is why the clause provides that the registrar shall be required to take action.
We are saying that if an employer is requiring prospective employees to furnish him with a printout from the Metropolitan police computer, or from the computers of other police forces, which shows that there is no known criminal record held against that individual, the Registrar should he able to issue an enforcement notice under the terms of the Bill telling that employer to desist from the practice. That seems to me and my right hon. and hon. Friends to be a reasonable and sensible means of dealing with what the Minister regards as a potential nuisance. He has already said that he is sympathetic to that purpose. It would be rather unfortunate if a Bill were enacted that was considered to be of benefit to individuals in protecting 192 their privacy and was found in certain respects to be an invasion of their privacy. The clause seems to provide a fairly easy way of dealing with this potential nuisance.
§ Mr. WaddingtonIn explaining why I cannot recommend the new clause to the House, I do not want to imply that I see no cause for the concern that has been expressed about the potential for third parties to pressurise individuals to exercise the subject access rights that are created by the Bill. However, I cannot accept that any of the solutions so far proposed, including the new clause, provide a satisfactory answer to the problem.
In Committee we debated an amendment which would have made it a criminal offence to make what the new clause calls "a wrongful request". I said then, in effect, that not all such requests could be considered "wrongful", and that it seemed virtually impossible to devise a statutory provision which would distinguish between those which were and those which were not. I remain of that view and I consider that the system proposed in the clause is unworkable. It is based on a misapprehension about the nature of enforcement notices, which are the means used by the Registrar to ensure that the data protection principles are observed by registered persons.
Clause 10(1) states that an enforcement notice must specify the steps to be taken so that whatever data protection principle has been reached may be complied with. The problem is that the making of a "wrongful request" is not a breach of the data protection principles. Indeed, it could not possibly be a breach of the principles because a "wrongful request" can be made by someone who is not even a data user. So an enforcement notice under the new clause could not order its recipient to withdraw his request and not to do it again.
It seems that the only way to remedy the problem would be for a further amendment to be made to clause 10 to provide that an enforcement notice could be served on any person whether or not registered under the Bill requiring him to take such steps as are specified to withdraw the "wrongful request". That would be odd, given the general role of the registrar to regulate and supervise registered users and bureaux, not the general public. It reveals also the fatal flaw in the idea that is expressed by the new clause. Once a request of that kind has been made, it is futile to think of it being withdrawn. The effect would be precisely the same as if the individual data subject simply refused to comply with the request in the first place, which he is already entirely at liberty to do. The device is an ingenious one but it does nothing to solve the problem or to help the data subject.
§ Mr. Kilroy-SilkIf it becomes known that a certain company is consistently and habitually requiring information of the sort to which I have referred from prospective employees—we all regard that practice as unacceptable, including the Minister — is it not reasonable to look for a means of dealing with the nuisance? Is not the most reasonable approach that he or I have found so far to say to the registrar, "You shall have power to tell that company to desist from this practice and that penalties and sanctions will follow from the inability or wilful refusal to comply with the notice?"
§ Mr. WaddingtonIt is clear that the hon. Gentleman has not listened to what I have been saying. What happens if the company that makes the request is not a data user? The purpose of the Bill is to make data users register with 193 the registrar and to give the registrar supervisory powers over the user. If the person who asks a potential employee to get information from the police about his previous record, or lack of record, is not a user, how can we frame the Bill so as to give the registrar, who has no supervisory rights over a person who is not a user, the power to supervise that non-data user and to serve upon him a notice, a power which is available to the registrar only in respect of data users, to make him conform with the data principles?
§ Mr. Kilroy-SilkI accept that difficulty but I understood that we had overcome it in the drafting of the new clause. I accept that the Bill deals with data users and data subjects. It may be possible that the individual making the request is not a user but the new clause states:
If the Registrar is satisfied that any person"—not necessarily a data user or a data subject. Is that not a means of overcoming the difficulty to which the hon. and learned Gentleman has alluded? I ask that question in all humility because I am neither a parliamentary draftsman nor a lawyer.
§ Mr. WaddingtonIt could be a means of doing so but it would be an odd way in which to proceed. If it were adopted, many more amendments would have to made to the Bill than the one which is sought in the new clause. I cannot imagine a more radical alteration to the Bill than the one which has the effect of giving the registrar powers over data users as defined in the Bill and over many others as well. The hon. Gentleman must face the fact that the Bill is concerned with the setting up of a registration system that will be supervised by a registrar. It is about data users being subject to disciplines that are overseen by the registrar. That is why I said earlier that I cannot accept that that is the way in which we should proceed, given the fact that we are dealing with a Data Protection Bill and a registration system.
Even if by some extraordinary mechanism we could give the registrar powers over non-data users as defined in the Bill, we would still be faced with the problem of deciding when the registrar should be able to use his enforcement powers. The hon. Gentleman knows that the Bill's structure depends upon the registrar having power to serve an enforcement notice to demand compliance with the data protection principles. The type of conduct to which reference is made in the new clause is certainly not in breach of those principles.
6 pm
The new clause would mean asking the registrar not only to exercise powers against people who are not data users but to use an enforcement notice for a purpose that differs entirely from the purpose for which the enforcement notice was devised — to make a person conform with the data protection principles.
§ Sir Dudley SmithMy hon. and learned Friend is right. I know, for example, of inquirers who illegally obtain information on car numbers or owners from the police. This power would spread to vast sections of the community.
§ Mr. WaddingtonI am grateful to my hon. Friend. I am not persuaded that we will find a worthwhile definition of a "wrongful request". There are, undoubtedly, 194 circumstances in which a data subject might legitimately want to comply with a request by a potential employer to provide certain information. My case rests not on that point but on the impossibility of dealing with the mischief that, undoubtedly, can sometimes exist with the use of the type of mechanism that has been proposed by the hon. Gentleman. I am not saying that there cannot be a mischief. I am saying merely that we have not yet found a means of coping with it.
§ Mr. MaclennanI have a great deal of sympathy with the motives of the hon. Member for Knowsley, North (Mr. Kilroy-Silk) in the new clause. It adverts to a subject that we debated in Committee.
The Minister, in his concluding remarks, recognised that there is a mischief with which the Bill does not deal. In a sense, it is a new problem arising from the fact that the data subject will now have access to information about himself that he would not necessarily otherwise have had. By empowering him to obtain information about himself, he could be put in the embarrassing position of having information extracted from him that he was reluctant to reveal. He might be subject to pressure to reveal information about which formerly he could have said, with his hand on his heart, "I am sorry; I cannot let you have that information." The new clause is designed to deal with that mischief.
I accept what the Minister has said about the appropriateness of the new clause. It widens the powers of the registrar beyond the scope of his duties. The problems in defining "wrongful request" are real. This should not be the end of the matter. Perhaps the Minister will undertake to consider how best to deal with the problem. If we enact the Bill as it stands, improper pressure may be brought to bear upon a data subject to disclose information that it would be undesirable for him to disclose. The Bill is designed largely to protect the data subject, and clause 21 sets out the new protections provided. I fear that, probably inadvertently, we are exposing the data subject to a danger that did not exist previously.
§ Mr. Kilroy-SilkI do not wish to pursue or press this issue. I am grateful for the support of the Hon. Member for Caithness and Sutherland (Mr. Maclennan). Given the fact that there seems to be unanimity on both sides of the House on the importance of this issue, that we agree that there is a potential problem and that it is difficult to find appropriate solutions, I press the Minister to consider this matter yet again in the hope that he or his officials will come up with a suitable remedy that can be added to the Bill during its passage through the other place. I understand the difficulty with which the Minister is confronted, and I ask him to consider the matter without any commitment. In those circumstances, I should be happy to withdraw the motion.
§ Mr. WaddingtonIt is not realistic, after the trouble to which we have gone to find a solution to this problem, to say that, before the Bill completes its progress through Parliament, we shall try to find yet another form of words to meet the objections put forward by hon. Members. Having recognised that there is a potential mischief, we must keep the operation of the Bill under close supervision. If it turns out that there is an abuse of the type suggested by hon. Members, it may be possible by means other than legislation to cope with it. The hon. Member 195 for Knowsley, North (Mr. Kilroy-Silk) may be thinking about administrative means by which potential employers who abuse the rights given under the Bill would not receive the advantages for which they had hoped.
§ Mr. Kilroy-SilkI am grateful to the Minister for his statement. It is a gracious and important concession. On the clear understanding that there is no specific commitment, I beg to ask leave to withdraw the motion.
§ Motion and clause, by leave, withdrawn.