§
20. The definition of relevant filing system in section 1(1) of this Act shall be modified so that the definition ends after the third occurrence of the word 'individuals'.
21. Paragraph 20 shall have effect after 23rd October 2007.'.
§ My amendment is about structured manual files, on which there was an important debate in the other place. Such files will not be subject to the new law, so the Bill will allow organisations such as the Economic League to flourish.
§ The problem relates entirely to the private sector; there will be no problem in the public sector, because the freedom of information legislation will provide access for every individual to manual files, barring personal data. The human rights legislation, too, will minimise the files and personal information held by public bodies if they invade privacy.
615 9.30 pm
§
In a briefing note on manual records dated 29 January, available on her website, the Data Protection Registrar said that if the Government's approach to structured manual records was
the correct interpretation of the Directive, it is hard to see how it makes practical sense".
It seems that that advice has been ignored.
§
In another place, Lord Williams of Mostyn, the Under-Secretary, said about the relevant filing systems:
We do not wish the definition to apply to miscellaneous collections of paper about individuals, even if the collections are assembled in a file with the individual's name…on the front".—[Official Report, House of Lords, 16 March 1998; Vol. 587, c. 467.]
There will therefore be a legal reason for some unscrupulous private sector bodies to evade all data protection control.
§ For example, a private sector organisation such as the Economic League, which kept dossiers on trade union members for the purposes of blacklisting them, will be allowed to keep whatever information it likes, however inaccurate or irrelevant it is, and to disclose it to whomever it likes, so long as it keeps the information on paper and in date order. Similarly, that aspect of the Bill is a godsend to private investigators, allowing them to indulge in covert surveillance of individuals, and will encourage the use of enforced subject access. They, too, will be able to evade all data protection controls.
§ The lack of data protection controls means that individuals will have no rights, and there will be unlimited disclosure to anybody of secret dossiers and files of irrelevant or inaccurate information, which may be kept for ever. In short, organisations such as the Economic League, and private investigators, will enjoy the same level of total exemption as MI5, MI6 and GCHQ. It is hard to believe that that is what Ministers really intend.
§ The Government have produced a convoluted definition of a relevant filing system, because they are worried about the costs to the private sector. My amendment is a compromise, telling the private sector that it has nine years to bring all personal files into the ambit of data protection controls. At least after that time, malicious or unfair use of personal data kept on manual files would cease.
§ Mr. HoonI am grateful to my hon. Friend for explaining the purpose of his amendment. I hope that I shall be able to reassure him about the specific examples that he has given. As hon. Members will be aware, the Data Protection Act 1984 does not apply to manual records; it is concerned only with the automated processing of personal data. However, the 1995 directive, to which the Bill gives effect, requires member states to apply their data protection laws to certain manual records. Article 2 of the directive attempts a definition of the manual records that it intends to cover. That definition is accompanied by a more detailed commentary in recitals 15 and 27.
The definition of a "relevant filing system" in clause 1(1) is based on those provisions of the directive. The Government's purpose has been to cover all the manual records that the directive requires member states to cover, but to go no further than the directive requires. The purpose of the directive is to bring within the scope of data protection law the manual records that lend themselves to easy manipulation of the information contained in them, as computerised records do.
616 The Government support that approach. The greatest risk of infringement of privacy comes from manual records held in such a way that specific information about particular individuals can be easily identified and extracted. I hope that my hon. Friend will accept that his example of a card index held, by the Economic League, would be covered by the Bill, because with each card there would be the possibility of identifying information about a particular individual. Such a system would be included under the Bill.
To that extent, I hope that my hon. Friend will be satisfied that the Government have had regard to his concerns. Where manual records are not structured in such a way as to permit the easy manipulation of specific information, the risk of infringement of privacy is much less. The directive does not require data protection law to be applied to such records; nor does the Bill.
My hon. Friend's amendment would extend the application of the Bill to such records; the Government do not believe that necessary or desirable. To do so would be to impose additional burdens on business and others who use manual records in circumstances in which there is little or no threat to privacy. It would put UK data controllers at a competitive disadvantage.
I agree that the amendment would not come into force until 23 October 2007, but deferring implementation does not necessarily remove the difficulties of substance that I have identified.
I must tell my hon. Friend that the Government cannot accept the amendment. I hope that, given my assurances, my hon. Friend will feel able to withdraw it.
§ Amendment, by leave, withdrawn.