CODE OF PRACTICE ON PRIVACY

HC Deb 04 February 1997 vol 289 cc824-40

'—(1) The Secretary of State shall prepare a Code of Practice on the use and processing of personal data for purposes associated with the provisions of this Act or any enactment amended by this Act.

(2) A copy of any Code of Practice prepared under the provisions of this section shall be laid before Parliament.

(3) Before he lays before Parliament a copy of any Code of Practice prepared under the provisions of this section, it shall be the duty of the Secretary of State to publish a draft of that Code and consider any representations made to him about that draft by—

1. (a) the Data Protection Registrar, and
2. (b) any other person or body,

and he may modify that draft accordingly.

(4) A Code of Practice prepared under the provisions of this section shall not come into effect until it has been approved by resolution of each House of Parliament and issued by the Secretary of State.

(5) The Secretary of State may from time to time revise the whole or any part of a Code of Practice issued under the provisions of this section, and the provisions of subsections (1) to (4) above shall apply to any such revision, with appropriate modifications.

(6) It shall be the duty of the Data Protection Registrar to keep under review compliance with any Code of Practice issued under the provisions of this section, and in pursuance of this duty he shall have power to require the provision of any information necessary to him in the discharge of this duty.

(7) Where the Registrar considers that the provisions of any Code of Practice issued under this section have been breached, then such a breach will be deemed to be a breach of the data protection principle or principles to which that part of the Code relates.

(8) The Secretary of State shall lay before Parliament annually a report on the monitoring of compliance with any Code of Practice issued under the provisions of this section.

(9) In this section, "data protection principles", "Data Protection Registrar", "personal data", "processing" and related expressions have the same meaning as in the Data Protection Act 1984.'—[Mr. McLeish.]

Brought up, and read the First time.

Motion made, and Question proposed, That the clause be read a Second time.—[Mr. McLeish.]

Mrs. Anne Campbell (Cambridge)

It is necessary to provide a clear legal basis for the use and disclosure of information. I remind the House that we are discussing information that has been collected for one purpose but will be used for another. Such data may be supplied by statute to the Inland Revenue or by a person who is claiming benefit. People provide the information voluntarily because they believe that they are entitled to claim benefit.

We have a duty to protect both kinds of information, but we have a particular and pressing duty to safeguard information that must be disclosed according to Government requirements. The Bill proposes to use the information supplied by disclosing it to other Departments and local authorities in order to detect fraud. The Opposition support that objective, but the Bill contains wide powers for data matching activities that may be carried out in two ways: first, by checking an individual's details with other databases—for example, by checking whether an address supplied is valid or income details remain the same—and, secondly, by performing a side-by-side comparison of two or more large databases to detect trends, anomalies and potential duplicates.

It is possible to compile a comprehensive picture of an individual, and to identify likes, purchase habits and credit behaviour. Alternatively, the information may be used to detect similarities and differences between data that are collected for different purposes—for example, someone may be collecting social security and paying income tax. The information may be used both as a commercial tool and as a weapon in the fight against fraud.

With the proposed privatisation of many Department of Social Security functions, many data will end up in the hands of private operators. The two remaining bidders for Project Accord—the centralised computer project in the Department—are American, and one is registered in Liechtenstein. There is no guarantee that work will not be exported to another country to take advantage of cheap wages. The Department of Social Security is accountable to Parliament, but that partner would be far removed from it.

New clause 2 does not contain any proposals that the Government have not already acknowledged. In their Green Paper, "Government direct", the Government state specifically that people want their interests to be protected. The document says: people want to be assured that their interests—such as their reputations, their finances, their entitlements and their prospects in life—are properly safeguarded. Information about them must not be misused, wrongly disclosed, accidentally revealed or fraudulently obtained … New methods of service delivery outlined in this Green paper will be developed in accordance with the requirements of the UK's international data protection obligations. It also promises that the Government will consult the Data Protection Registrar so that the collection, use and disclosure of data can comply with the necessary requirements and meet the necessary standards of protection. It goes on to give an assurance that the commitment to consultation on all those issues will apply equally once the European Community data protection directive is in force.

The Opposition want the Government to do what they have said they want and intend to do in "Government direct". I have quoted the Government's own words—but they are empty promises unless the Government can ensure that public concerns are met. Labour proposes that the Government achieve that aim through the provision of a code of practice to regulate the way in which information is used and disclosed.

Mr. Heald

The problem with new clause 2 is that it applies to only a limited area of government, so we would end up with a piecemeal approach to data protection rather than the seamless provision that everyone wants. Consultations are taking place on the European data protection directive and the "Government.direct" Green Paper. That is surely the proper place to deal with those issues.

Mrs. Campbell

The Minister is correct to say that we shall soon require new legislation to bring the EC data protection directive into force. It will apply only to data that are specifically guarded by EC legislation, and it will not apply across government as a whole. There will be a time lag before that directive is implemented in the United Kingdom, so we shall require some protection in the interim. Our proposal has been suggested by the Data Protection Registrar herself, to protect the interests of individuals in the meantime.

If we consider the possible abuses, it is clear what problems may arise. I am sure that the right hon. Member for Kingston upon Thames (Mr. Lamont) felt angry and betrayed when the details of his unpaid Visa bill were made public. Similarly, members of the royal family were embarrassed and dismayed when it was revealed that a private telephone conversation had been recorded.

It is clear that, when the technology was invented, such activity was not intended to happen. We must guard against the unexpected and the harmful. Intrusion into private lives could become commonplace if regulation is not put in place. The stakes are high. I urge the Government to think twice before being cavalier about privacy.

5 pm

We propose a code of practice, but we do not set out what should be in it. There should be full public consultation, and the Data Protection Registrar's advice should be sought. The code of practice may need to be reviewed regularly, as technologies change rapidly, security requirements differ over time as criminals discover new techniques for defrauding the system, and international treaties may change our obligations. Flexibility is required. The new clause would provide for a code of practice, which should be drawn up after consultation and introduced by regulation.

The Minister referred to the EC data protection directive. We do not yet know what form of domestic legislation will transpose that directive into United Kingdom law. The statutory code that we propose should serve to ensure that decisions that are made on the basis of automated, data-matching exercises are not in breach of article 15, which gives individuals the right not to be subject to an automated individual decision, although there may be exemptions. As a person who has suffered damage as a result of a breach of the data protection principles can claim compensation, it is important that the Secretary of State takes note of that. He should now establish procedures that would avoid that problem.

Our proposal is by no means unusual. In Australia, Canada, New Zealand, the United States and Germany, data matching by government is subjected to independent scrutiny. Individuals who are identified in "hits" as a result of data matching must have a chance to make representations.

I hope that the Minister will accept the new clause, or at least agree to introduce a clause of his own when the Bill goes to the other place. Our proposal follows the advice given to the Secretary of State by the Data Protection Registrar in a letter dated 10 January. If the Minister will not safeguard personal privacy by a code of practice, I hope that he will spell out in his reply precisely what he will do instead.

Mr. Ian Bruce

I shall comment briefly on the excellent provisions in the Bill, and explain why I believe that the new clause, although worthy, should not be accepted.

Hon. Members will have heard me talk about the European informatics market group, which has an unfortunate acronym—it sounds like something completely different unless one listens carefully. That all-party group considers issues such as data protection. It was set up because of an unfortunate EC draft directive that probably would have destroyed the whole of the informatics market in the United Kingdom. The hon. Member for Cambridge (Mrs. Campbell) raises her eyebrows, but she will be pleased to know that the current draft directive, which is doing the rounds in Europe, is more to the United Kingdom's liking and to the liking of the European informatics market group, which has taken sensible advice.

The United Kingdom civil service has almost the most enviable record of any civil service in the world on keeping people's personal data secret and secure. It may not have such an enviable record on keeping the Government's secrets secure—especially when draft information is being sent between Departments—but we should be proud of what the Inland Revenue, the Department of Social Security and housing benefit offices in our town halls have already achieved. The codes of practice they work to are exemplary.

We are considering whether it is right or wrong to allow information that is collected for one purpose to be used in matching to discover whether criminals—I emphasise that—are trying to rip off the system and steal taxpayers' money. No hon. Member who has read the reports of the Social Security Committee can be in any doubt that we should use whatever technology is available to check that we are making best use of public money, and that we are not being ripped off.

The Opposition propose that, instead of having discrete information in discrete Government Departments, we should establish a special code of practice with a special form of policing to cover the exchange of such discrete information between Departments. That is an unnecessary leap.

The Data Protection Registrar has made many proposals. Many aspects of our data protection registration are nonsense. We can prosecute people if they do not register to operate and keep data—if they have not informed the registrar—but once they have registered, there is not a lot that the registrar can do to them. It is important for the registrar to lay down principles. We should not have a bureaucratic system. We should ensure that remedies are available to people who are damaged because data on them have been passed on when they should not have been. We should examine that aspect of the problem.

It is long past time that we had this exchange of information. Many hon. Members will know that I ran an employment agency in Yorkshire for about 12 years. Towards the end of that time, the Department of Social Security found out that a temporary member of staff had more than one job. In fact, that individual had five jobs and was claiming unemployment benefit and social security. The Department knocked on our door and said, "This person has been claiming and has also been working for you." I said that I could provide the necessary details, because we had told the Inland Revenue and the Contributions Agency that that person was working for me. I was amazed that that information had not immediately been passed to the Department of Employment so that it could check the details.

When the investigator asked whether we could give him a list of all the people who had been working for us in the past six months, I said, "No problem," and provided him with a complete list. We found that a third of the people who were registered in our agency were working for us, being paid by us, paying taxes and national insurance—and receiving unemployment benefit.

The first thing that amazed me was the time that it had taken the Department of Social Security to ask us for information. We were only too happy to co-operate: we were taxpayers, and we wanted to ensure that people were "signed off' before coming to work for us. Following the successful outcome of our passing information to the Department, however, I was even more amazed when it did not contact us again.

I strongly believe that data matching should be available to Departments that are trying to establish whether people are ripping off the system. It is very simple; it is a case of churning through data, using high-powered computers, and trying to find a match. Records involving people who are not in any way suspicious are ignored. No person examines the records: certain information is thrown up that looks a little suspicious—perhaps 50 people, all supposedly living at the same address, claiming housing benefit, or perhaps 30 people with different names claiming unemployment benefit in a one-bedroom flat. A large number of people may be found to have the same date of birth, and to be living in the same place. I am sure hon. Members will agree that that is the kind of information that we want to find.

The hon. Member for Cambridge made an impassioned plea for data to be treated properly. She should accept that this country has a good record on ensuring that personal data are kept in an appropriate way. Most people would be amazed to learn that information they give to one Department is not shared with others. Most honest citizens would probably consider sharing entirely normal and natural; it is because the crooks know that it is not that they have been getting away with murder for years.

I oppose the new clause.

Mr. Chris Davies

I do not believe that any hon. Member can wish to do other than end benefit fraud. Money should, of course, reach those who are most in need, and not be siphoned off by people who are out for private gain, and defraud taxpayers and other claimants for their personal advantage. People should not, however, be able to take advantage of the bureaucratic obstacles that may exist now in order to play one Department off against another. We support the widening of powers to ensure that data can be cross-referenced to enable crooks and fraudsters to be caught out.

As long as the powers in the Bill are used as they are intended to be used, there will be no problem. The question is, how do we ensure that that happens? How do we prevent civil servants with access to information from going on fishing expeditions to find out—for reasons of curiosity, devilment or desire for personal gain—the private details of other citizens? The details may be those of a personal acquaintance: a neighbour, perhaps, or an ex-wife's new partner.

One thing is certain. The House cannot rely on the good behaviour of every civil servant; that is expecting too much of human nature. As sure as eggs is eggs, there will be cases of abuse.

I listened with interest to the comments of the hon. Member for South Dorset (Mr. Bruce). He spoke of the specific information that would be available, giving us to believe that it would be possible to gain access only to that information; but a National Audit Commission report published in March 1995 noted 655 reported incidents of computer hacking among civil servants—staff who were exceeding their authority by using passwords to obtain information about members of the public which they intended to disclose, or did disclose, to outsiders. That happened two years ago.

Mr. Bruce

It is interesting that the hon. Gentleman should raise the subject of computer hacking. Does he accept that someone who opens a filing cabinet and examines a piece of information in that cabinet can get away with it very easily, but that someone who hacks into a computer leaves an audit trail? Many people say that a computer is less secure than a filing cabinet, but I would contend that it is much more secure.

Mr. Davies

The hon. Gentleman misses the point. He may be correct in saying that it is possible for computer hacking to be detected—if, that is, someone is aware that it is taking place, and bothers to go and check. There is clearly a huge difference between access to one filing cabinet in one Department and the ability to touch a computer keyboard and gain access to a full range of Government information on the screen. The technology that is now at our disposal, and the sheer amount of information on private citizens that is stored in Government offices, create an opportunity for the fostering of Orwellian conditions.

As Liberty has pointed out in the past few days, there is a danger that human rights may be violated if the Bill is passed in its present form. The House must remember that it has an obligation not only to protect taxpayers from fraud, but to protect and safeguard the liberties of all individuals, along with their privacy. It must give them the right to ensure that that privacy is not invaded without specific and lawful reason.

5.15 pm

In an intervention, the Minister said that powers would shortly be introduced to ensure that access to information was properly controlled, but I, for one, do not feel happy about supporting proposals now on the assumption—only the assumption—that safeguards will be introduced later. In the past few weeks, the official Opposition's approach to the Police Bill has demonstrated all too clearly that they do not share the approach of Liberal Democrats and, I believe, Liberty to the defence of civil liberties. That does not make us feel confident that the safeguards mentioned by the Minister are likely to be introduced if the official Opposition become a Government later this year.

None the less, I support the proposals for a code of practice, which go some way towards meeting my concerns. I ask hon. Members to remember that we have a duty to set standards that are, in this respect, at least as tough as those applying in other democracies, and that we should not forsake that duty.

Mr. Alan Howarth

In contemplating the Bill, we face a dilemma. We are all committed to introducing measures and powers to prevent and expose fraud, but, equally, we should all be committed to safeguarding civil rights, and, in particular, the right to privacy that is enshrined in article 8 of the European convention on human rights. We must strike a balance. That involves a difficult judgment, but I believe that the introduction of the code of practice proposed in new clause 2 would help us to strike the right balance. At present, such a balance is grievously lacking.

Last week, I asked the Secretary of State a question about this matter, and his response was not discouraging. I hope that the Minister will be able to tell us today that it is indeed the Government's intention to introduce a code of practice—but we must wait and see what he says.

In the meantime, hon. Members are doubtless aware of the legal opinion with which Liberty was provided by Mr. Richard Drabble QC and Dinah Rose, who clearly consider that the Bill fails to constrain powers within the exceptions that are set out in the second paragraph of article 8 of the European convention—the exceptional circumstances in which intrusion into privacy can be justified. They doubt whether the powers that would be exercised under the Bill could be regarded as being in accordance with the law; in the sense that the Bill creates such large discretion, and omits so comprehensively to provide safeguards, that it would not be possible for the citizen to regulate his conduct with sufficient precision—to use the terminology of legal opinion. They question whether the Bill, and the actions that could be taken under it, would be proportionate.

Of course there is a pressing social need to address the problem of fraud, but it remains at the very least highly doubtful that such far-ranging powers should be taken and exercised by the Government and their agencies, invading the privacy of the individual citizen through data matching. The opinion's authors deplore the absence of an effective remedy, to which the citizen should be entitled under article 13 of the convention when there is abuse of his privacy. They say that, before someone's personal records are divulged to others, there should at least be grounds for suspicion or, at any rate, inaccuracies and inconsistencies should already have been demonstrated. Of course, the Government will contend that, until they have the data matching powers, it will not be possible to demonstrate the inaccuracies and the inconsistencies, as is necessary in the effort to deal with fraud, so we are clearly faced with a conundrum.

What the House cannot be in doubt about is that the Bill provides for a large extension of state powers. It amends section 122 of the Social Security Administration Act 1992 so that the Inland Revenue, Customs and Excise and other Departments may pass on information to the Secretary of State. He may pass on information to local authorities and their contractors, who may pass it on to each other—not to mention access to the Royal Mail's database for redirection of mail. We are therefore talking of a vast increase in the scope for data matching and of the use of extended powers not just for purposes of prevention, detection, investigation and prosecution of fraud, but to enable greater accuracy to be achieved in records.

Then there is the catch-all phrase: any other matter relating to social security". The Department of Social Security already has powers to obtain information from other Departments when it investigates fraud, but, if the Bill is passed in its present form, the Department will have powers to embark on wholesale trawling of increasingly large databases. As my hon. Friend the Member for Cambridge (Mrs. Campbell) said, that must at least be contrary to the 1981 European convention on data processing, which stipulates that data compiled for one purpose should not be used for another.

Safeguards need to be introduced. We need legislation to incorporate the new European data protection directive. We also need privacy legislation. We should incorporate the European convention on human rights into our domestic law and, following satisfactory public debate, introduce a Bill of Rights in Britain.

In response to my intervention, the Minister said that the Bill was not needed to legitimise existing data matching, but I understand that, since April 1995, the Department has cross-checked certain benefit payments, looking for inconsistencies and multiple claims. The London fraud initiative is already under way. Existing legal powers must be being stretched to their ultimate, if not being overstepped. We should be careful and sensitive about civil liberties. The Police Bill has been mentioned, and I think that we are all conscious of this issue's delicacy.

There was a story in the press recently—I think last Sunday—about benefit spies joining police road checks. It said that fraud investigators and the Benefits Agency were interrogating people who were stopped by police in routine roadside checks and that, last year, up to 10,000 vehicles were checked. Benefits Agency staff were alongside the police as they did that.

Liberty reports that some people who were questioned were not told of their right to stay silent. That must worry us all. There is always the temptation for big government and officialdom to step beyond where they should go in the exercise of their powers, using excessive zeal, and jeopardising civil liberties. That is why it is particularly important for the code of practice to be incorporated into the Bill.

Mr. Bruce

The hon. Gentleman seems to be supporting the Bill but saying things that would preclude its being passed. May I give him an example? The original data protection directive said to people who wanted to mail a person information that was unrelated to the fact that they had the person's name and address from another source that they first had to mail the person and say, "Am I allowed to mail you something?" but, by doing that, they would have broken the law in the first place. That is the way we can go if we take it absolutely at face value that no one is allowed to cross-check information that is given to the Government.

Mr. Howarth

I think that the hon. Gentleman misunderstands me. I am not suggesting that there should not be data matching. I argue that data matching should be circumscribed by powers that enable the citizen to be protected. Limitations on data matching should be set out in a code of practice, which can evolve over time to match best practice internationally, and match agreements that we enter into. We would have flexibility within what I hope would be an absolutely resolute desire to strike the balance that we need between the civil rights of the individual citizen, particularly the citizen's right to privacy, and the Government's obvious duty to do what they can to stamp out fraud. I am arguing not for an absolute in one direction or the other, but for maximum care.

I hope that, in the exercise of whatever powers the Government take through the Bill, they will always be anxious to do what they can to minimise intrusion into privacy by using, for example, privacy enhancing technology such as encryption and "pseudonymisation", ensuring that names of individuals about whom data may be revealed are known to the minimum number of officials and only in circumstances when that can be absolutely justified.

In Committee, I quoted from DSS research report No. 56 on "Confidentiality: the public view"—the Department-commissioned report by Mr. Alan Hedges. Its findings should warn Ministers that public opinion is sensitive in this matter, and they must be extremely careful in deciding what powers to take—and certainly in the exercise of those powers.

My hon. Friend the Member for Cambridge described how legislative practice in other countries has moved well ahead of ours. By the autumn of next year, we shall have to legislate to incorporate into our law the new European directive. That will inevitably provide a new legislative context for the Bill's operation, but, as we do not have that safeguard in place, it is all the more important, as she has said, that the code of practice should be incorporated.

Mr. Harry Cohen (Leyton)

I support the new clause, which provides for a code of practice on privacy. First, it does not adversely impact on data matching for anti-fraud activity. All it does is ensure that such activities comply with a code of practice that is approved by the Data Protection Registrar.

I tabled a parliamentary question on the Bill to the Under-Secretary of State for Social Security. His answer stated: The registrar wrote to my right hon. Friend, the Secretary of State, on 10 January about the scope of the disclosure of information powers contained in the Bill, advocating the introduction of a statutory code of practice for DSS datamatching activities."—[Official Report, 27 January 1997; Vol. 289, c. 108.] Therefore, the registrar clearly supports the new clause's purpose.

Liberty's opinion has already been quoted to the House. Its press release, published on 31 January, said: Liberty today published a legal opinion from two leading lawyers, one of whom is a Queen's Counsel, which states that the "Datamatching" provisions of the fraud Bill breach the right to privacy contained in the European Convention on Human Rights. Liberty stated: The opinion is by Richard Drabble QC and Dinah Rose who are experts in social security and the law of the European Convention on Human Rights and advise the government on such matters. A code of practice would help to prevent Ministers from breaching our international obligations under recommendation R(86)1 of the Council of Europe convention. Although the United Kingdom has opted out of the provisions of paragraphs 1.2, 3.3 and 5 of the recommendation, it has not derogated from paragraph 4.3, which states: Personal data should not be communicated outside the framework of social security for other than social security purposes except with the informed consent of the person concerned or in accordance with other guarantees laid down by domestic law. The importance of paragraph 4.3 is that, if other uses occur, guarantees must be laid down in domestic law.

5.30 pm

Clause 1 replaces section 122 of the Social Security Administration Act 1992, and clause 1(4) shows that personal data can be lawfully supplied to other organisations. There is no statutory guarantee offering the protection that the recommendation proposes. A code of practice would supply such a guarantee.

My second reason for supporting a code of practice is that the legislation has the potential to negate most of the Data Protection Act 1988. As the House knows, that has eight principles, and the Bill could negate all of them. I shall refer to a couple of those. The first principle states: The information to be contained in personal data shall be obtained and personal data shall be processed, fairly and lawfully. Clause 1(4) makes lawful certain disclosures of detail from the Inland Revenue to the Department of Social Security and vice versa. Later clauses legalise disclosures to local authorities and vice versa. The Data Protection Registrar has no remit under the lawfulness arm of the first principle, as any processing with respect to the exchange of personal data is made lawful by the Bill. Similarly, the fairness arm of the principle, which requires a data subject to be notified of any non-obvious use and disclosure, is also negated. The new law, as represented by the Bill, overrides it.

If the use or disclosure of personal data is required by law, it can be used or disclosed "in any event". The "fairly obtained or processed" provision is overridden, which means that any use or disclosure under the legislation can lawfully be kept secret and data subjects need not be informed of it. The fourth principle states: Personal data held for any purpose or purposes shall be adequate, relevant and not excessive in relation to that purpose or those purposes. As I said in Committee, any hon. Member who loses his job after the election—many Conservatives will lose theirs—and makes a social security claim can be data-matched for ever under the Bill. That is an excessive provision. As my hon. Friend the Member for Stratford-on-Avon (Mr. Howarth) said, clause 1 legitimises the disclosure of personal data, not just about offences relating to social security but for use in checking the accuracy of information relating to benefits, contributions or national insurance numbers or to any other matter relating to social security and (where appropriate) amending or supplementing such information. That is a broad provision, and it makes a mockery of the principle that data should not be used excessively.

The Government have the potential to negate all the data protection principles. In almost all other fields, if the Data Protection Registrar wishes to enforce compliance with the data protection principles, she serves an enforcement notice on data users in the knowledge that failure to comply with it is a criminal offence. However, under section 38(2) of the Data Protection Act, a Government Department cannot be prosecuted. If Departments cannot be prosecuted, enforcement notices cannot be enforced, and serving them is irrelevant. As a result, the Data Protection Registrar is impotent in terms of enforcing the principles.

That is a worst case scenario, but, as we are dealing with fundamental privacy matters, we need to give the registrar an effective role in correcting abuses. There should be a statutory code of practice which brings in the registrar, and it should relate to the data protection principles and privacy considerations. If the DSS decides to act in an underhand way, the registrar could make her views known to Parliament, and it could take account of her warnings. Such a code of practice should hold no fears for the DSS. However, we cannot leave the potential for gross neglect of the data protection principles by the DSS to chance, thereby trampling on the privacy rights of individuals. A statutory code of practice on privacy is necessary.

Mr. Heald

My hon. Friend the Member for South Dorset (Mr. Bruce) made an excellent point when he said that this country should be proud of the way in which the security of personal data has been protected for many years by Government Departments.

There are stringent rules governing the way in which the Department records and uses such information. It is available only to officials on a "need-to-know" basis. There are random management checks to ensure that access has been properly authorised, and there is also audit trail analysis. Officials are conscious of the need to hold and process data securely, not least because, each time an official logs on to the system, he is reminded of the fact that every access must be authorised and that unauthorised use is a serious disciplinary offence. Some staff in the Department have been disciplined and some have been dismissed within the past year for breaches of the rules. However, there have been very few breaches, because there have been few instances of officials and staff not following the rules that we have laid down.

All computer processing is registered under the Data Protection Act 1988, and officials are in regular contact with the Data Protection Registrar. Any unlawful disclosure of information is an offence and, occasionally, prosecutions are pursued. The Department's record on handling personal data by computer is exemplary in terms of security, confidentiality and conformity with data protection principles and other requirements of the Act.

As the hon. Member for Stratford-on-Avon (Mr. Howarth) said, since July 1995 we have been data matching between different computer systems. That has been carried out by a small team of highly skilled officials working in secure conditions on a single site. Detailed criteria are set, any matched data must be relevant to the benefit, and discrepancy is investigated only where it raises a suspicion of fraud. In the Office of the Data Protection Registrar, the registrar is aware of that service and of the action that is taken to protect data.

The same rigorous principles of confidentiality and security will be applied to the Bill: only relevant data will be supplied by the Inland Revenue and Customs and Excise, and about emigration, immigration, nationality and prisoners; it will be held in secure conditions by a small number of specially appointed officials; and data that are consistent with data we already hold will not need to be further disclosed within the Department. Moreover, the Department's use of that data will be registered in accordance with the Data Protection Act 1988, and—once they come into force—with the requirements of the European Union data protection directive.

Like all other data users, local authorities are bound by the requirements of the Act and other legislative requirements to ensure confidentiality and proper handling of data. They, too, have a good compliance record. The Office of the Data Protection Registrar has produced guidance for local authorities—which is endorsed by both the DSS and local authority associations and issued to all local authorities—and it will be updated once the Bill receives Royal Assent.

As drafted, new clause 2 presents the House with a very wide proposal. It would apply to all current processing performed by the Department of Social Security and range across other Departments—not only the DSS—and it would be unsystematic. It would also extend the operation of the Data Protection Act 1988. Any breach of a code of practice would be deemed to be a breach of the data protection principles, even if it were not. Moreover, the Data Protection Registrar's role would be greatly expanded, and she would have to review compliance with the code of practice. That would be unnecessary because, as I have explained, our policy is to co-operate with her. I think that she would agree with that. Her annual reports and those of her predecessors show that it is not the DSS but other data users that cause concern.

Hon. Members may believe that the Data Protection Registrar should have a right to obtain information from any data user, but that is a general issue to which, no doubt, the House will return when it considers the Government's proposals for the implementation of the EU data protection directive.

Mr. Alan Howarth

Will the Minister give way on that point?

Mr. Heald

I think that I am about to deal with the point that the hon. Gentleman wishes to make. Perhaps I can go on, and we can then discover whether his question has been answered.

Other concerns are specific to the new powers introduced by the Bill. We are in touch with the Data Protection Registrar on the use of personal data within the Department, and she has suggested to us some ideas on additional safeguards which could apply to data matching. Although the Government are unconvinced at the moment by the case for a code of practice—as it would not add any practical measures to safeguard personal data, and risks blurring the clear provisions of the Data Protection Act 1988 and the Secretary of State's accountability to the House for compliance with it—the Government will consider further the points made by hon. Members in this debate and, if she wishes, discuss them further with the Data Protection Registrar; that offer has been made.

I do not doubt that similar concerns will be raised when the Bill is considered in another place, and there will undoubtedly be further opportunities for debate then. The Government are unconvinced of the case for a code of practice, but will reflect on the points made in this debate.

I should also mention the point on Liberty's opinion. In framing the Bill, it was of course vital that the proposals complied with the provisions of the European convention on human rights. The issue would be tested only in the context of an individual case being pursued. However, when we were developing the proposals, we considered all the issues of lawfulness and prescribed the law in a very tight and careful manner. We believe that there is no question of there being any breach of our obligations.

I realise that hon. Members are as concerned as we are to protect the interests of individuals, and I can assure them that the Bill's provisions are not the thin end of any wedge.

The powers we propose have been framed to allow relevant information to be provided by other Departments to the DSS, and the purposes for doing so have been explained clearly in the Bill. There is no question of curious civil servants being able to trawl through information to investigate friends and neighbours. There are very tight procedures for such activity, and clear measures for discipline and prosecution are available, should it occur. I do not think that it is necessary for me to say more on that issue, unless the hon. Member for Stratford-on-Avon would like to pursue it.

Mr. Howarth

I am grateful to the Minister.

Many administrative functions have of course now been contracted out to private sector organisations. I am not sure how confident he can be that the very strict rules, informal code and ethics—which he rightly says he insists on in the Department—will be observed by private sector agencies. As matters now stand, the Data Protection Registrar does not have a power to audit; she can only respond to complaints. Does the Minister really consider that sufficient, considering the scale of the operation?

Mr. Heald

I think that the package of current safeguards, which I have outlined, are adequate. The hon. Gentleman mentioned the Hedges report. It is worth remembering that one of its key findings was that the public want information to be sufficiently available for the efficient conduct of their own affairs, and for confidentiality not to act as a shield for serious wrongdoing. That is also the Government's view. Having outlined the Government's case on new clause 2, I hope that the hon. Member for Fife, Central (Mr. McLeish) will be prepared to withdraw the motion.

Question put, That the clause be read a Second time:—

The House divided: Ayes 258, Noes 300.

Division No. 65]	[5.45 pm
AYES
Adams, Mrs Irene	Boateng, Paul
Ainger, Nick	Bradley, Keith
Ainsworth, Robert (Cov'try NE)	Bray, Dr Jeremy
Allen, Graham	Brown, Gordon (Dunfermline E)
Anderson, Donald (Swansea E)	Brown, Nicholas (Newcastle E)
Anderson, Ms Janet (Ros'dale)	Bruce, Malcolm (Gordon)
Armstrong, Ms Hilary	Burden, Richard
Ashdown, Paddy	Byers, Stephen
Ashton, Joseph	Caborn, Richard
Austin-Walker, John	Callaghan, Jim
Banks, Tony (Newham NW)	Campbell, Mrs Anne (C'bridge)
Barnes, Harry	Campbell, Menzies (Fife NE)
Barron, Kevin	Campbell, Ronnie (Blyth V)
Battle, John	Campbell-Savours, D N
Bayley, Hugh	Canavan, Dennis
Beckett, Mrs Margaret	Cann, Jamie
Beggs, Roy	Chisholm, Malcolm
Beith, A J	Clapham, Michael
Bell, Stuart	Clarke, Tom (Monklands W)
Benn, Tony	Clelland, David
Bennett, Andrew F	Clwyd, Mrs Ann
Bermingham, Gerald	Coffey, Ms Ann
Berry, Roger	Cohen, Harry
Betts, Clive	Cook, Frank (Stockton N)
Blunkett, David	Cook, Robin (Livingston)

Corbett, Robin	Janner, Greville
Corston, Ms Jean	Jenkins, Brian D (SE Staffs)
Cousins, Jim	Jones, Barry (Alyn & D'side)
Cox, Tom	Jones, Ieuan Wyn (Ynys Môn)
Cummings, John	Jones, Jon Owen (Cardiff C)
Cunliffe, Lawrence	Jones, Dr L (B'ham Selly Oak)
Cunningham, Jim (Cov'try SE)	Jones, Martyn (Clwyd SW)
Cunningham, Dr John	Jones, Nigel (Cheltenham)
Dafis, Cynog	Jowell, Ms Tessa
Dalyell, Tam	Kennedy, Charles (Ross C & S)
Darling, Alistair	Kennedy, Mrs Jane (Broadgreen)
Davidson, Ian	Khabra, Piara S
Davies, Bryan (Oldham C)	Kilfoyle, Peter
Davies, Chris (Littleborough)	Kirkwood, Archy
Davies, Denzil (Llanelli)	Lestor, Miss Joan (Eccles)
Davis, Terry (B'ham Hodge H)	Lewis, Terry
Denham, John	Liddell, Mrs Helen
Dewar, Donald	Litherland, Robert
Dixon, Don	Livingstone, Ken
Donohoe, Brian H	Lloyd, Tony (Stretf'd)
Dunwoody, Mrs Gwyneth	Llwyd, Elfyn
Eagle, Ms Angela	Loyden, Eddie
Eastham, Ken	McAllion, John
Ennis, Jeff	McAvoy, Thomas
Etherington, Bill	Macdonald, Calum
Evans, John (St Helens N)	McFall, John
Ewing, Mrs Margaret	McKelvey, William
Faulds, Andrew	Mackinlay, Andrew
Field, Frank (Birkenhead)	McLeish, Henry
Fisher, Mark	McNamara, Kevin
Flynn, Paul	MacShane, Denis
Forsythe, Clifford (S Antrim)	Madden, Max
Foster, Don (Bath)	Maddock, Mrs Diana
Foulkes, George	Mahon, Mrs Alice
Fraser, John	Mandelson, Peter
Fyfe, Mrs Maria	Marshall, David (Shettleston)
Galbraith, Sam	Marshall, Jim (Leicester S)
Galloway, George	Martin, Michael J (Springburn)
Gapes, Mike	Martlew, Eric
Garrett, John	Maxton, John
George, Bruce	Meacher, Michael
Gerrard, Neil	Meale, Alan
Gilbert, Dr John	Michael, Alun
Godman, Dr Norman A	Michie, Bill (Shef'ld Heeley)
Golding, Mrs Llin	Milburn, Alan
Gordon, Ms Mildred	Miller, Andrew
Graham, Thomas	Mitchell, Austin (Gt Grimsby)
Griffiths, Nigel (Edinburgh S)	Moonie, Dr Lewis
Griffiths, Win (Bridgend)	Morgan, Rhodri
Grocott, Bruce	Morley, Elliot
Gunnell, John	Morris, Ms Estelle (B'ham Yardley)
Hain, Peter	Morris, John (Aberavon)
Hardy, Peter	Mowlam, Ms Marjorie
Harman, Ms Harriet	Mudie, George
Henderson, Doug	Mullin, Chris
Heppell, John	Murphy, Paul
Hill, Keith (Streatham)	Oakes, Gordon
Hinchliffe, David	O'Brien, Mike (N Warks)
Hodge, Ms Margaret	O'Brien, William (Normanton)
Hogg, Norman (Cumbernauld)	O'Hara, Edward
Home Robertson, John	Olner, Bill
Hood, Jimmy	O'Neill, Martin
Hoon, Geoffrey	Orme, Stanley
Howarth, Alan (Stratf'd-on-A)	Pearson, Ian
Howarth, George (Knowsley N)	Pendry, Tom
Howells, Dr Kim	Pickthall, Colin
Hoyle, Doug	Pike, Peter L
Hughes, Kevin (Doncaster N)	Pope, Greg
Hughes, Robert (Ab'd'n N)	Powell, Sir Raymond (Ogmore)
Hughes, Roy (Newport E)	Prentice, Gordon (Pendle)
Hughes, Simon (Southwark)	Prescott, John
Hutton, John	Primarolo, Ms Dawn
Illsley, Eric	Purchase, Ken
Ingram, Adam	Quin, Ms Joyce
Jackson, Ms Glenda (Hampst'd)	Radice, Giles
Jamieson, David	Randall, Stuart

Raynsford, Nick	Straw, Jack
Reid, Dr John	Sutcliffe, Gerry
Rendel, David	Taylor, Matthew (Truro)
Robertson, George (Hamilton)	Thompson, Jack (Wansbeck)
Robinson, Geoffrey (Cov'try NW)	Thurnham, Peter
Roche, Mrs Barbara	Timms, Stephen
Rogers, Allan	Tipping, Paddy
Rooker, Jeff	Touhig, Don
Rooney, Terry	Trickett Jon
Ross, Ernie (Dundee W)	Trimble, David
Rowlands, Ted	Turner, Dennis
Ruddock, Ms Joan	Tyler, Paul
Sedgemore, Brian	Vaz, Keith
Sheerman, Barry	Walker, Sir Harold
Sheldon, Robert	Wallace, James
Shore, Peter	Walley, Ms Joan
Short, Clare	Wardell, Gareth (Gower)
Simpson, Alan	Wareing, Robert N
Skinner, Dennis	Watson, Mike
Smith, Andrew (Oxford E)	Wigley, Dafydd
Smith, Chris (Islington S)	Williams, Alan (Swansea W)
Smith, Llew (Blaenau Gwent)	Williams, Alan W (Carmarthen)
Snape, Peter	Winnick, David
Soley, Clive	Wise, Mrs Audrey
Spearing, Nigel	Wray, Jimmy
Spellar, John	Wright, Dr Tony
Squire, Ms R (Dunfermline W)
Steel, Sir David	Tellers for the Ayes:
Steinberg, Gerry	Mr. Joe Benton and
Stevenson, George	Mr. Eric Clarke.

NOES
Ainsworth, Peter (E Surrey)	Carrington, Matthew
Aitken, Jonathan	Carttiss, Michael
Alexander, Richard	Cash, William
Alison, Michael (Selby)	Channon, Paul
Allason, Rupert (Torbay)	Chapman, Sir Sydney
Amess, David	Clappison, James
Arbuthnot, James	Clark, Dr Michael (Rochf'd)
Arnold, Jacques (Gravesham)	Clarke, Kenneth (Rushcliffe)
Ashby, David	Clifton-Brown, Geoffrey
Atkinson, David (Bour'mth E)	Colvin, Michael
Atkinson, Peter (Hexham)	Congdon, David
Baker, Kenneth (Mole V)	Conway, Derek
Baldry, Tony	Coombs, Anthony (Wyre F)
Banks, Matthew (Southport)	Coombs, Simon (Swindon)
Banks, Robert (Harrogate)	Cope, Sir John
Bates, Michael	Cormack, Sir Patrick
Batiste, Spencer	Couchman, James
Bellingham, Henry	Cran, James
Bendall, Vivian	Currie, Mrs Edwina
Beresford, Sir Paul	Curry, David
Biffen, John	Davies, Quentin (Stamf'd)
Body, Sir Richard	Davis, David (Boothferry)
Bonsor, Sir Nicholas	Day, Stephen
Booth, Hartley	Deva, Nirj Joseph
Boswell, Tim	Devlin, Tim
Bottomley, Peter (Eltham)	Dicks, Terry
Bottomley, Mrs Virginia	Dorrell, Stephen
Bowden, Sir Andrew	Douglas-Hamilton, Lord James
Bowis, John	Dover, Den
Boyson, Sir Rhodes	Duncan, Alan
Brandreth, Gyles	Duncan Smith, Iain
Brazier, Julian	Dunn, Bob
Bright, Sir Graham	Durant, Sir Anthony
Brooke, Peter	Dykes, Hugh
Brown, Michael (Brigg Cl'thorpes)	Eggar, Tim
Browning, Mrs Angela	Elletson, Harold
Bruce, Ian (S Dorset)	Emery, Sir Peter
Budgen, Nicholas	Evans, David (Welwyn Hatf'ld)
Burns, Simon	Evans, Jonathan (Brecon)
Burt, Alistair	Evans, Nigel (Ribble V)
Butler, Peter	Evans, Roger (Monmouth)
Butterfill, John	Evennett, David
Carlisle, John (Luton N)	Faber, David
Carlisle, Sir Kenneth (Linc'n)	Fabricant, Michael

Fenner, Dame Peggy	Lait, Mrs Jacqui
Field, Barry (Isle of Wight)	Lamont, Norman
Fishburn, Dudley	Lang, Ian
Forman, Nigel	Lawrence, Sir Ivan
Forsyth, Michael (Stirling)	Legg, Barry
Forth, Eric	Leigh, Edward
Fowler, Sir Norman	Lennox-Boyd, Sir Mark
Fox, Dr Liam (Woodspring)	Lester, Sir Jim (Broxtowe)
Fox, Sir Marcus (Shipley)	Lidington, David
Freeman, Roger	Lilley, Peter
French, Douglas	Lloyd, Sir Peter (Fareham)
Fry, Sir Peter	Lord, Michael
Gale, Roger	Luff, Peter
Gallie, Phil	Lyell, Sir Nicholas
Gardiner, Sir George	MacGregor, John
Garel-Jones, Tristan	MacKay, Andrew
Garnier, Edward	Maclean, David
Gill, Christopher	McLoughlin, Patrick
Gillan, Mrs Cheryl	Madel, Sir David
Goodlad, Alastair	Maitland, Lady Olga
Goodson-Wickes, Dr Charles	Malone, Gerald
Gorman, Mrs Teresa	Marland, Paul
Gorst, Sir John	Marlow, Tony
Grant, Sir Anthony (SW Cambs)	Marshall, John (Hendon S)
Greenway, Harry (Ealing N)	Marshall, Sir Michael (Arundel)
Greenway, John (Ryedale)	Martin, David (Portsmouth S)
Griffiths, Peter (Portsmouth N)	Mates, Michael
Grylls, Sir Michael	Mellor, David
Gummer, John	Merchant, Piers
Hague, William	Mitchell, Andrew (Gedling)
Hamilton, Sir Archibald	Mitchell, Sir David (NW Hants)
Hamilton, Neil (Tatton)	Moate, Sir Roger
Hampson, Dr Keith	Monro, Sir Hector
Hanley, Jeremy	Montgomery, Sir Fergus
Hannam, Sir John	Needham, Richard
Hargreaves, Andrew	Nelson, Anthony
Harris, David	Neubert, Sir Michael
Haselhurst, Sir Alan	Newton, Tony
Hawkins, Nick	Nicholls, Patrick
Hawksley, Warren	Nicholson, David (Taunton)
Hayes, Jerry	Norris, Steve
Heald, Oliver	Onslow, Sir Cranley
Heath, Sir Edward	Oppenheim, Phillip
Heathcoat-Amory, David	Ottaway, Richard
Hendry, Charles	Page, Richard
Hicks, Sir Robert	Paice, James
Higgins, Sir Terence	Patnick, Sir Irvine
Hogg, Douglas (Grantham)	Patten, John
Horam, John	Pattie, Sir Geoffrey
Hordern, Sir Peter	Pawsey, James
Howard, Michael	Peacock, Mrs Elizabeth
Howell, David (Guildf'd)	Pickles, Eric
Howell, Sir Ralph (N Norfolk)	Porter, David
Hughes, Robert G (Harrow W)	Portillo, Michael
Hunt, David (Wirral W)	Powell, William (Corby)
Hunt, Sir John (Ravensb'ne)	Rathbone, Tim
Hunter, Andrew	Redwood, John
Hurd, Douglas	Renton, Tim
Jack, Michael	Richards, Rod
Jackson, Robert (Wantage)	Riddick, Graham
Jenkin, Bernard (Colchester N)	Rifkind, Malcolm
Jessel, Toby	Robathan, Andrew
Johnson Smith, Sir Geoffrey	Roberts, Sir Wyn
Jones, Gwilym (Cardiff N)	Robertson, Raymond S (Ab'd'n S)
Jones, Robert B (W Herts)	Robinson, Mark (Somerton)
Jopling, Michael	Roe, Mrs Marion
Kellett-Bowman, Dame Elaine	Rowe, Andrew
Key, Robert	Rumbold, Dame Angela
King, Tom	Ryder, Richard
Kirkhope, Timothy	Sackville, Tom
Knapman, Roger	Sainsbury, Sir Timothy
Knight, Mrs Angela (Erewash)	Scott, Sir Nicholas
Knight, Greg (Derby N)	Shaw, David (Dover)
Knight, Dame Jill (Edgbaston)	Shaw, Sir Giles (Pudsey)
Knox, Sir David	Shephard, Mrs Gillian
Kynoch, George	Shepherd, Richard (Aldridge)

Shersby, Sir Michael	Townsend, Sir Cyril (Bexl'yh'th)
Sims, Sir Roger	Tracey, Richard
Skeet, Sir Trevor	Tredinnick, David
Smith, Sir Dudley (Warwick)	Trend, Michael
Smith, Tim (Beaconsf'ld)	Trotter, Neville
Soames, Nicholas	Twinn, Dr Ian
Speed, Sir Keith	Vaughan, Sir Gerard
Spencer, Sir Derek	Waldegrave, William
Spicer, Sir Jim (W Dorset)	Walden, George
Spicer, Sir Michael (S Worcs)	Walker, Bill (N Tayside)
Spink, Dr Robert	Waller, Gary
Spring, Richard	Ward, John
Sproat, Iain	Wardle, Charles (Bexhill)
Squire, Robin (Hornchurch)	Waterson, Nigel
Stanley, Sir John	Watts, John
Steen, Anthony	Wheeler, Sir John
Stern, Michael	Whitney, Sir Raymond
Stewart, Allan	Whittingdale, John
Streeter, Gary	Wiggin, Sir Jerry
Sumberg, David	Wilkinson, John
Sweeney, Walter	Willetts, David
Sykes, John	Wilshire, David
Tapsell, Sir Peter	Winterton, Mrs Ann (Congleton)
Taylor, Ian (Esher)	Winterton, Nicholas (Macclesf'ld)
Taylor, John M (Solihull)	Wolfson, Mark
Taylor, Sir Teddy	Wood, Timothy
Temple-Morris, Peter	Yeo, Tim
Thomason, Roy	Young, Sir George
Thompson, Sir Donald (Calder V)
Thompson, Patrick (Norwich N)	Tellers for the Noes:
Thornton, Sir Malcolm	Mr. Bowen Wells and
Townend, John (Bridlington)	Mr. Sebastian Coe.

Question accordingly negatived.