ENFORCEMENT NOTICES (Hansard, 2 July 1998)

HC Deb 02 July 1998 vol 315 cc596-605 596

§ Mr. Cohen
I should like to speak to amendment No. 1, in page 23, line 32, to leave out "the fourth" and insert "any". However, I welcome the Government amendments that have been grouped with it, which, 597 I think, accept the points that I wanted to make. The rights granted by article 12 (b) and (c) of the European directive, as established by the Bill, should apply to all the data protection principles, and not only to the fourth principle, as originally proposed, so that unlawful and unfairly obtained data—not only inaccurate data—are covered.
There was a danger that the Bill would not implement the data subject's rights under those two articles of the directive, which would also have meant a lessening of protection for data subjects under the Data Protection Act 1984. I welcome the Government amendments.

§ Mr. Deputy Speaker (Mr. Michael J. Martin)
Is the hon. Gentleman saying that he is not moving amendment No. 1?

§ Mr. Cohen
Yes. I am prepared not to move it, as I accept the Government amendments.
Amendments made: No. 33, in page 23, line 33, leave out 'may' and insert 'which requires the data controller to rectify, block, erase or destroy any inaccurate data may also'. No. 34, in page 23, line 34, leave out 'any inaccurate data and'.
No. 35, in page 23, line 36, leave out 'or' and insert— '(3A) An enforcement notice in respect of a contravention of the fourth data protection principle'. No. 36, in page 23, line 39, leave out from 'party' to second 'to' and insert 'may require the data controller either—

(a) to rectify, block, erase or destroy any inaccurate data and any other data held by him and containing an expression of opinion as mentioned in subsection (3), or

(b)'.
No. 37, in page 24, line 2, leave out from 'notice' to 'or' in line 4 and insert 'requires the data controller to rectify, block, erase or destroy any personal data'. No. 38, in page 24, line 6, leave out 'were inaccurate' and insert 'had been processed in contravention of any of the data protection principles'.—[Mr. Hoon.]

§ Mr. Richard Shepherd (Aldridge-Brownhills)
I beg to move amendment No. 15, in page 24, line 28, at end insert— '(7A) The Commissioner shall maintain a register containing—

(a) a copy of every enforcement notice issued under this section;

(b) such other particulars relating to such notices as the Secretary of State may by order prescribe.

(7B) The provisions of sections 19(6) and (7) shall apply in relation to the register maintained under this section as they do in relation to the register maintained under section 19(1).'.

§ Mr. Deputy Speaker
With this, it will be convenient to discuss the following amendments: No. 16, in clause 42, page 25, line 20, at end insert 'and may, if he considers it appropriate, inform any other person'. 598 No. 17, in clause 59, page 36, line 44, leave out 'necessary for reasons of substantial' and insert 'in the'.
Government amendment No. 46.
No. 18, in page 36, line 44, leave out 'substantial'.

§ Mr. Shepherd
The amendments reflect concern about a new prohibition on the release of information in clause 59, which would make it an offence for the Data Protection Commissioner or her staff to disclose information about any identifiable business or individual other than in very limited circumstances. The offence would be committed even if the disclosure caused no harm to commercial confidentiality, for example. No such offence exists under the Data Protection Act 1984.
The provision is likely to prevent the commissioner from publicly identifying businesses that have been found to be misusing personal data about individuals by obtaining data through deception, for example, or by selling private information for commercial purposes. The commissioner may be unable to reveal that she has received large numbers of complaints about a particular company, that a company has failed to respond to requests to improve its practices or that an enforcement notice has been served against a firm. Equally, it may be an offence to reveal that a business has agreed to correct a problem without formal action, or that a complaint had proved unfounded.
The registrar has expressed concern at the new provision, which she says may require her and her staff to be unnecessarily guarded in future. The result may be both to deny the public information that they should have and to undermine public confidence in the commissioner's work, by preventing her from explaining what action she has taken to deal with complaints relating to matters of public concern.
The offence is not limited to disclosures likely to cause actual harm, but will be caused by any disclosure of any information about an identifiable business. That contradicts the policy established by the previous Government, whose 1993 White Paper on open government provided that, in any new offences involving the disclosure of information, the presumption will be in favour of the inclusion of a harm test". It is also inconsistent with this Government's proposals for a freedom of information Act. The freedom of information White Paper proposes that information should be withheld only where disclosure would cause either harm or substantial harm to specified interests. Existing statutory restrictions on disclosure are being reviewed with a view to repealing or amending those that do not reflect the proposed harm test.
In Committee, my hon. Friend the Member for Ryedale (Mr. Greenway) tabled an amendment to restrict the offence to information that is potentially damaging. The amendment was not accepted. The Government say that the new offence is required by the European data protection directive, which states that national supervisory authorities must be subject to a duty of professional secrecy". However, the registrar's view, as expressed in January, is that that obligation can be met without the creation of a new criminal offence. Moreover, the directive contains 599 a number of pro-disclosure provisions, which would permit a far more balanced approach. They include recital 72, which states that this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive", and recital 63, which states that supervisory authorities must help to ensure transparency of processing". The Government maintain that the restriction is not as serious as it seems, as the commissioner has a discretion to release information under clause 51(2), which states: The Commissioner shall arrange for the dissemination in such form and manner as he considers appropriate of such information as it may appear to him expedient to give to the public about the operation of this Act, about good practice, and about other matters within the scope of his functions under this Act". However, precedent under similar provisions suggests that that may be of limited value.
For example, the Health and Safety Commission and Executive are prohibited from disclosing information unless it is for the purposes of their functions, but they are required to ensure that people concerned with matters relevant to the purposes of the Health and Safety at Work Act, etc. 1974 are kept informed of, and adequately advised on those matters. The HSC and HSE interpret those two requirements restrictively, and say that they are prohibited from revealing information about individual premises unless to do so would directly prevent risk, or is necessary to protect health and safety. Requests for information about identifiable premises from people who are not themselves in danger, including Members of Parliament, researchers and journalists, are usually refused. The explicit prohibition on releasing information about identifiable businesses is therefore likely to override the commissioner's general discretion to release information, unless, under clause 59(2)(c), the disclosure is made for the purposes of, and is necessary for, the discharge of…any functions under this Act". It would be extremely difficult to demonstrate that a particular disclosure was necessary for any function under this Act. If the function can be discharged without the disclosure, the disclosure will not be necessary, and, indeed, will be illegal.
Clause 59(2) permits disclosure in certain other limited circumstances—for example, when the information is already publicly available, when the individual or business concerned consents to the disclosure and when disclosure is made in connection with legal proceedings. The subsection also provides for a limited, highly restrictive, public interest defence.
The amendments would require the commissioner to maintain a public register of enforcement notices, whose disclosure might otherwise constitute an offence. They would permit—but not require—the commissioner to reveal the results of an assessment of whether a particular business was complying with the legislation. At present, that information can be revealed only to the person who asks for the assessment, and its disclosure to a Member of Parliament or a journalist could be an offence. The amendments also attempt to strengthen the public interest defence available to the commissioner or her staff.
Let me deal first with amendment No. 15. Under clause 41, the commissioner may serve an enforcement notice when it appears to her that a data controller is 600 contravening any of the data protection principles. The notice may require the controller to take specified action or to stop processing data. The amendment requires the establishment of a register of such notices, as is made clear in new subsection (7A), which would have to be available to the public, free of charge, at all reasonable times. Certified copies of entries could be obtained on payment of any prescribed fee. That is provided for by new subsection (7B), which applies the existing provisions of clause 19(6) and (7), relating to the data protection regime.
The amendment would bring the Bill into line with existing legislation, such as the Environment and Safety Information Act 1988 and the Environment Protection Act 1990, which require the establishment of public registers of enforcement notices about environmental and safety hazards. Paragraph (b) of new subsection (7A) would allow the Secretary of State, by order, to require other information relating to such notices to be included in the register. That would allow the fact that a notice had been cancelled under clause 41, or was the subject of an appeal under clause 48, to be recorded; it might also permit the person on whom the notice had been served to add a statement of explanation or mitigation to the register.
Amendment No. 16 refers to clause 42. Under clause 42(1), a person who believes that he or she has been directly affected by any processing of personal data may ask the commissioner for an assessment of whether that processing breaches the Act's requirements. After carrying out the assessment, the commissioner must inform the applicant, to the extent that she considers appropriate, of any view formed or action taken as a result". That is in clause 42(4)(b).
8.45 pm
However, while the applicant must be informed of the outcome, the commissioner may commit an offence under clause 59 by revealing the same information to any other person. Thus, although there may have been a well-publicised complaint about a particular practice, the commissioner may not tell anyone—including a journalist, a Member of Parliament or another potentially affected person—about her findings. The amendment allows, but does not require, the commissioner to make such disclosures; however, a requirement may arise under the proposed freedom of information Act.
The discretion is appropriate in this instance. When a complaint relates purely to the circumstances of an individual applicant, wider disclosure may not be appropriate; but when the issue is of general concern and affects a large number of people, disclosure may be justified—if, for example, it reveals that a bank is failing to safeguard personal data about its customers.
There is no reason why the level of disclosure proposed in the amendment should be thought to contravene the obligation of professional secrecy required by the directive, given that the directive also provides that supervisory authorities must help to ensure transparency of processing". Let me now deal with amendment No. 17. A public interest test is available under clause 59(2)(e) should the commissioner, or a member of her staff, be prosecuted for an offence relating to the disclosure of information. 601 The test is particularly restrictive, and amendments Nos. 17 and 18 seek to remove some of the restrictive features. Clause 59(2)(e) provides that no offence is committed if having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary for reasons of substantial public interest. That means that it would have to be established that the disclosure was "necessary", not just desirable, in the public interest, and that the public interest related to the rights and freedoms or legitimate interests of others. That term does not, on the face of it, acknowledge the public interest in the accountability of the commissioner's work. Moreover, the public interest itself would have to be "substantial".
It is hard to see why that public interest test should be set down so strictly, particularly as most of the Bill's other public interest tests are less demanding. For example, there is no requirement that the public interest be "substantial" before a newspaper can publish personal data under the public interest test in clause 32(1)(b).
Amendment No. 17 would remove the requirement that the disclosure be "necessary" and that the public interest be "substantial". The defence, as amended, would read: having regard to the rights and freedoms or legitimate interests of any person, the disclosure is in the public interest. Amendment No. 18 and Government amendment No. 46 cover similar ground. Amendment No. 18 is an alternative to amendment No. 17. It would delete the word "substantial" in clause 59, but would retain the word "necessary". The amended clause would then read: having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary for reasons of public interest. The wording is effectively identical to amendment No. 46, tabled by the Home Secretary. Under that amendment, the clause would read: having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary in the public interest. I hope that the Government will withdraw their amendment and support mine, because the word "necessary" would remain a problem with both amendment No. 18 and amendment No. 46. A disclosure that was "desirable" in the public interest, but not "necessary", would not be permitted under those amendments. There is an important distinction between the two, and I hope that the Government will accept my amendments.

§ Mr. Greenway
My hon. Friend the Member for Aldridge-Brownhills (Mr. Shepherd) very adequately set out the concerns of the Data Protection Registrar. I tried to impress on the Government the importance of several concerns about the provisions that create the offence of unlawful disclosure of information by staff. People who are only doing their job may find themselves committing a criminal offence. The House must be sure that the legislation provides for that criminal offence only when it is strictly necessary.
I was disappointed in Committee that the Government did not accept the harm test to which my hon. Friend the Member for Aldridge-Brownhills referred. There seems to 602 be an inequality in the public interest test, in that the word "necessary" will apply to this provision, even when the Government amendments are made, but not to other exemptions in the Bill. I cannot for the life of me understand why staff who are only doing their job should be subject to a greater hurdle than others when disclosure is accidental, especially as some of the exemptions, as in clause 32, are extremely wide.
I hope that the Minister will acknowledge that those are genuine concerns. If Government amendment No. 46 is made, it would at least allow the other place to return to the matter when it considers our amendments. With that in mind, it may not be too late for the Government to reconsider the word "necessary", to which my hon. Friend the Member for Aldridge-Brownhills so rightly referred.

§ Mr. George Howarth
I pay tribute to the hon. Member for Aldridge-Brownhills (Mr. Shepherd) for his hard work and the good advice that he often takes on these matters. His concern about confidentiality of information is well recognised and respected, and he moved the amendment very much in that spirit.
Clause 40 is a key part of the Bill. It enables the commissioner to issue enforcement notices requiring compliance with data protection principles. Amendment No. 15 would require the commissioner to maintain a register of enforcement notices, to be accessible in much the same way as the main register of data controllers' notifications provided for in clause 19.
The idea of keeping a public record of enforcement notices has been suggested in the past, and we are not unsympathetic to it in principle. I understand that the Data Protection Registrar herself has expressed some interest in such a record, as the hon. Member for Aldridge-Brownhills said.
It was with such an idea in mind that the Government tabled an amendment in Committee to add clause 19(2)(b), allowing the Secretary of State, by notification regulations, to authorise or require the commissioner to include in the register of notifications maintained under that clause certain information in addition to the basic registrable particulars.
It would be possible to use the provision to add information about enforcement notices to the register. Under clause 25, the commissioner can make proposals for the content of notification regulations. The Government look forward to hearing the commissioner's views and will consider the issue further in that context. Against that background, I invite the hon. Gentleman to withdraw the amendment.
Amendment No. 16 would explicitly allow the commissioner to tell any other person, as well as the originator, the outcome of a request for assessment of the compliance of any particular processing with the provisions of the law. I recognise that the provision is discretionary, but I do not think it appropriate for the legislation to be framed in that way.
Requests for assessment may deal with essentially private matters—that is, private either to the data subject or to the data controller. More fundamentally, such requests are at most preliminaries to enforcement action, and they may come to nothing, as there may be perfectly good answers to the questions. I am not in favour of any general presumption in favour of releasing the results of assessments. That is not to say that they might not emerge in one form or another under other parts of the Bill.
603 Clause 51 places general duties on the commissioner to promote good practice and to disseminate material that she considers appropriate, about the operation of the Act, good practice and any other matters within the scope of his functions. Anonymised information from assessments may appear in one of those contexts, and the result of any assessment may be quoted in enforcement proceedings.
I do not think that a power at large, qualified only by the general term "appropriate", fits what we need in this targeted legislation. Release of information when it serves a particular purpose is fine; but otherwise, just as we have to be careful with the interests of data subjects, we have to be careful with the interests of data controllers. I invite the hon. Member for Aldridge—Brownhills to reflect on the provisions of clause 51 and not to press to a vote amendment No. 16, which is a general amendment to clause 42.
Clause 59 is an important and, I accept, difficult provision. It is important because it discharges the obligation on us to ensure that the supervisory authority—the Data Protection Commissioner and her staff—are subject to a duty of what the directive calls "professional secrecy", in respect of the confidential information to which they have access.
We have found it difficult to get the provision right. Our original proposal in another place was criticised by the Data Protection Registrar, and we revised it on Report there, but we could not, and still cannot, accede to pressure to remove it; the directive requires us to have a statutory provision, which needs to be enforceable through a criminal sanction.
We have considered the detail further in the light of representations, not least from the hon. Members for Aldridge-Brownhills and for Ryedale (Mr. Greenway), and of the Government's own commitment to freedom of information legislation, which the former hon. Gentleman rightly prayed in aid for his argument.
Clause 59 states that one way in which a disclosure may be made with lawful authority is if, having regard to the rights and freedoms or legitimate interest of any person. the disclosure is necessary for reasons of substantial public interest. Government amendment No. 46 replaces that with a simple test of necessity in the public interest. I hope that the hon. Member for Aldridge—Brownhills will accept that that goes further in the direction of freedom of information, while still complying with the directive. That is a difficult balance, but amendment No. 46 achieves it.
Amendments Nos. 17 and 18 go in much the same direction, as the hon. Gentleman said. I prefer the Government's wording, for two reasons. First, it maintains the necessity test, which is important for an exemption from the directive's requirements. Secondly, our words are simpler. "In the" rather than "for reasons of is a simpler way to express the point. I hope that the hon. Gentleman will be willing to withdraw his wording in favour of ours.
The hon. Gentleman argued that clause 59 could, perhaps, go further, and we did consider whether there was further scope for easing the restrictions that the clause imposes, while keeping it consistent with the directive. So far, we have been unable to find a way to do that, but we shall certainly continue to have regard for that point as we continue our work on freedom of information. If we can identify any way in which restrictions can 604 properly be eased, we shall bring forward any necessary amendment in freedom of information legislation. There is scope to revisit the point within that framework, provided that we can find a suitable way to achieve what the hon. Gentleman and the Government want.
I hope that the hon. Gentleman will agree that that is a considered response to his concerns, and that he will feel able to withdraw the amendment, safe in the knowledge that we recognise his concerns and are aware of the possibility of revisiting the point at a later stage.

§ 9 pm

§ Mr. Shepherd
I am extremely disappointed by that reply. I took the trouble to provide the Government with my notes for the debate, and I thought that they would address the issues raised in those notes. However, they have not done so. I thought that there were some benefits in my approach. I was being helpful on the White Paper. There is a muddle, and there is grave concern about how matters interrelate, so I was trying to set out the position. I was also trying to state clearly the anxieties expressed by the Data Protection Registrar, Mrs. France, and by professionals in the field.
I was trying to assist the Government by preventing the need for this business to return to the House once the Lords have amended the Bill along my lines. There is one simple problem in both the Government's amendment and my amendments. My argument is that "necessary" would remain a problem under the amendments. Amendment No. 18 was my fallback position, and I was pleased to see the Government withdraw the substantial point. However, "necessary" is being retained, and that reminds me of my experience under Governments of my own party and their unwillingness to yield once Government amendments had been set out. "Necessary" will remain a problem. A disclosure merely desirable, but not necessary, in the public interest would not be permitted under amendment No. 46. The Minister simply has not addressed that point, although it is of the essence. Perhaps he will consult his colleagues and the civil servants in their Box.
I would gladly not press amendment No. 18 if the Government would not press amendment No. 46. Then we would have a good raft of amendments that would satisfy the House of Lords. We could prevent the need for the matter to come back.

§ Mr. George Howarth
I have listened carefully to the hon. Gentleman; I hold him in the highest regard. I did not have the opportunity to read the notes that he sent to the Home Office, and I apologise for that. I do not believe, however, that his concerns need to be dealt with in the way he states, because the Government amendments go far enough. I will be sorry if the hon. Gentleman does not feel able to withdraw his amendment. He will be able to revisit the matter, as will the House, under the general heading of freedom of information.
I am loth to say more because I sat through long hours of debate on the Maastricht treaty, and I know of the hon. Gentleman's enormous potential to speak again with alarming frequency and great lucidity. I am desperately anxious not to tempt him to do so.

605

§ Mr. Greenway
The House is in a dilemma. We have only the prospect that the Government's amendment is likely to be carried, and we have to face that reality. Yet that amendment includes the word "necessary" and I agree with my hon. Friend the Member for Aldridge-Brownhills (Mr. Shepherd) that that word is not required. I am being helpful to the Minister when I say that the House can only accept the Government amendment, but the Government must expect that amendment to be amended in the other place because my hon. Friend's arguments are extremely valid.
The word "necessary" is unnecessary. It is not applied in other parts of the Bill. The only opportunity open to us now is to accept the Government amendment. If the House does so, I ask the Government to think again so that when the Bill goes to the other place the word "necessary" can be deleted.

§ Mr. Shepherd
I am grateful to my hon. Friend the Member for Ryedale (Mr. Greenway), and I am concerned.
I made out a case which I tried to get to the Whips because I understand the urgency with which the Government have to manage their programme. These were detailed arguments, but they were not addressed in detail. I am genuinely disappointed by the points made about the word "necessary". I hope that the House will have to return to the matter; the Lords will take an interest in this.
The Government moved favourable amendments—I congratulate them on that—as a consequence of the Lords taking a view on certain parts of the Bill. I have no doubt that our liberty is in the interstices of the details of Bills such as this. The matter is extremely important which is why I should have liked a more sympathetic response. The Government have moved some of the way, but I ask them to reflect on what that simple word "necessary" means to the burden of the argument as contained in the clause. Accordingly and with the advice and guidance of my good and hon. Friend, I beg to ask leave to withdraw the amendment.

§ Amendment, by leave, withdrawn.