THE COMMISSIONER AND THE TRIBUNAL (Hansard, 5 April 2000)

§ Mr. Shepherd
I beg to move amendment No. 177, in page 58, line 42, leave out paragraph 19.
Schedule 2 makes the commissioner subject to a new prohibition on disclosure of information about to come into force under the Data Protection Act 1998. The commissioner and her staff would face criminal charges for disclosing certain information under the Bill. Disclosures could be made only if they were "necessary" for their functions or "necessary" in the public interest. The "necessary" test is a strict one which may prevent disclosure by the commissioner in many circumstances. The present Data Protection Commissioner, who will become the first Information Commissioner, has expressed concern.
Under section 59 of the Data Protection Act, the Data Protection Commissioner is subject to a statutory prohibition on the disclosure of certain information. Schedule 2(19) of the Bill extends that prohibition to the Information Commissioner. The effect may be to prevent the commissioner and her staff from disclosing information about how or whether they are handling particular complaints, where this involves the release of information about identifiable businesses. That may become relevant where an authority has refused to disclose information about a particular company to an applicant.
In some cases, businesses may be public authorities in relation to certain functions. For example, under clause 4(1)(a), private bodies with public functions can be brought within the scope of the Bill by an order in relation to specified functions. That might apply to companies such as Group 4 in relation to prison contracts. The registrar has disputed this view because article 28.7 of the data protection directive states: Member states shall provide that the members and staff of the supervisory authority are to be subject to a duty of professional secrecy with regard to confidential information to which they have access. However, the Data Protection Commissioner has said: The Registrar does not believe that the Directive requires the criminal provisions provided by clause 54 [now section 59]. She believes that the existing law combined with appropriate conditions and staff contracts will satisfy the requirements of Article 28.7.
Whatever the legal position in relation to the Data Protection Act, the offence cannot be required in relation to the commissioner's freedom of information functions. That is relevant to the arguments that were adduced by hon. Friend the Member for Surrey Heath (Mr. Hawkins) a few minutes ago, as those functions do not flow from the directive or other Community obligations or assert the primacy of Community law over our domestic legislation.
The rationale for extending the offence appears to be based merely on an unnecessary preference for consistency. I shall not read out the prohibition on disclosure in section 59 of the DPA, which will apply to the Information Commissioner, as I know that the Department is well apprised of the matter.
The effect of that provision is to expose the commissioner to risk of prosecution if she discloses information obtained under the Freedom of Information Bill about an identifiable individual or business—the 1050 latter will be the real issue—without their consent, unless the information was supplied in order for her to publish it or the disclosure was for the purpose of legal proceedings. In any other circumstance, the commissioner would have to show that one of two conditions could be met.
The first is that the disclosure is "necessary" for the discharge of any of the commissioner's functions. It is a strict test. If the function can be discharged without releasing the information, disclosure may not be necessary. It may not be possible to show that it is necessary for the commissioner to identify a company that opposes the disclosure of information about defective products, safety problems or discriminatory employment practices, if the commissioner can still discharge her function by referring to it anonymously.
The second condition is that the disclosure is necessary in the public interest, having regard to the rights, freedoms or legitimate interests of any person. This would no doubt protect a disclosure made to the applicant or someone else with a direct interest, but it would leave open the possibility of an offence if disclosure were made to the press or public generally. Again, the problem is that "necessary" means that the rights, freedoms or legitimate interests of any person would be harmed if the information could not be disclosed and that that would be contrary to the public interest.
8.15 pm
Disclosure in the interests of the accountability of the authorities to whom freedom of information requests are made, or the accountability of the commissioner herself, may not pass the "necessary" test. A purposes clause which made clear that the Bill was intended to promote accountability could provide some statutory safeguard. However, the Government have resisted such a provision.
The most objectionable element of the restriction is that it contains no "harm" test. The offence is not limited to the disclosure of trade secrets or commercially damaging information, but could be caused by a harmless disclosure of information about an identifiable business. The perverse consequence would be that information about a business which an authority would have to disclose under the Bill, because it did not reveal a trade secret or prejudice the commercial interests of the business concerned, could result in the commissioner being convicted of a criminal offence if she disclosed it.
At the time of the Data Protection Bill's passage through the House, the registrar commented: The effect of clause 54— which is now section 59— is potentially to criminalise disclosures of information relating to an identifiable business in circumstances where it could not sensibly be maintained that this could cause any harm. For example, where a journalist queries the lawfulness of a company's processing activities, a member of the Commissioner's staff could commit a criminal offence simply by confirming that the company had discussed the processing in question with the Registrar because this disclosure is clearly not absolutely necessary for the discharge of the Commissioner's functions under the Act. The Registrar has always sought to be as open as possible with the Press. She is aware of no evidence that this has caused any individual or company significant harm. She is therefore concerned that this clause could require her and her staff to be unnecessarily guarded in future. 1051 Such a restraint on the Data Protection Commissioner's dealings with the press would be undesirable; to restrain the Information Commissioner would be unthinkable. It could undermine her ability to explain the basis of her approach. Any suggestion of secrecy on the part of the commissioner could damage the credibility of the legislation itself.
During the Data Protection Bill's passage through the House, the Government suggested that the Data Protection Commissioner's general power to disseminate information—the Information Commissioner would have the identical power—would protect the commissioner in making the necessary disclosures. However, the Minister himself suggested that this would allow the publication of "anonymised" information, implying that the disclosure of company-specific information would be constrained.
A similar general power to publish information, coupled with the specific prohibition of disclosures, appears in the Health and Safety at Work, etc. Act 1974. The Health and Safety Commission and the Health and Safety Executive have long maintained that it prevents them from disclosing information obtained under their powers unless disclosure is strictly necessary for health and safety purposes.

§ Mr. Dalyell
I apologise for interrupting the hon. Gentleman, who is making a very well-sculpted speech, but could he share with us whose view this is? He is reading out a highly technical, carefully worded legal view. Whose view is it?

§ Mr. Shepherd
I am grateful to the hon. Gentleman for raising that point. Of course it is the view of the Data Protection Registrar, as was. It was put forward during the DPA's passage through the House, but it did not obtain a satisfactory response. That is why it has had to be raised again. I apologise to the House for the sheer technicality of the explanation, but we never succeeded in getting a Minister to focus on it. I gave Ministers advance notice of my previous endeavours to raise the matter and I accept that it is highly technical.

§ Mr. Lock
May I speed things up by saying that I have seen the freedom of information brief, that the hon. Gentleman can assume that I am aware of what it says, and that I shall respond to that brief as to his speech?

§ Mr. Shepherd
I was referring to the earlier stages when the Data Protection Bill was passing through this place. This speech is almost a repeat of the previous speech so it is in the machinery of Government, and the Whips Office has it—the Minister may relax.
It was hoped that the debate would not be a dialogue of the deaf, in which I would read a highly technical script and the Government would brush it aside. There is a point of importance in this, and, in that sense, I am grateful for the Minister's intervention. If he has something material to say, I shall conclude my speech. He has the information; he has the brief; he is apprised of the argument; and we would like a response and action.

§ Mr. Lock
I shall not detain the House by explaining the background to the debate and the purpose and effect 1052 of section 59 of the Data Protection Act 1998, other than to say that it requires the Data Protection Commissioner not to disclose information save in specified circumstances. Section 59 is required by article 28(7) of the European data protection directive, and—this may be a crucial point—schedule 2 of the Bill applies the relevant parts of the Data Protection Act 1998 to the Bill; and paragraph 19 of the schedule extends the duty of confidentiality and the related offence in section 59 of the DPA to information obtained by the commissioner for the purposes of the Bill. The effect of amendment No. 177 would be to disapply that extension.
I heard what the hon. Member for Aldridge-Brownhills (Mr. Shepherd) said, but the Government's view is that the amendment would lead to an impossible situation for the commissioner and her staff, because we do not believe that it is possible for section 59 to bite for one regime and not for another. We have already said that we believe that the vast majority of requests for information and, consequently, complaints to the commissioner, will involve both personal and non-personal information. Therefore, the information obtained by the commissioner will not fall neatly into one regime or the other—one to which section 59 would apply, and another to which it would not. So, because we have to have section 59 for the purposes of the data protection regime, the only practical way forward is to have it also for the purposes of the freedom of information regime.
However, the Data Protection registrar expressed two concerns. She has expressed concern, first, that she would be unable to share information with other investigatory bodies—such as various public sector ombudsmen—which she may have been in contact with in the course of investigating a complaint; and secondly, that the prohibition on disclosure without lawful authority could act to prevent the commissioner from disclosing the fact that she had received a complaint and that she was investigating it, which would be contrary to the principles of freedom of information.
I tell the hon. Gentleman that we have listened very carefully to both those complaints. We accept the strength of the argument for an amendment to the Bill to allow information to be shared by and between the commissioner and other proper regulatory investigatory bodies, and we shall table an amendment to that effect in another place to deal with that perfectly legitimate concern.
We have considered the second objection, and we are not satisfied that schedule 2 would have the effect claimed. From the Government's perspective, nothing in the Bill seeks to prevent the release by the Information Commissioner of information about the handling of complaints where that disclosure was made with the consent of the individual or company to whom the information, obtained in accordance with section 59 of the Data Protection Act 1998, relates.
I have heard the hon. Gentleman's argument, but where information is sought, the application has been made and the person making the application does not wish it to become public at that time that they are making the application, in the Government's view it is right that the Information Commissioner, who is carrying out a statutory function on behalf of that individual, should not be able to overrule that view and routinely disclose the information that she was looking into that complaint. The Information Commissioner's office is not intended to be 1053 an alternative source of information that is available under the Bill for public authorities, and there is no need for the commissioner to disclose information obtained from a public authority if that information is obtainable under the Bill.
Furthermore, the commissioner can lay reports before Parliament about the exercise of her functions under the Bill and will do so, as clause 49 provides. Any disclosure of information in such reports would obviously be done for the purpose of, and be necessary for, the exercise of the commissioner's functions, and there would therefore be lawful authority for that. If the commissioner is worried about any matter that comes up in an individual complaint, the right body to report it to is Parliament through the laying of a report under clause 49; it would not necessarily be right for the commissioner to report the matter to the press against the view of the individual who was submitting the complaint.
Thus we accept that section 59 of the DPA will inhibit the exercise of the commissioner's functions save in the one respect that I have mentioned, and the Government will table an amendment in the other place. I acknowledge the problem, and the balance that has to be struck, but I hope that that concession concerning the operation of the interrelations between the commissioner and other regulatory bodies is enough to satisfy the hon. Gentleman that we have taken the issue seriously and cause him to ask leave to withdraw his amendment.

§ Mr. Shepherd
I am very grateful to the Minister for his detailed reply. There clearly is a conflict in the understanding of what is happening here. I am not the arbitrator on this, but my instinct is that when the former registrar, who will be the commissioner, has an anxiety about a matter, that must be weighed most carefully. I hope that, during the Bill's passage through this place and another place, the Minister will reflect very carefully on other representations that will undoubtedly be made to him.
In the spirit and light of the observations that he and I have made, I beg to ask leave to withdraw the amendment.