§ Order for Second Reading read.
6.35 pm§ The Secretary of State for the Home Department (Mr. Jack Straw)I beg to move, That the Bill be now read a Second time.
This is a detailed, technical Bill, which has already been the subject of extensive debate in the other place. It implements the directive on data protection that was agreed in the European Union in 1995.
The draft directive, which was drawn up in 1990, was the subject of a good deal of discussion in the House. When it came up for discussion in European Standing Committee B in December 1994, serious reservations were expressed by both the then Government and the then Opposition. My hon. Friend the Member for Pontypridd (Dr. Howells) spoke for the Opposition. The directive was then improved, and the previous Government—Mr. Tom Sackville was the Minister—published a consultation document in March 1996. We are under an injunction in the directive to implement the directive in the form of legislation by October this year. The Bill would do that.
The Bill's detail can be the subject of discussion in Committee. However, I want to refer to a few important aspects where there are significant changes from the 1994 Data Protection Act, which itself implemented a 1981 Council of Europe convention on data protection. The first difference is that the Bill covers some manual records, which are known as structured manual records. It does not cover unstructured manual records. Hon. Members will be pleased to hear that, because in my experience that automatically excludes any record held by a Member of Parliament.
Clause 2 sets out special safeguards for the processing of sensitive personal data, including information about matters such as ethnic origin, political or religious opinions, health and sexual life. One important matter that has been raised with the Government—indeed, it was raised with me when I visited the United States in February—concerns the rules governing transfer of personal data to countries outside the European economic area. It is an important issue, which I hope will be discussed in some detail in Committee.
I know that there is come concern among certain of the European Union's trading partners, especially the United States, about how the word "adequacy" in the Bill will be interpreted in practice. Not all countries outside the EU have arrangements that meet the high standards in the directive, but I believe that our proposals for dealing with individual cases are sufficiently flexible to meet controllers' needs, while giving proper effect to the directive.
§ Mr. Andrew F. Bennett (Denton and Reddish)Will my right hon. Friend explain what protection is available to an individual who provides information to a company which decides to sell it abroad? Does the individual have any veto on the information being sold abroad?
§ Mr. StrawThat is what the Bill and the directive seek to do. The Bill also seeks to deal with the issue of enforced third-party access to information held by data users. The broader question of third-country adequacy is 530 being addressed in collective discussions in Brussels, and I am confident that a satisfactory way forward can be found.
The Government are committed to dealing with the problem of enforced subject access. Typically, that occurs where one person requires another to provide information in documentary form which can be obtained only by using the subject access route. That has been a means of accessing individuals' criminal records. The Data Protection Registrar strongly believes that this is wrong in principle, and, in another place, my noble and learned Friend Lord Williams indicated our acceptance in principle of what the registrar had said.
The matter is proving to be a very difficult nut to crack. The issues are complex, and, in some respects—certainly until part V of the Police Act is enforced—there will be a continuing need to ensure that there is access to individuals' criminal records. We are continuing to have discussions with the Data Protection Registrar and her staff. I hope that we can table the necessary amendments in Committee.
§ Mr. Andrew Miller (Ellesmere Port and Neston)My right hon. Friend has just made an important statement. In Committee, will he ensure that sufficient flexibility exists in the legislation to take into account the rapidly changing scene—particularly his Department's use of processes such as data matching, which are very important in crime detection?
§ Mr. StrawYes, we will address that issue, and will listen with care. As we made clear in another place, we approach this matter in an entirely bipartisan way, and there has been excellent co-operation from the Opposition. We do not regard the Bill as perfect, but we have done our best. I am sure that it could be improved, and we look forward to receiving amendments from wherever they come.
Clause 28 was partly amended in the other place, against our advice. We are considering carefully whether there is any way in which we can limit the need for the original provision in clause 28, but we may have to table amendments in Committee.
Understandably, concern was expressed by the media about the way in which the Bill might impact on their rights. Detailed discussions have taken place with representatives of the media, particularly with Lord Wakeham. The conclusions of the discussions have been positive, and are expressed in clause 31. They achieved approbation from both sides of the House, and can be the subject of further discussion in Committee. I believe that they provide a satisfactory way forward, and they appear to have achieved widespread agreement.
In conclusion, I repeat that we regard this as an all-party matter, which we inherited from the previous Administration. It is an important but technical Bill. I look forward to the debate and to the reports of the proceedings in Committee.
§ Sir Brian Mawhinney (North-West Cambridgeshire)May I immediately tell the Home Secretary that we share his view that we ought to proceed in a bipartisan way? There has been a lot of consultation—which we welcomed—in another place, and we will seek to continue 531 in that constructive vein during our considerations. I agree that this is a technical Bill. Its principles are important, but I will not seek to get bogged down in the details at this stage. They can be examined in Committee, and I hope that that will be of help to the House.
We are pleased that the principles behind the Data Protection Act 1984 are largely reproduced in the Bill, with some additions. We consider that to be almost the necessary prerequisite to that bipartisan approach. Personal data, and the proper and accurate handling of those data, is important. Our constituents must be protected when people are tempted to misuse information. All of us will have had examples of constituents who have been greatly distressed because they could not find out what was held about them. In many cases, the information was inaccurate, and they had no means of changing it.
As the Home Secretary said, the directive emerged because different countries applied the data protection convention in different ways. The European Commission, as is its tendency, wanted to homogenise everything. We were not aware that the absence of a directive had had a negative effect on trade between member states, or was necessary to ensure fair competition within the Community. We did not believe that a directive was necessary to make the single market work. We did not vote for it, but we have it, and we are now under an obligation to see that it is put into our law.
That leads me to my first question, which can be explored in Committee. The House will want to know what steps are being taken by other countries. We have a tendency in this country to get ahead of the game, and to be conscientious in the implementation of directives. We then find that others—for a variety of reasons—are lagging behind, and our businesses find themselves at a disadvantage. We will want to know what progress is being made in other countries.
We want to know also how much gold-plating is in the Bill, over and above what is required by the directive. When the Labour party was in opposition, it regularly accused us of adding to legislation required by directives, and imposing extra burdens over and above those requirements. In Committee, we will want to explore how much of the Bill flows from the directive, and how much is an opportunity being taken by the Government to add other burdens.
The Home Office said that the directive has three intentions. First, it intends to harmonise data protection legislation throughout the EU. We would prefer a regime of minimum standards, but we will look at the Bill against that background. Secondly, the directive aims to protect the individual's rights and freedoms, particularly the right to privacy with regard to the processing of personal data. That is a matter of common ground between us. Thirdly, the directive facilitates the free flow of personal data within the EU in the interests of improving the operation of the single market. As I have said, we are not aware that the single market is being damaged, but we will bear that in mind.
Like the Home Secretary, I wish to mention a few articles as a tick-list to which we will return in Committee. Article 7 defines the individual's right to gain access to information. That is a very important right, which we will want to make sure is enshrined. 532 Article 8 introduces the new concept of sensitive data. We will want to explore why such sensitive data might be held in the first place, and whether there are ways of regulating the holding and processing of personal data.
We must look at the range of exemptions in terms of revealing information. The Bill refers to the police, employers, health care services and lawyers. Other things occur to me. What about the notes I take in my political surgeries when constituents come to see me? Will they be covered by the Bill? What about the advice given by citizens advice bureaux to our constituents? There are a number of large issues relating to exemption which we will want to explore in some detail.
Article 9 states that member states must provide exemptions from data processing rules where the information is held solely for the purposes of journalism or literary expression. Like the Home Secretary, I have read the Hansard reports of the debates in another place, and I have talked to my noble Friend Lord Wakeham, whose general view of the article's appropriateness I share. I only wish that the Government had consulted as effectively on the Human Rights Bill as they clearly have on this Bill—they are belatedly doing so, for which we give them half a mark.
We recognise the importance of deferring legal recourse to post-publication—we shall sympathetically examine the Government's decision on that. The Home Secretary mentioned manual records and the concerns of the Data Protection Registrar, which we shall also want to consider further.
On enforcement, clause 41 is a replica of current legislation, but we welcome the Government's willingness to go further, as represented in clause 42, as that goes to the heart of ensuring privacy and confidence in the system. I hope that the Home Secretary will understand if, in Committee, we come back time and again to the question whether the procedures will elicit public confidence.
The final point to which I want to draw attention—the Home Secretary did not mention it—is the enormous cost to business and industry of implementing the Bill. According to the Government's figures—from the Data Protection Commissioner's office—£1.15 billion in non-recurring start-up costs and £750 million in recurring annual costs will be incurred. That is a huge burden on business. It will have an impact on competitiveness for those who compete and market not only within the United Kingdom but—unless there is a level playing field—internationally. That brings me back to where I started: if the Bill is gold-plated, there will not be a level playing field, and we shall add burdens to British business and industry that will not be replicated overseas.
We recognise the importance of technological advance and the need to change procedures to take account of it. We also recognise the importance of personal privacy, accuracy and access to information—in other words, confidence. On the whole, the 1984 Act commanded confidence, and the Bill must do the same—we shall work hard and constructively to ensure that it does. Its principles are right and unexceptional, and we will be so directed, when the time comes, to make a Second Reading judgment.
§ Mr. Richard Allan (Sheffield, Hallam)The Liberal Democrats, too, welcome the Bill. Although it has been a long time in gestation, we believe that it should be dealt with with some urgency. It is an important piece of human rights legislation, fitting into a general pattern of reform, which will help to define privacy. We have some concerns, which I shall mention briefly, so that the Government have notice of them—obviously, I shall save the detail for Committee.
A couple of measures are still missing. First, the Home Secretary referred to enforced subject access, on which the Government gave a clear commitment to legislate in the framework of the Bill. We shall be disappointed if nothing is done about that; we favour the creation of a criminal offence.
Secondly, there should be an exemption on the holding of sensitive personal data on ethnicity for the purposes of ethnic monitoring. Clearly, great strides have been made in monitoring the work force, and we do not want the Bill to make such monitoring—when it is in the wider public interest—illegal. The Government made a commitment to create such an exemption in response to an amendment moved in another place by my noble Friend Lord Dholakia—we want them to act on that.
We want the Commissioner to have stronger powers, especially under clause 50, to be more proactive in identifying situations in which the principles are not being complied with. We have concerns about third-country standards, which the Home Secretary mentioned. Moreover, we believe that the media exemptions in clause 31 throw up wider questions, especially in the context of the Human Rights Bill. We are convinced neither that the notion of proportionality in considering the public interest is sufficiently incorporated, nor that clause 31 will stand up when the Human Rights Bill is enacted—we shall want to return to that matter.
We want the measures on data matching to go further; specific codes of conduct should be referred to and made compulsory. We shall also examine the issue of sensitive data that are held by bodies other than the police or the Secretary of State, as we believe that, for example, organisations such as the Royal Society for the Protection of Birds should be able to hold information on wildlife offenders.
We believe that the Bill is sensible, but it is crucial that people register. We welcome the improvement of notification procedures, but, in searching through the information provided by the Data Protection Registrar, I noticed that only slightly more than 100 Members of Parliament are currently registered. I can tell the right hon. Member for North-West Cambridgeshire (Sir B. Mawhinney) that the registrar has proposed new categories of data, including citizens advice bureaux records and the casework of Members of Parliament. I sent off my application form today, and I hope that registration will become more widespread as people become more aware of the issue.
§ Mr. Richard Shepherd (Aldridge-Brownhills)Because of the extraordinary lateness of the hour, I realise that I must condense my remarks on this important Bill, which owes its genesis and genius elsewhere—in our membership of the European Union.
534 I want to speak about only one measure, about which I have already teased the Home Secretary. The Bill originally contained a provision—clause 28(4)—which was deleted when the Government were defeated on an amendment moved by Baroness Nicholson in another place. However, the Government have said that the provision may be reintroduced in the House of Commons, which is why I want to highlight it now.
Clause 28(4) gave the Secretary of State the power by order to remove essential safeguards from unspecified classes of personal data. An order removing those rights could be made where it was thought necessary to prevent or detect crime, apprehend or prosecute offenders, or assess or collect tax.
The rights that would be set aside are: first, individuals' rights under clause 7 to obtain a copy of any data held about them—the so—called right of subject access; secondly, the first data protection principle, which requires that those processing data do so fairly and lawfully—the term "processing" includes the obtaining of personal information, the use made of it and its disclosure; thirdly, the so-called non-disclosure provisions, which consist of any of the other safeguards in the data protection principles that may prevent the disclosure of personal information.
The effect of a provision such as clause 28(4) would be drastic. It would allow bodies to obtain information illegally and entitle them deliberately to mislead the individual who asked how the information had been obtained, what use was being made of it, and to whom it was being disclosed.
There are three reasons why the proposal is objectionable. First, it is unnecessary. The preceding provisions—clause 28(1) to (3), which remain in the Bill—permit those safeguards to be set aside in any individual case where their application would prejudice law enforcement or tax collection. Clause 28(4) permitted those safeguards to be set aside in all cases, regardless of whether compliance would prejudice law enforcement or tax collection.
§ The Parliamentary Under-Secretary of State for the Home Department (Mr. George Howarth)As a result of the earlier decision, this matter is being considered, as the hon. Gentleman will know. I am more than happy to discuss it with him in detail before the Bill is considered in Committee.
§ Mr. ShepherdI greatly appreciate that offer, which I shall indeed take up. I am not trying to talk out the Bill, as the Minister will understand; I want to highlight the issue, and ensure that the reasons behind the Government's decision to delete the measure are given.
My final point is that, in the past—over the Deregulation and Contracting Out Act 1994, for example—the Labour party expressed great concern about the ability to amend, by secondary legislation, primary legislation to which rights were inscribed. Having said that, however, I support the general thrust of the Bill.
§ Question put and agreed to.
§ Bill accordingly read a Second time, and committed to a Standing Committee, pursuant to Standing Order No. 63 (Committal of Bills).