Data Protection Bill [H.L.]

HL Deb 20 January 1983 vol 437 cc1551-85

4.45 p.m.

Second Reading debate resumed.

Lord Wigoder

My Lords, I sense all around me a determination and an anxiety to proceed with the debate on the Data Protection Bill. When Liberals heard that there was to be legislation on this subject, we hoped that it would achieve three separate objectives. First, that anyone holding data about other people should be placed under a firm obligation to ensure that those data were accurate, were properly safeguarded and were not misused; and that there would be a way of effectively enforcing that obligation. Secondly, that the citizen should in general have the means available to him of ensuring that the data were accurate; that if not accurate they were rectified; and that if not rectified, or no longer needed, they should be destroyed. Also, that there should be an effective way of enforcing that right.

Thirdly, we hoped that the Bill would provide that, so far as possible, business efficiency through increased computerisation and mechanisation would be encouraged rather than hampered; and, in particular, that no barrier should be raised to international industrial co-operation or international trade because of any inadequate data protection system in this country. Against those objectives, one is bound to agree with the noble and learned Lord, Lord Elwyn-Jones, that this Bill falls far short. It does not achieve very much. Indeed, it does not try to achieve anything more, so far as one can see from the Bill, than the bare compliance with the terms of the European Convention.

We must take this Bill on the terms offered. There was much eager anticipation that there would be a comprehensive measure for the protection of privacy. This Bill does not set out to achieve that purpose, and does not claim to do so; and it may be difficult for us at later stages in this Bill to amend it in order that it might in fact do so. If I may say so on a personal note, this Bill remains one of the most difficult Bills to discuss that I have ever read. I felt at times that I was in the position of trying to attack a jellyfish with a wad of cotton wool. On examination, I came to the conclusion that the reason why I felt this difficulty was the fundamental problem that nobody in your Lordships' House really knows what it is that we are talking about. I can understand anyone who adds, sotto voce, "speak for yourself.

The real problem that arises in this Bill is that in many ways the crux of it lies in the regulations which the Secretary of State is taking power to make, and as to the content of which none of us at the moment has any idea. May I give one or two illustrations of that? In Clause 2(3), (4) and (5) the Secretary of State takes power to look at the principles that are so important and are set out in the schedule. The Secretary of State may then by order modify or supplement them, provide additional safeguards, modify not only the principle but also the interpretation of the principle as set out in another schedule, and make different provisions in relation to data consisting of information of different descriptions.

In Clause 4(7) the Secretary of State takes power to make orders to vary the particulars to be included on the register in due course. In Clause 29(1)—a crucial clause in many ways where the protection of data is concerned—the Secretary of State has power by order to exempt from the subject access provisions or to modify the provisions relating to the physical or mental health of the. data subject. In subsection (2) he has powers similarly to make orders exempting other organisations in relation, for example, to social work as distinct from physical or mental health. Finally, in Clause 32(1) the Secretary of State takes further powers to exempt from the subject access provisions personal data consisting of information, first of all, where the disclosure is prohibited and, secondly, where it appears to the Secretary of State to be of a confidential nature of a particular sort.

How this Bill is going to work in due course will depend vastly on the orders and regulations which are made under it by the Secretary of State, and I do hope that when the noble Lord the Minister comes to wind up this debate he will recognise that it is very, very difficult to ask your Lordships to treat this "jellyfish" as a pig in a poke and to support the Second Reading of a Bill which gives such vast discretionary powers in due course to the Secretary of State, without some clear indication at this stage of what it is the Secretary of State has in mind under these various clauses, what form of orders he proposes to lay and what matters he proposes to deal with.

That is one of the difficulties that I felt about this Bill when I read it. The other difficulty is, of course, that although there was much talk in Lindop and again in the White Paper about codes of practice playing a crucial part—and indeed Lindop did suggest statutory codes of practice—we are left at the moment completely in the dark as to whether there are to be codes of practice, and if they are to be on a voluntary basis we have no idea at this stage what they might contain.

In that situation this is a difficult Bill to debate in any constructive way. Perhaps it is fair to say that, even in the state in which it is. without knowing what the orders are or what the codes of practice may contain, clearly, serious problems will be raised. I would rather not deal in general terms with those problems but take them in relation to one particular organisation of which I have knowledge, not in order either to advertise that organisation or to indulge in special pleading, but because there are problems which we shall face in that organisation which will be similarly faced by many other sections of industry.

Therefore I refer, if I may, to the private medical insurance body called BUPA, of which I happen to be chairman. I begin with this proposition; Inevitably we have on computer a vast amount of personal data. It is personal data that concerns the medical and personal history of our subscribers. We also have, because we do screening for prevention purposes, a vast amount of computerised data that comprise diagnosis and prognosis of the various patients who are seen at those centres.

The first matter that arises is this: most of that information is on files and it goes to the computer from the file. There is—is there not?—something logically absurd about placing us in the situation in which, if the information has gone from the file to the computer, then all the provisions of this Bill will apply, and if it is still on our file and has not yet been passed to the computer, then none of the provisions of the Bill will apply. Indeed, one can extend it by saying that there is a very large quantity of personal data contained in the files of hospitals and doctors which is not at the moment subject to computerisation but where some control is clearly necessary in the interests of security and in the interests of the proper and accurate compilation of those records.

There appears to be an absurdity about the refusal of the Government to extend this whole question of data protection to data whether manual or computerised, and to limit it in the way the Government have in this Bill solely to computerised information. The second problem that we shall face, as will many others, concerns precisely what is meant by the definition of "data" in Clause 1(2) of the Bill. The word is defined there as meaning— information recorded in a form in which it can be processed by equipment operating automatically in response to instructions given for that purpose". In fact, with the rapid development of computer technology, almost any information can be processed in that way or is likely to be able to be processed in that way in the very near future.

May I give a simple example?—a letter from a consultant to a general practitioner or from one of our medical centres to a general practitioner, setting out the diagnosis of a patient. That letter, as I understand the definition, can be processed by equipment operating automatically and thus come within the provisions of Clause 1. There is no difficulty about that. There are internationally recognised codes for classification of diagnosis and there would be no difficulty at all about bringing that within the provisions of Clause 1(2). It is, of course, of crucial importance to the medical profession as well as to ourselves—and no doubt we shall hear further about this in the course of the debate—because under Clause 21(1)(b) there may be circumstances in which the medical practitioner or the insurance company may be obliged to disclose the contents of the report to the subject, the patient, upon whom the report is made. That clearly will give rise to very serious difficulties unless a rather more accurate and precise definition of Clause 1(2) can be reached.

Indeed, one takes it a little further. Does the definition apply—and I do not pretend to know the answers to these questions—to microfilm equipment, which can in fact be retrieved through the use of buttons and keys? Does it apply to word processors in certain circumstances? Does it apply to electronic mailing equipment? These are all matters which cannot be dealt with by the simple definition offered to us in Clause 1 as it stands.

I refer to the problem that will face anyone who has information about the medical condition of a patient or of an insured person, and of course it is against that background that Clause 29 becomes so very vital. I have already referred to the fact that Clause 29 provides for the Secretary of State by order to exempt from the subject access provisions information as to the physical or mental health of the data subject. I think it is essential that before this Bill goes very much further the Government should make it perfectly clear what they have in mind, in particular in relation to the physical medical health of the data subject. It happens frequently with my own organisation, for example, that we have to ask a subscriber's doctor, with the subscriber's permission of course, for an up-to-date medical report. The doctor notifies us maybe that the patient has a malignant tumour. The doctor may well say to us, of course, that it is very undesirable that the patient should know about this matter. Will there, under the Bill, be a right by the patient to access to those records, or would it perhaps not be better to amend the Bill very firmly to ensure that the right of subject access, which is highly desirable in general terms, should be excluded when it relates to medical information which has been disclosed in confidence, and where the medical practitioner certifies that it might be harmful to the health of the patient for that information to be disclosed?

Again, it goes further than that in relation to medical information, because of Clause 28, which has been referred to also by the noble and learned Lord, Lord Elwyn-Jones. Under that clause it appears that, in certain circumstances, medical information may be released, indeed must be released, to the police. That again requires careful consideration, and perhaps some guidelines from the British Medical Association as to its propriety. If medical information is to be released to the police for any purposes, it is surely necessary that there should be safeguards; that the police should be made to undertake that it will not be used for any purpose other than the one for which it was obtained and that it will be destroyed when it is no longer relevant.

One other aspect of disclosure of information to the police that I might mention, curiously enough deals with the reverse side of the matter. There may very well be occasions when bodies, such as that to which I have referred, will want to disclose computerised data to the police I am not now talking about medical data—in order to assist the police, and may be prevented from doing so, as I understand it, by the terms of the Bill. For example, fraud cases are not unknown in insurance circles. It may be highly desirable that an insurance company should want to disclose its data about a particular person in those circumstances in order to assist the police with their inquiries into such a fraud. Yet, in regard to the third principle, it looks as though the insurance company concerned would be in clear breach of principle if it sought to do that.

Indeed, the third principle provides that data should not be disclosed in any manner incompatible with the purposes for which they are held, unless it is proposed to go to the interpretation part of the third principle in the second schedule and say, in effect, that that of course is all right, provided one has registered that that is a purpose for one's obtaining the data. As I understand it, that would mean that if any organisation felt that at any time it might wish, in order to prosecute someone, to disclose personal data to the police, it would have to register under the Bill that one of the purposes of its holding the computerised data was for the purpose of assisting the police. If I may say so, that seems to me to make an absurdity of that part of the matter.

There are many other points that I would wish to deal with. Perhaps I may be forgiven if I deal with them at a later stage rather than now. The question raised by the noble and learned Lord, Lord Elwyn-Jones, about the totally inadequate powers of the registrar; the question as to whether written references that happen to have been computerised would be made available to the subject of the references; the question of the status of children, whether children should be given a right of access to their records or whether parents ought to be given a right of access in certain circumstances to their children's records—all these are matters to be considered with some care when we come to Committee.

I have perhaps said enough to indicate for the moment that I would find it a little difficult to give unqualified support to the Bill at this stage. I console myself with two thoughts. One is that I think I shall be in good company, and the second is that we shall have the opportunity, in due course, of seeking to improve this Bill. For the moment, I am grateful to the noble and learned Lord the Lord Chancellor for the elegant way in which he introduced the matter, and particularly for his introductory remarks referring to a current television programme. I hope that your Lordships will forgive me if my answer at this stage is a resounding, "No, Minister".

5.7 p.m.

Lord Hunt of Fawley

My Lords, this Bill is about how data can be collected, stored and protected by many people from many different professions and in other parts of our work. In my profession, the medical profession, we have relied on the Hippocratic oath for more than two thousand years. It has done us extremely well, in that anything private between doctor and patient, which it is important should remain strictly private, cannot be divulged for any reason. But modern civilisation has led to a breakdown of this. As time is running short, I will give just one good example. A doctor has a patient who is the driver of a train. He suddely discovers that this patient is developing epileptic fits. He has, for the safety of hundreds of passengers, to tell the railway authorities about this. That is a strict violation of the Hippocratic oath but is essential under modern conditions.

For this reason, very few medical students now take the Hippocratic oath. I myself took it 50 years ago but I left out several clauses with which I did not agree. I have discussed this matter with a great many people, including the noble Lord, Lord Wigoder, and many of my colleagues, and we believe that it cannot be changed and improved. We want something new, and I myself very much hope that this Bill will be the new something that we are looking for.

The Bill contains a great many clauses. I believe that too much stress has been laid on computerised medicine and computerised detail and not enough on manual collection. We have more than 20,000 general practitioners in this country, with their accompanying health centres, group practices, nurses, and so on, and all of them are making notes about patients. More than 95 per cent. of those notes are manual and not mechanical. I do not believe that the Bill stresses this enough. I very much hope that the parliamentary draftsmen on the next draft will take this into account and perhaps lay more stress on the manual collection of material than on mechanical collection. This manual collection is very important. It is much more important than the other at the moment, and we must not forget that. Time is getting short, and that is all I have to say.

5.10 p.m.

Lord Smith

My Lords, to a doctor, this Bill reveals certain potential dangers to patients and I think I might put some of them briefly before your Lordships. I have used the phrase "potential dangers" because I am sure that the Government will have foreseen these risks and will have planned to avoid them. It is the duty of any persons responsible for keeping medical information to keep it safe, and this Bill should be used to place a statutory responsibility upon them to do so. Furthermore, I believe that the data on manual as well as on computer systems should be included.

Any form of legislation in this field, including statutory instruments, should have the positive approval of Parliament. The same criteria for safeguarding information must apply to the public sector as to the private sector, and there must be no transfer of medical information to the police without the patient's knowledge.

Though the majority of doctors regret that a data protection authority will not be set up, as envisaged by the Lindop Committee, they would support an independent registrar reporting to Parliament via a Select Committee. No doubt the registrar will be independent of Government and, perhaps, appointed in the same way as the Parliamentary Commissioner for Administration—the ombudsman.

It is very important that the registrar's duties, as well as his powers, are specified clearly in any legislation. He must be required to initiate action where necessary; for example, the registrar must have powers to initiate court proceedings on behalf of individuals. To give advice to the registrar, I believe that an advisory health team, comprising medical and lay representatives, should be set up and a good case could be made out for setting up an appeals tribunal whose members had a knowledge of health care ethics. At the Committee stage of this Bill, we shall be able to make sure that the dangers to patients are avoided. But I am certain that the Government have a grip on this situation and, for that reason, I am sure that most doctors will approve of this Bill.

5.13 p.m.

Baroness Trumpington

My Lords, may I first apologise for the fact that, owing to a long-standing engagement, I shall not be able to listen to what will, no doubt—prodded by the words of my noble and learned friend the Lord Chancellor—be a magnificent speech from my noble friend the Minister. May I also say that I listened with great respect to the words of my noble friend Lord Hunt of Fawley, and with pleasure to the noble Lord, Lord Smith, who spoke so eloquently and with such authority for, I believe, the first time since his illness.

When I had the honour to second the Motion for a humble Address in reply to her Majesty's most gracious Speech at the opening of this Session of Parliament, I particularly welcomed the Government's proposals for the Bill which is before us today. I said: It is essential that those responsible for these [data] files should make sure that the undeniable advantages that they can obtain from automatic data processing do not at the same time lead to an undermining of the personal privacy of the individuals about whom data is stored." [Official Report, 3:11:82; col. 8.] I believe that we all recognise the importance of this subject. Many of us would wish to see this Bill go somewhat further, so as to extend at least some of its proposals to, for example, manual records.

But there is another aspect to which I wish to draw attention. It is the question of the sanctions proposed by the Bill for its effective enforcement. This Bill creates at least six new criminal offences—probably more. At any rate, Clauses 5, 6, 10, 12, 15 and 16 all contain provisions which say that non-compliance with what is laid down will constitute a criminal offence. So far as I can see, none of the things which are to be prohibited are things which ought to be allowed, bearing in mind what this Bill sets out to achieve. In other words, I have no quarrel with the subject matter of the prohibitions in those clauses. But what I venture to question is whether it is really necessary to invoke the awesome majesty of the criminal law in every case, in order to give these prohibitions the force of law. For example, the very first penal sanction in the Bill is found in Clause 5(1), which states: A person shall not hold personal data unless an entry in respect of that person as a data user, or as a data user who also carries on a computer bureau, is for the time being contained in the register. Noble Lords who are members of the legal profession will know what I mean when I say that this clause creates an offence of strict liability; that is to say, no criminal intention is required to be proved in order that there should be an offence under this clause. Elsewhere in that very clause one finds a requirement—a very proper requirement, let me emphasise—that a data user, or, in other words, the firm with the computer, shall not use computerised personal data for any purpose, other than the purpose or purposes described in the entry, in the register. Quite right, too!

But what of the sanctions? These are found in Clause 5(5), which is somewhat revealing. It states, Any person who contravenes subsection (1) above or knowingly or recklessly contravenes any of the other provisions of this section shall be guilty of an offence. Your Lordships will be quick to gather that the Bill draws an important distinction between an offence under Clause 5(1), as compared with other offences under Clause 5. For all the other offences under the clause, including the one I mentioned of improper use of data, it is necessary to prove that what was done wrong was done "knowingly or recklessly". No such requirement applies so far as concerns the offence under Clause 5(1)—holding personal data without being registered. There liability is split.

Some of us are alarmed at the growth of the use of offences of strict liability, of which this is but one example. Indeed, some of us are worried at the apparently inevitable use of criminal sanctions, sometimes requiring criminal intent in one form or another, sometimes requiring none, which seems an inevitable concomitant of almost any Bill these days. The time has surely come for us to question and to challenge this onward march of the criminal law. Is there not some other way in which Parliament might prohibit and regulate, without having always to resort to the draconian sanctions of the criminal law?

This is a subject which has caught the attention of a number of worthy bodies in recent times. In 1980, Justice, the British section of the International Commission of Jurists, published a report entitled Breaking the Rules, which advocated the introduction into the law of a new category of transgression, which they referred to as a "contravention". They said this: … drawing a formal distinction between crimes and contraventions in English law would go some way towards increasing respect for the remaining truly criminal part of that law, and that would be an important benefit". A little later on, Justice said in its report: In future legislation, Parliament would need to apply its mind specifically to the question whether new categories of conduct to be regulated should be made crimes or contraventions, and provide accordingly". I agree with Justice about this, and wonder to what extent Parliament ought to try, in the context of this very Bill before us today, to explore the possibility of making some of what are in the Bill criminal offences into what Justice calls contraventions.

But they are by no means the only ones to put forward that point of view. In 1981, the Justices' Clerks' Society published a report entitled Decriminalisation—an Argument for Reform. Your Lordships will appreciate that justices' clerks are better able to judge than practically anybody else what should or should not be made a criminal offence. The society argued that: a large section of the population does not regard most of the recently created offences as 'crimes'. The view is growing that these offences are not indicative of the sort of evil of mind that justifies criminal prosecution. Most regard such offences as mere 'contraventions', deserving of penalty but not the stigma of a criminal conviction". As an ex-magistrate, I certainly agree with this assertion. On page 11 of the explanatory report of the Council of Europe concerning the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, we read: It should be noted that the convention gives clear and precise indications on the purpose to be achieved by each principle, but leaves to each party the manner of implementing it in its own domestic law". Finally, the Consumers' Association, the publishers of Which? and champions of worthy causes, including at least one which is close to my heart, published a book entitled Towards a Middle System of Law. They take the argument a little further and actually spell out the kind of sanctions which we in Parliament could introduce into legislation like this if we felt that it was not always appropriate to use the criminal law to give the force of law to what we are enacting. The Consumers' Association put it this way: Nowadays practically anything can be a crime. The statute book consists of thousands of things which Parliament has decided to prohibit, for one reason or another. Each year they add a lot more. It is debatable whether some of these things need to be forbidden at all. That is another argument. But is it really necessary always to make a crime of something that has to be prohibited or controlled, saying it is a crime if you don't comply? What else could be done? The answer at the moment is nothing. Either it is a crime or it is legal". A little later in their book the Consumers' Association ask what would happen to these regulatory offences if they ceased to be crimes. The answer they give, and I will quote it, is this: They would become infringements or contraventions or transgressions of a new legal system—the middle system of law. In future, people who broke this type of law would be liable to a civil penalty instead of a fine or imprisonment under the criminal law". All this makes good sense to me, and I suspect that it might make good sense to a large body of opinion in this House. If it makes sense to us, why do we not apply that good sense here and now to this very Bill? If we are to start somewhere, why do we not start today?

In conclusion, let me return to the sanctions that are in this Bill. Clause 21 gives to the ordinary citizen the right of access to personal data held by data users about him. It is a very important right and I greatly welcome it. But what is the sanction? It is found in subsection (8) of Clause 21. This gives the citizen the right to get a court order compelling the data user to provide information about what the data user has stored in his computer about the citizen. That is all very well, but does it go far enough? Ought there not to be some more powerful sanction to support this important provision?

I appreciate that, in the context of this Bill, I have raised a huge question. But it is one that this House and Parliament in general ought to face. I think we ought to listen to what worthy bodies such as those I have quoted are saying and apply it to legislation that is before us. There is no time like the present.

5.25 p.m.

Lord Hatch of Lusby

My Lords, for the first time since I entered this House I have to start with a similar apology to that just made by the noble Baroness, Lady Trumpington. Before the Second Reading of the Bill appeared on the Order Paper I had contracted to attend a meeting at six o'clock this evening. I shall be extremely brief. I hope, however, that the speakers who are to follow me will not follow my example, so that I may get back in time at least to hear the noble Lord the Minister who is to reply. I apologise to the succeeding speakers, and if I am unable to be here when the Minister winds up I apologise to him also.

I should like to select three of the principles that were read out by the noble and learned Lord on the Woolsack at the beginning of the debate. Principle 2 states that personal data shall be held only for one or more specified and lawful purpose. Principle 3 states that personal data held for any purpose or purposes shall not be used or disclosed in any manner incompatible with that purpose or those purposes. Principle 7—this is from Part I of Schedule 1 on page 28 of the Bill—states: A data subject"— in plain English, a person— shall be entitled—

1. (a) to access at reasonable intervals and without undue delay or expense to personal data of which he is the subject; and
2. (b) where appropriate, to have such data corrected or erased".

I select those principles because of the one point, and the one point alone which I want to make in this Second Reading debate on the Bill. That refers, as my noble and learned friend Lord Elwyn-Jones pointed out in his opening remarks, to Clause 28 on page 21 of the Bill. Over the last few years—indeed, some of us would say going back for the last 15 or perhaps 20 years—we have seen a trend, emanating in particular from this Government but also to be seen in previous Governments, including those of my political complexion, towards categorising different forms of citizens of the British Isles. We have seen a trend towards first, second and third class citizenship. I am afraid that this trend is continued in the Bill. In the Nationality Act, in the immigration regulations and in the treatment of overseas students we have seen a very clear move towards separating citizens of this country who have different skin colours.

Exemptions are stated in Clause 28 for those who may not have the privilege of the principles which I have quoted. Those exemptions will be those people whose personal data will not be sacrosanct and those who will have only a limited opportunity to examine their own personal data. They are designated as being affected by:

1. "(a) the prevention or detection of crime;
2. (b) the apprehension or prosecution of offenders;
3. (c) the assessment or collection of any tax or duty; or
4. (d) the control of immigration".

I believe we all have to accept that when the word "immigration" is used in law, by the media, or in this House it is very widely accepted by the public that "immigration" refers to people with non-white skin colours; very largely, I say. To some of us it is offensive to link together the question of the control of immigration—which, let us be frank, means very largely the immigration of coloured people into this country—with the offences mentioned before:

1. "(a) the prevention or detection of crime;
2. (b) the apprehension or prosecution of offenders;
3. (c) the assessment or collection of any tax or duty".

It is offensive to link the control of immigration with such offences. As my noble and learned friend Lord Elwyn-Jones pointed out in his opening remarks this afternoon, we should warn the Government Front Bench and in particular the Government Chief Whip that we shall keep them up for a very long time at Committee stage in order to remove this offensiveness.

When we think of the wide openings which are being made in the protection of the individual, irrespective of his skin colour, by the inclusion in this clause for the control of immigration we think also of the way in which this exemption can be used against people some of whom are citizens, and many of whom wish to become citizens, of these islands. I hope that the Government will recognise that a considerable section of the population of the British Isles will share my sense of offence that this aspect has been included in this way.

At Committee stage we shall have the opportunity of probing into this more deeply and of giving the Government examples of the kind I am sure they can find for themselves of how this could be used; of how we are discarding the protection of the law for a large number of the citizens of this country. It is on that point alone that I wanted to contribute to this Second Reading debate, with the warning that some of us on this side of the House, and I hope some on the other side of the House, too, see how offensive this subsection of Clause 28 is, and we hope they will help us at Committee stage to convince the Government that it should be removed.

5.35 p.m.

Viscount Colville of Culross

My Lords, I hope that the noble Lord, Lord Hatch of Lusby, will forgive me if I do not follow him on that particular subject and also if I do not speak for one and three quarter hours, in order to allow him to return from his meeting to listen to my noble friend; my modest notes would have to be stretched considerably beyond my capacity.

I well remember the beginning of the process on the subject of privacy to which the noble and learned Lord, Lord Elwyn-Jones, has referred, because I was at the Home Office at the time when the Younger Committee was reporting. I believe it has been gradually accepted since then that the first approach should be on the question of computerised data. Therefore I am not surprised and I am in no way disappointed that this Bill should concern itself with this particular matter. At the very least, my noble and learned friend the Lord Chancellor has pointed out the advantages of bringing ourselves within the European Convention so that we may gain the international advantages that will obtain as a result of ratification and implementation of that convention, and I would have hoped that your Lordships would have started off with the intention of welcoming this Bill on the broad basis that that is what it does.

This Bill has given rise to a substantial volume of correspondence, consultation and thought. There is no reason why one should not go wider than the terms of the European Convention itself and there is no reason why, for example, the legislation in any municipal jurisdiction should not deal with manual records. On the other hand, the convention itself is perfectly plain in Article 1 that it is intending to deal with automatic processing of information. If your Lordships will be good enough to listen to me for a few minutes, it may perhaps occur to some of you, to follow my train of thought, that this itself is not a wholly simple matter.

I have had an opportunity to discuss these draft clauses on the commercial front as opposed to some of the more specialised areas which have been discussed so far in this debate. I very much take up the point made by the noble Lord, Lord Wigoder, that we must ensure that the provisions of this Bill complement the increase in business efficiency which is a very important part of the commercial and industrial scene today. If I may, and I am afraid that this is without notice, I should like to make a few general points to my noble friend Lord Elton about the practicability of some of these aspects and to ask him a few questions, which I obviously cannot expect him to answer today. However, I believe that some people will be rather relieved if they can think that in due course Parliament will look at matters which are causing some worry.

One of the difficulties has been that the White Paper did not contain very many details of the proposed legislation. It was presented in rather general terms and it was not until just before Christmas that the Bill was printed, which was therefore the first time that many of those involved in the compilation and use of computer data had an opportunity to look at the details of this Bill.

The noble Lord, Lord Wigoder, has given some examples of the type of data which are intended to be comprehended by the definition in the first clause of the Bill. This is fairly important. There is the point that some noble Lords would like manual data as well as electronic data included within the protection of the registration procedure given by the Bill.

Let us for a moment look at what the Bill already comprehends in terms of the definitions it gives. There is in the definitions very broad scope for the electronic collection of material and its subsequent use. The general reaction that I have received in the business world is that the Bill is a fair and reasonable attempt to tackle this. But there is apprehension that, if the definitions remain as they are—and I appreciate that there are difficulties in terms of the convention in constraining them too much—there is the likelihood that a very large amount of unnecessary computer detail will have to be registered and considered by the registrar in the course of the process of setting up his occupation and his register. The timetable for this is set out in broad terms in Clause 38, and we know from the Explanatory Memorandum that the registrar is only going to have 20 staff", so he is not in fact equipped with a very large amount of time or assistance—and I think this is probably right—to allow him to look with a critical eye at a very large amount of unnecessary material.

I will give a few examples of what may or may not be thought to be unnecessary material. As the Bill is at present drafted, it appears to some of us who have discussed the matter that there would be no way in which one could avoid registering a compilation on the computer for purely internal purposes within a company of the payroll of the company, because it inevitably involves more than the name and address of the person. It involves his wage rates, PAYE contributions, national insurance and probably pension contributions as well. Not only would that happen during the period when a person was employed, but it would have to continue during the period when he was drawing his pension, so one would have ex-employees on the register as well.

I am not sure that Her Majesty's Government necessarily wish this material to be registered. I am far from clear that they would wish this material to be open to public access under Clause 9 of the Bill, because I feel fairly certain that, if a rival wished to find out what was the rate of pay in a concern with which it was competing, access to the registry under Clause 9 could be an extraordinarily profitable method of approach. So, not only from the point of view of clogging up the works in the registrar's proceedings but also from the point of view of the desirability of public access, I wonder whether the Government would wish to have that sort of information registered and subsequently available.

There is a very similar problem where you have, as is not uncommon nowadays, a group of companies which have chosen, at any rate at the present, to centralise their accounts on a computer which serves more than one company. There are certainly within the group with which I operate—I do not think I have to declare an interest because it is merely a matter of information—at least three companies where there are a number of subsidiaries, all of which together with the parent company use a central computer for the purposes of a great number of commercial affairs, including the dealings with individual customers, and, of course, the question of whether or not they have paid their bill. In these circumstances, if you have the computer operated by one of the companies in the group and used by a number of others, as I read the draft legislation in the Bill, we have a situation where the central company will probably have to register itself as a computer bureau and all the other companies individually will have to register themselves as data users, all in respect of the same data on the same computer under the same jurisdiction. I do not see under the drafting as it stands any way of avoiding this. Nor do I consider that it is necessarily what the Government had in mind when they set the whole matter up, particularly bearing in mind the timetable and the burden of work on the registrar which I have mentioned.

Then, if we have these materials, this data, all available and registered on the computer, there is the point on which I have already touched momentarily about the facilities under Clause 9 for making the information contained in the entries in the register available for inspection by members of the public. Under what circumstances, I wonder, could my noble friend tell me either now or in due course, is this material going to be available? Of course one appreciates at once that individual persons who have their details recorded on data held within a computer ought to be able to look at them, and of course, under the provisions of the Bill, correct them and so on. But that is not what Clause 9 says. It gives, as it were, a completely free rein to members of the public to fish out of the computer almost any information they think fit, and it is not subject to any very substantial safeguards. If the computer contains the sort of information that I rather think it will, and the register therefore provides this as a subject of consultation by the public, a large number of commercial secrets, or at any rate commercially sensitive information, will be open to the public at large, to those who wish to make a comprehensive search of the register.

Lord Mishcon

My Lords, I wonder whether the noble Viscount, with his usual courtesy, would allow this short intervention, which I make only because we are all so anxious to follow very valuable points which he always makes. Clause 9 of the Bill only provides a public right to look at the entries in the register, which will merely show that somebody is using a computer for certain purposes. There is no public right under Clause 9 to look at what is in the computer.

Viscount Colville of Culross

My Lords, the noble Lord, Lord Mishcon, has probably saved my noble friend three and a half sentences in his speech. If that is right, then it would be a very welcome reassurance to some of those who have been reading this Bill, and who certainly have not absorbed the point with the rapidity with which the noble Lord has done. There are genuine fears about this which I am sure one ought to put at rest, because it is the sort of thing which creates the atmosphere which would be antagonistic to acceptance of this legislation as at present drafted. The noble Lord may well be right. I will wait with interest to see what the Government have to say about it in due course.

On the subject of practicability, there is a slightly more recondite point which has been drawn to my attention which I think I do understand, although I am not attempting this afternoon to follow a formally legal line of reasoning. There are, of course, many commercial activities which require, at any rate nowadays, the registration on computers of individual details relating to sales or hire of apparatus. Any large company which operates a computer-based system of this sort, primarily for the purposes of seeing, for instance, that rentals are paid on a television set or something of that sort, is also liable to use the information for other purposes which I think are not wholly illegitimate, such as sending those customers information about further services which may be obtained.

The difficulty arises out of an understanding of the way in which the principles in Schedule 1 are to be interpreted in relation to the registering of information. The principles are, of course, important because the registrar has to pay attention to them in deciding whether or not he will accept the registration, because he is entitled under Clause 7 to refuse if he thinks that the principles are likely to be contravened.

The question really arises of how, in practice, some of these principles are to be construed and implemented in the course of an ordinary commercial activity. For instance, if one hires out a piece of equipment to someone, is one supposed at that particular moment to tell that person of all the possible uses to which one might conceivably put the information which subsequently is to go on to the computer? When one hires a small item of domestic equipment, does one have to tell the hirer, or make the shop assistant automatically tell him, that his name will go on the computer and that he may well be the subject of leaflets which are sent from time to time describing the firm's activities and other services which may be available? Furthermore, does one have to tell him at that time that it is possible that other associated or interested companies will be allowed to use the fact that the hirer is a customer and to send information to him by way of a mail or something of that sort, so that he may be in receipt of further information about the services or equipment that is available?

One must look at the question whether the information contained in the data has been obtained fairly and lawfully, which is the first principle in Schedule 1. No one wants to make heavy weather of this, but it is a matter of clarification of what exactly people will have to do in order to make sure that the registrar will be certain that the purposes to which they propose to use the data will be in accordance with the principles. I am bound to say that on one interpretation—the one that I have just put forward—it could be a little tedious and onerous, not only for the assistant in the shop but also for the customer. However, if that is what is intended, it will have to be done. There is a great deal of clarification which some people would like to have about the way in which this will affect the ordinary, simple, individual commercial transaction in shops dealing with all sorts of different commodities.

Although the noble and learned Lord, the Lord Chancellor said that these principles came from the Younger Report it is, after all, a slight novelty that we have the jurisdiction of a quasi-administrative tribunal being interpreted in accordance with general principles of this sort. I am not in any way opposed to it. It may be that we are halfway to the European type of legislation if we introduce principles of this sort, but if we are to have them in this country I should have thought that we need fairly clear guidelines about the way in which the registrar is to interpret in individual cases the meaning and the import of these principles so that people can know what information they have to provide when they go to the registrar for their initial registration, and for any subsequent changes.

These are a few small practical points. They do not in any way derogate from what I have said about the general welcome to this legislation I have been able to collect from a number of my commercial contacts. However, just as others have had reservations about the rather more different aspects of the exceptions and exemptions, so I think there is for the purposes of acceptance in the commercial world and the ever-increasing use of computers a further need for explanations on exactly how this will work. I hope that in the course of discussion on this Bill in both Houses, but particularly here so that there will be the maximum time for comprehension, we may get that clarification from the Government.

5.55 p.m.

Lord Hankey

My Lords, I was very interested to hear the speech of the noble Viscount, Lord Colville of Culross, because he is always immensely practical while having great legal knowledge and experience behind him. I have learned over the years to appreciate very widely his intellectual approach which is combined with enormous common sense.

I hesitate to intervene in this debate among so many learned Lords, but I think that certain practical aspects of this legislation need to be mentioned. I suppose I must declare a certain interest in that I am a director of one of the larger building societies that has an enormous computer operation covering the whole of the United Kingdom. However, I am not speaking on behalf of that society or of any business or association. What I have to say is entirely on my own responsibility.

Most of industry accepts, as indeed I do, and also the noble Viscount, Lord Colville of Culross, that some legislative framework for the handling and transmission of name-linked data is now desirable, both for its own sake and so that we can co-operate with our partners on the Continent. I am not sure that the Bill gets that framework quite right. I have serious doubts about it. Frankly, I am a little alarmed that the Government should want to set up a huge quango, as the data protection registrar and his office will be, with such extensive powers to licence, control, interfere with and, if necessary, suppress computer users. If ever there was a time when commerce and industry of all sorts should be set free from annoying restrictions, limitations, petty official interference and taxation, surely that time is now.

The Government have performed gallantly to control inflation, but they have been slow to understand and to help solve the problems of industry. Without a re-expanding and successful industry—expanding especially into the new fields that science is opening before us, such as data processing—the Government will never really cure inflation; they will merely have a recession. So much industrial success must now depend on data processing in its wider aspects. The use of computers, as I think has been made clear but I want to say again, is increasing rapidly. Computers are getting steadily cheaper, more powerful relative to their size, easier to install, easier to use and, most important of all, more popular and more widely accepted and understood, particularly by children.

The market changes almost every month as new equipment comes forward and new uses are found for it. All the banks use computers, all the large companies and the corporations. A tremendous number of small industrial organistions of every sort use computers and a great number of small companies use data processors of different types. Private people are buying them for the home. Schools and libraries are using them, and so on. We have heard much today about the way the doctors are using them. Hospitals are using them. The work of the registrar will be absolutely enormous if all this material has to be covered. It is vital that the system should not be crystallised either now or later, otherwise we shall become rigid. That, I may say, is a typical British error in almost every field of activity. As soon as we become traditional—and even this will become traditional in a few years—we are lost and everyone else makes rings round us.

I want to make another rather unpleasant point. Having been a civil servant for 38 years, I know that most officials most often tend to say, "No". I am afraid that the new system will, for that reason, turn out to be rather inflexible and static, and that would be really disastrous. In this area of industry where change is constant and bewilderingly rapid, we really must not create anything like our planning system. All too often companies and corporations hear, "No" from the local planning authority to some proposal which they have put forward. They then appeal to the Ministry; they employ a QC; it costs them £2,000; two years go by; the Japanese or the South Koreans come in and take the market away or the market changes; the item is no longer relevant and our industry suffers. I speak with a certain knowledge of the planning authorities.

If this new quango is equally bad for business in this new field of data processing, it will be very bad indeed for United Kingdom industry for which the official world, anyhow, very often shows little understanding. I speak with some knowledge of the official world. Therefore, I want to press the Government strongly to make the new system more flexible than it is at present in the Bill. I support those who favour civil penalties rather than criminal ones, although I hesitate to say that in front of so many noble Lords with infinitely greater knowledge of these matters than I possess.

I come back to flexibility and I should like to give a few examples. I do not want to be unconstructive and I shall do my best to make a few suggestions to show the type of thing that I have in mind. Let us take as an example the procedures for new registrations and alterations under Clause 7 of the Bill. If new requirenents oblige the data user to apply for a new registration or an alteration of registered particulars—for instance, because he has found a new use for his data processing facilities—he may not know for a period of up to two months whether or not he will be allowed to meet that requirement. This can be seen in Clause 7(1), (5) and (6). A two-month delay could really unduly restrict business activity. Therefore, I suggest that much needed flexibility might be enhanced if the presumption that approval has been given were to be brought forward to the moment when the application was filed with the registrar. We could limit that facility, if we so wished, to those applicants who already appear in the register in respect of previous registrations. Such a procedure would save the registrar's office an enormous amount of interim correspondence and meanwhile the opportunity to act as described in new registration details would be unlikely to be abused by the data user because he would be afraid of being struck off the register.

Then I come to deregistration notices and the power to remove the data user from the register. In order to carry out his supervisory task effectively, the registrar must have the power to prohibit practices which are not acceptable in any shape or form. But removing a data user from the register would be an enormously drastic thing to do; it would bust his business—absolutely bust it. Nowadays there are neither the staff nor the means of paying the staff to do the job in the old way—they are not there and they could not do it anyway. So in contemplating deregistration, the registrar should be asked to weigh up the interests of the data subjects who are likely to be affected.

The Bill makes no mention of the registrar's duty to look after the interests of the data users and to encourage data users to improve their standards. In my view this is very important. It is not a matter of just scratching them off the list. We want the registrar system to make the system better and this idea ought to appear somewhere in the Bill. I hope that your Lordships will think that this is a really constructive suggestion. Somewhere there should be a more explicit statement of the high priority to be given by the registrar towards educating users to achieve higher standards of practice. It would be useful to have that in the Bill.

I now come to what is really a similar point; namely, how do the Government see the role of the registrar? Is it a positive and constructive role or mainly a negative or prohibitive one? After what I have said about officials liking to say, "No" and to operate in that way, your Lordships will see why I am afraid of this distinction. Somehow it ought to appear in the Bill, otherwise we shall not get the registrar leading off with the correct foot.

The Bill is silent as to whether the registrar should use the carrot or the stick. Therefore, I would like it said that one of the duties of the registrar is actively to assist data users and computer bureaux to find ways in which they can bring substandard practices up to an acceptable level, certainly before knocking them off the list. It should be shown in the Bill that deregistration is really only a matter of last resort. Perhaps it would be a useful idea if there could be a conditional deregistration notice and the deregistration would only become effective if improvements demanded by the registrar had not been made within a certain specified time. I ask the Government to mull over this thought in the hope that it may be useful because I believe that it will be useful to industry.

I return to what I consider to be a very difficult point. The Bill as drafted will require the data user to declare all types of published information including that which is readily available in works of reference. I am thinking of Who's Who, the Directory of Directors and so on. There are masses of such documents. This information is already public and by putting it into the computer and saying that it now acquires an enormous sensitivity, we are in danger of making something dangerous to reveal which is already revealed and available to loads of people. There are all the addresses in the telephone directories and the names and addresses in the electoral register. Your Lordships may not realise it, but a great many commercial companies use the electoral register in order to compile lists of addresses, and so on, which they will use. I often wonder—as I know many of your Lordships do—why on earth people write to us with all sorts of brochures saying that one will acquire a mini next week if only one will fill in some form. It is incredible, but that is the way it happens. There is absolutely no point in this work being used to expand the work of the registrar.

In my view some distinction ought to be drawn between sensitive items and items which are already public. I have a hunch that this appears already in the European convention, but I admit that I have not been able to trace the particular clause. If we do not make this distinction, we deprive industry of the scope for self-regulation, which it is very desirable that it should be encouraged to do because it makes industry conscious of the need for good behaviour. It certainly lands on the registrar an enormous quantity of material and expands his costs. Please do not forget that the establishment of this registrar and his office is an extra burden on industry. I see from one of the introductory pages of the Bill that it will cost £650,000 a year, which industry will have to pay.

I fully agree that personal data relating to matters of a racial, religious, political, medical, sexual or penal nature should require registration. There are various other categories which obviously require registration. That I fully recognise, but I should like this to be done in such a way that it hampers industry as little as possible. Perhaps there is a distinction to be made between factual information and inferential judgments based on that information. When one presses the buttons on a video screen and it comes up with a mass of information, it may often contain opinions quoted from some newspaper or person. There is perhaps a useful distinction there.

I hope that your Lordships will not regard this as an unconstructive intervention, but I have very great concern about anything which would shackle British industry in a field which is the subject of so much hope, so much progress, such bewilderingly rapid change, and where our people are making huge strides forward.

6.12 p.m.

Lord Digby

My Lords, this is a Bill that I approach with some trepidation because, although I believe that the Bill is necessary, I also believe that, unless we are very careful, we may find ourselves doing more harm than good. It is an old cliché that legislation too often has the opposite effect to that which Parliament intends. Therefore, although I support the principle of the Bill, I think it is vital that the practices, the practicalities and the effects on individuals should be thoroughly tested at the Committee stage, which I am sure we shall do.

I must confess that my instinct tells me to follow the example of my family crest, which is the ostrich, described by my wife as, "Head in the sand and hope for the best". It is not always an entirely bad principle. However, I was trained as a soldier on the principle that if you did something it was sometimes wrong, but if you did nothing, it was always wrong.

I should like to start by considering the Short Title, which I think is misleading. It is not the data that we wish to protect, but the individuals and organisations from the misleading use of those data. Throughout the considerations on this Bill we must remember that the object is to protect the individual.

I should now like to mention one or two points which concern local authorities—large users of computers—and in particular the Association of County Councils. It will not surprise your Lordships that I start with the financial and manpower implications. The Explanatory and Financial Memorandum envisages implementation costs for local authorities and other public bodies of £9-£11 million in each of the first two years. Our professional advice is that £8-£10 million will be spent by local authorities alone. Again, running costs are estimated in this Bill at £13 million, including those for public bodies; whereas we estimate £16 million for local authorities alone. There is a very considerable gap in these estimates and it is important to be realistic about costs, as otherwise the job will not be done properly.

The Explanatory Memorandum suggests that additional duties generated by responding to requests for access should be met within existing manpower limits. Is that realistic, while local authorities are continually being exhorted to reduce manpower? The changes in the software of computers take a lot of time and employ experts whose skills are much in demand. Other computer programmes will inevitably suffer. Part IV deals with the important subject of exemptions', in particular Clause 29 empowers the Secretary of State to make orders exempting certain categories of data. I trust that the Minister can assure us that local authorities will be consulted before these orders are laid.

I am afraid that I find the effects of this Bill very difficult to assess and I must agree with the reservations of the noble Lord, Lord Wigoder. I only trust that the detailed discussion at Committee stage will reveal more about the practical implications of this Bill. I think that we all have our reservations, but the protection of the individual must be paramount, so I support the Bill.

6.16 p.m.

Lord Mottistone

My Lords, I find this Bill an interesting one because it is one which has been written about by almost more people than any other similar sort of legislation, raising so many small detailed queries, comments and criticisms. The larger organisations, like the CBI, the Retail Consortium and the consumers' associations, have all said in their opening statements that they welcome the Bill, but they then go on to list a whole range of reservations of quite a complicated sort, and I shall not even attempt to bore your Lordships with them.

However, one point seems to stick out and it has been represented to me from several quarters. It is that the registrar initially will require only 20 staff and that seems to be a remarkably small number for what will be a very difficult task. I suppose the Government will say that because the Bill says, "initially", that may be true, because they might just be needed to set up the computer to enter the people on the staff" on to their own computer. The noble Lord, Lord Hankey, is right in describing it as a huge quango, because I am afraid that it must be huge. The registrar is a single person, and in my book quangos consist of lots and lots of people on the committee doing the job. So my first point is that the number of 20 staff appears to be very small if the registrar will be expected to identify and admonish those data users who are not operating in accordance with the principles set out in Schedule 1.

The number also appears to be small if the registrar is to be expected to give constructive advice to data users, particularly the smaller ones, in order to help them improve the standard of their operations to acceptable levels. So I should like a small comment, if my noble friend Lord Elton can make it. on that particular point; and in so doing would he perhaps advise or tell me whether he or his Minister will be advising the registrar that his role should be more admonitory or more advisory?—what I think the noble Lord, Lord Hankey, called the "carrot or the stick".

It would also be helpful to know, in the absence of clear guidance in the Bill, whether it is the Government's intention that the registrar will be required to issue an enforcement notice to a data user before a deregistration notice can be issued. I quote that as just one example of a whole range of matters of detail which we shall have to try to unearth at the Committee stage. My own reading of the situation is that there will be a great many amendments and a great deal of your Lordships' time will be occupied on that task.

Having dealt with the fact that the staff is too small, one then wonders whether the task is not too big. My noble friend Lord Colville made the point that there must be some sorts of data, like payrolls, which really could be not subject to registration. I understand that universal registration is not required by the Council of Europe Convention, and indeed that many other countries that have some sort of registration do not have it universally but have a selective system. I should have thought that this might be a better method of handling things. It will be interesting if my noble friend can say anything at this stage, but I shall quite understand if he would like to write to me later on that sort of point.

Finally in a concluding area of points of detail, because so far as I can tell it has not been mentioned, the retailers, through the Retail Consortium, are concerned about two areas which they feel may be difficult. One is the potential for the control of information used for mail shots. They do not quite see how the Bill is going to apply to that. The second is information collected for credit reference purposes. That point was touched on by, I think, the noble Lord, Lord Hankey.

The problem is that under the Consumer Credit Act 1974 consumer credit businesses and credit reference agencies are licensed and controlled by detailed regulations. The licensing and the introduction of regulations has been a time-consuming and complicated process that has brought about comprehensive controls over the credit business. That is the situation now. What the Retail Consortium are saying on behalf of their members is that the provisions of this Bill that we are now discussing for rights of access to data should be made compatible with the Consumer Credit Act 1974, so that the work that has been done already is not all wasted and does not have to be done all over again. It would be helpful to have a comment on that.

I shall not weary your Lordships with more of these detailed points. One could go on indefinitely. Most of them are more suited in any case for inquiry through the processes of the Committee stage of the Bill. I shall therefore have to serve an awful lot of warning to my noble friend that there will be many rather tedious little amendments to extract information from him if he cannot give us a comprehensive answer at the end of this debate.

6.23 p.m.

Lord Kennet

My Lords, we have to remember what this Bill is about. It is, if I understand rightly, simply about people sending each other information about other people who do not want them to. If the people to whom the information relates do want people to send each other that information, then there is no need for this Bill and there is no need for the convention—and, after all, that is something that people have always done and will continue to do.

It is a Bill to protect the right of the citizen not to have information about him given by someone who holds it for a good reason to someone who would hold it either for another good reason or for a bad reason. That is all it is really about. The points I want to make are probably concerned mainly with regulations that the Secretary of State may be making later, and possibly with the codes of practice which many people still hope will emerge, and in the approval of which the registrar, many people hope, will have a role.

As it stands, the Bill still allows third party access where it denies subject access. That is to say, it allows disclosure in certain circumstances where the subject of the information is not allowed to see the information. Prima facie that is wrong. The Bill looks closely, therefore, at the circumstances in which there is something which would override that and make it an OK thing to do. The House will certainly want to look most closely at those circumstances too. This is all in Part IV of the Bill, mainly in Clause 28, the exemptions from access.

I hope that the following points can be dealt with either by regulation by the Secretary of State or possibly in the code of practice, but preferably in regulation by the Secretary of State. On the question of police files, there is a verbal matter here which may be a matter for amendment of the Bill itself before it becomes law. It says that you may be denied access to your police file if it is held for the purpose of the prevention and detection of crime. If it is held for the purpose of the detection of crime, in hot pursuit of a suspected offender, as it were, then it is right that you should be denied access.

However, supposing the state. Big Brother, simply turns round and says, "This information about you is being held for the prevention of crime", in case it may come in handy at some time or another, that is another matter altogether. I would also draw the attention of the House to the fact that the word "prevention" is not in the international convention. The word used internationally is "supression". That is a very different matter. I think that the ordinary citizen would be justified in feeling that the words "prevention", "suppression", and "detection" go in an increasing order of acceptability as reasons for the maintenance of secrecy in spite of direct personal requests to see the records.

On immigration, the Bill gives the Secretary of State power to exclude immigration from subject access. I am puzzled by this because in what circumstances would one wish immigration records to be kept secret from their subject except for the detection of crime? Evading immigration regulations is a crime, and it is already covered by that. In all other circumstances the layman would have thought that anybody should have access to his own record on request.

I come now to the most difficult records of all; that is, health and social services. Health is a matter where of course doctors have got so used to not having the duty to reveal to a patient what they are saying about him that it is very little questioned in this country. I believe I am right in saying that in Sweden they now have a law guaranteeing the patient access to his own medical records except in the most exceptional circumstances, which are closely laid down, or possibly not even with any exceptions. They have had it for some years and it works perfectly well, and nobody objects except when he finds that his address or telephone number is wrong, which of course is what one would like to have subject or patient access for. This is the sort of reason for which it should exist. Maybe I am wrong about that, maybe I have heard exaggerated accounts, but it seems to me that, except in the case of one doctor passing clinical observations about the citizen to another doctor when both are engaged in treating him, there is really no reason why medical records should be concealed from their subject by anybody. I hope that the regulation will reflect that principle.

As for the social services, the principle seems to me even clearer. I would lay it down as a general observation that it is unconscionable for the employees of local authority or central Government social services to write secret observations to each other about people. They are interested in the real condition of people, and people are interested in informing social workers of their real condition and their real views.

On subjective judgments, I know that social workers in general tend to say, "This will stop us writing down subjective judgments, and it will hamper our freedom of work." Well, would it? It will not hamper two social workers talking to each other about the citizen. It will not hamper them in passing private notes to each other about the citizen and about what is best to do next. It will hamper them only in putting on permanent record their subjective opinions at a given date, which maybe they themselves would not wish to see maintained for ever and ever. That point should be looked at with a very beady eye indeed.

In his admirable speech, the noble Lord, Lord Wigoder, raised the question of handwritten records, and I agree with him that it is absurd that simply because there is a new technology—of putting the matter on computers—we should exempt the old technology from the same adjustment of the relationship between the state and the citizen, the company and the client, which we are taking the opportunity of introducing in the Bill. It is simply that technological change has given us the opportunity to increase ordinary justice between human beings in our country. The point is often made that if one includes handwritten records, one knocks out a lot of simple address lists and so on. That is already being coped with in the Bill in the case of computer-held records, so why not with manuscript and transcript ones as well?

As for the registrar, I hope it may be possible to give him the duty of approving the code of practice which is adopted by this or that data utiliser. That would seem an admirable way of putting him to a positive use as well as a merely negative one. He could simply say to the police or Messrs. Smith and Jones, Merchants, or whoever it might be, "Send me your draft code of practice". Then he could go on to say, "It seems to be wrong in this or that respect: let us have a discussion", and finally, when he was satisfied with it (operating, presumably, under regulations given him by the Secretary of State) he would register it and it would then enjoy the protection of the Bill and those registered on it would also enjoy the protection of the Bill.

People—by which I mean not so much Government departments as business in general—may be worried by the colossal load of work the registrar is supposed to carry out on Day One when the Bill comes into effect. He must register everything. The Bill does not say that he may phase the operation of registration, though perhaps it would be a good thing if it did say that. If it did, the registrar would be able to say, "We will take, first, the dangerous and difficult ones"—the police first, health second, and so on, or whatever it might be—and then he could say to industry and commerce, "You all can relax for a few months. I shall be calling you by categories on such and such an approximate date". I think that would hold off a lot of alarm and despondency and enable commercial enterprises to prepare in the ordinary way, knowing what to expect and when.

The whole Bill is a fascinating example of the practices followed in the, shall we say? more developed or modern societies, having a direct effect on us and forcing our somewhat sluggish political process to gird its loins and face the difficult problems which many of them have faced already. Needless to say, we on these Benches wish the Bill good luck and hope to play our part in improving it on its way through the House.

6.34 p.m.

Lord Mishcon

My Lords, in attempting to wind up, on behalf of my noble friends in the Opposition, what has been a most entertaining and. I hope, constructive debate, I would make two preliminary observations. The first is that I promise to try to abide by the rule which, I thought, guided this House; that on Second Reading one debated the general principles of a Bill and left it to other stages to move amendments, be they about criminal or civil offences or whether the registrar should employ 20 or 30 people.

My second observation has been made before, and I do not apologise for repeating it. It is that your Lordships' House is at its best when attempting to deal with the defence of the private rights of citizens and embarking on the campaign to defend those rights, which is common to all the democratic parties in this House and certainly is a principle shared by those who sit on the Cross-Benches. I hope, therefore, that there will be a unified attempt to look at the Bill objectively and to join with those who manage to prove that there are lacunae in the measure which should be filled.

I must say at the outset—and, I hope, in that objective spirit—that this is a quarter-baked Bill. I had in my notes when I prepared them last night the description of a half-baked Bill, but my noble and learned friend Lord Elwyn-Jones convinced my by his eloquent and remarkable speech that I had overestimated the degree of culinary skill of the Government and that the fraction should be one-quarter and not one-half. In so far as it is quarter-baked, we support it. In so far as there is three-quarters yet to be dealt with by your Lordships in your cooking capacity, I hope that in Committee we shall be able to do that and make of a defective Bill a very much better one.

There are clearly set out in regard to the defence of the private rights of the citizen dangers which exist in this field, and I could not put them better than the Government did in the White Paper, Cmnd. 6353, issued in December 1975, in which in paragraph 8 they said: The principal potential dangers to privacy come from three main sources: first, inaccurate, incomplete or irrelevant information; secondly, the possibility of access to information by people who should not or need not have it; and, thirdly, the use of information in a context or for a purpose other than that for which it was collected". They are dangers that should be looked at most carefully by your Lordships' House, not just in the commercial field, to which much attention has been given in this debate, but in the sphere of Government, where the major usage of computers takes place and where there is the possibility of one department passing on to another information collated on a computer to such a complete degree that if ever this country had the misfortune—which all your Lordships, with myself, hope will never happen—of having an extreme Government (be it the extreme of the Left or Right) there would be ready-made, without your Lordships having given proper protection, such a collation of information, undefended and unprotected, as would amount to a complete menace for those whom might suffer under such a régime. I hope your Lordships do not think I am being dramatic in saying that. It is the duty of a democratic Government and Parliament to point out those dangers, and they do exist.

In the general terms of principles—with which, as I said, we should be dealing in a Second Reading debate—I wish to emphasise some of the main criticisms one would have as to what is omitted from the Bill. The noble Lord, Lord Wigoder, in my view, so correctly drew attention to the omission of manual records. One does not want to have in this Bill necessarily the requirement that all manual records should be registered with the registrar. If I may, I shall come very quickly, I hope, in a moment, to the point of the registrar, of the authority, the powers and the duties. What ought to happen is that at least embodied in this Bill are the principles which are set out in the first schedule, which occur in the convention and which were built up by the history (to which my noble and learned friend Lord Elwyn-Jones referred) of our dealing with this matter Government by Government. At least those principles should be made to apply in a statute; and the availability of those records, the protection of those records, should at least be referred to and certainly in the public sector. The noble Lord, Lord Wigoder, referred to the nonsensical position of a file of written records, be it in BUPA or in some such other organisation not coming within the ambit of this Bill at all; but the moment it finds itself in a computerised machine, then all these provisions apply. That is the first point that one makes.

The second point that one makes is this. As my noble and learned friend Lord Elwyn-Jones has said, with some speed, an awful lot of haste, without even a draft Bill being presented to organisations that might have had so much to say—and I include the Law Society and those who administer the affairs of the Bar and who are so capable of giving advice on these matters—action has been taken. No draft Bill was sent to them. There was a White Paper, which is not necessarily consistent with some of the provisions of this Bill. The whole idea in all the recommendations that were made, the original reports, the Lindop Committee, was that there should be set up, in order to deal with the progressive computer industry which sends out its tentacles—and I do not use that term in any vituperative sense—in so many different areas and in so many ways, some form of control, and that there should be some research, some guidance, that there should be an inspectorate; and therefore it was necessary to have an independent authority.

The mountain laboured and brought forth the mouse of the registrar; and the mouse of the registrar is somebody who is going to register, is going to have 20 by way of staff. My word! Will he be inflicted with hosts of applications for registration at the very start! The registrar is somebody, I suppose, who will have the same sort of duties as the Registrar of Business Names used to have, and as the Registrar of Companies has, with the same sort of staff.

I can remember standing here, and my noble friends stood with me, saying, "Please don't take away the Registrar of Business Names". We were told by the Government that it was mere registration, an administrative department, useless for any practical purpose. We debated the registrar. The noble Lord, Lord Mottistone, has a sense of humour and a sense of truth. Therefore he is both laughing and, I hope, nodding his head. The Registrar of Companies was attacked when we were dealing with the Companies Bill. It is a nonsense, said the Government, to have somebody merely registering. You have to have either a proper department, you have got to have inspectors, you have got to investigate; or you are doing something which is absolutely futile. The Government themselves are trying to do something absolutely futile. As has been pointed out, there are no duties but there are powers; there is no inspectorate, no little inside police force (if you like), but the registrar is supposed to carry out all this superintendence of the great computer industry and all this great principle of defending the privacy and the private rights of the individual citizens of this country.

In the final observations which I promise your Lordships I am now going to make, I am not going to refer in any detail to this wicked—as I would respectfully call it, if I may use that adjective and still talk about being respectful—Clause 28. It is dreadful, quite dreadful, when you are thinking in terms of the police, who deserve the support of every single Member of this House but who have to be watched as every other branch of our Administration has to be watched, when it comes to protecting the rights of the individual.

There are too many cases of late—and we are only referring, it may be, to a minority of the police force, and the Metropolitan Police force—where things have gone wrong with regulations and with the rights and duties of the police which have to be properly performed if the subject is to be properly protected and if this country is to have the name it has had for centuries, the name of law and order properly and justly administered.

Are we going to be told in the course of this debate or in the further proceedings on this Bill what really happens by way of superintendence of police records? To whom are they given, and on whose authority? And what is the procedure in regard to superintendence, for example, of the records kept by the Department of Health and Social Security when the police ask for details from that department about the health of a national health patient, or the records of a national health doctor saved in the computer machinery? What is the superintendence? What is the procedure? Have we protected the situation in the light of what we know by Clause 28, or as my noble and learned friend Lord Elwyn-Jones has said so sensibly, in my view and, I believe, in your Lordships' view: Ought there to be the protection of a judge's order?—not difficult to obtain. That is what our judges are there for, to see that there is an independent, objective, judicial mind brought to bear, seeing the need for the enforcement of law and order, the prevention and detection of crime, on one side, the liberty of the subject on the other and the presumption of innocence of everybody until he is proved guilty.

In these essential respects—and one could mention others, but one would not be very popular if one continued to do so at this hour of the evening with another debate to follow—we have to be very vigilant at the Committee and Report stages. Could we—I ask this rhetorically, but with a plea in my voice—unite as a House to try and better this Bill in doing this terribly difficult balancing act of protecting those in industry and in Government who ought to be protected in regard to the computer records that they have and, at the same time, carry out our duties in this balancing act to protect those private rights that seem to be eroded with the passage of time but which ought never to be neglected by your Lordships' House?

6.50 p.m.

The Parliamentary Under-Secretary of State, Home Office (Lord Elton)

My Lords, today's debate, which I hope to conclude in a manner satisfactory to my noble and learned friend, marks the beginning of a long and important discussion of a measure that concerns us all very closely. In fact, the noble and learned Lord, Lord Elwyn-Jones, said that it would be a long and anxious discussion. What we know about other people is always a matter of compelling interest; but this is about something even more compellingly interesting—it is about what they know about us. That, at least, is the point of view from which most people first approach it—and it is itself a response to that approach.

The gathering, collating, transmission and application of information has been hugely altered over the past two or three decades. Time was when whatever was recorded about a person was set down in writing and transmitted by post. But now pages of type and card indexes have been overtaken first by mechanical and then by electronic devices, and transmission is over the wires or even over the air. The information is held in a new, elusive and highly transmittable form.

Noble Lords who could once measure their stature by the length of their entries in Who's Who—rightly referred to by the noble Lord, Lord Hankey—can certainly still find themselves in those august pages; but, simultaneously, they have seen themselves reduced to a magnetic wave on a floppy disc. It sounds like a picture by Salvador Dali. It is in fact invisible to the naked eye and illegible without specialist equipment to translate it for them, yet capable of almost instant transfer on to another floppy disc in the office of they know not whom, in a city they know not where.

It is not just your Lordships, of course. Every private citizen can be, and almost every private citizen is, catalogued in one place or another, indeed in many places at once, against a variety of characteristics that may be true or false, accurate or imaginary. That has been a matter of growing public concern over a number of years. That concern does not arise from anything peculiarly secretive in the British character. On the contrary, it is shared by people in many other countries and several of them have resorted to legislation ahead of us. The noble and learned Lord, Lord Elwyn-Jones, has regretted this. But this has, indeed, been to our advantage since, as my noble and learned friend has told your Lordships, we have been able to see their legislation at work and we were able to draw on their experience in drafting the Bill.

Noble Lords of a sporting turn will know full well that, while it may be great fun to lead the field, those who are a little behind the first flight are far less likely to come to grief, and among them they will find the noble Lord, Lord Mishcon, for he was castigating us at the end of the debate, in which his noble and learned friend had said that we have gone too slowly, by saying that this was done in unseemly haste.

We also had to hand the European Convention. The convention enshrined a set of principles, which we have reproduced in Schedule 1 to the Bill. It is useful not only as a reference point and a yardstick but also as a passport. Countries which subscribe to the convention apply the principles. There is therefore an assurance as to how any information about individuals—or "personal data" as we should call it in this Bill—which is passed from our country to any of theirs will be treated and a reciprocal assurance concerning any such data passed from any of those countries to ours.

The noble and learned Lord, Lord Elwyn-Jones, painted a lurid picture of the economic consequences of not having legislation on data protection. I am less than sure that Lloyd's would in fact collapse under those circumstances; but the Government fully accept that the free international flow of personal data to and from this country is of prime importance to our trading position. Nevertheless, let our concern on this point not blind us to the other reason for the Bill, the protection of the individual citizen. It is for both economic and privacy reasons that we are legislating on this subject.

Since much of this information is commercially useful, it is clearly in the interests of trade that we should comply with the convention. The convention sets out to ensure that personal data are properly handled—that is to say, that they are obtained and processed fairly and lawfully, for instance, and that they shall be held only for specified and lawful purposes—and it is also in the interests of the individual that we should do so.

The need for the Bill is therefore, I think, clear—and most of your Lordships have accepted this—and the next question we must ask ourselves is the rather more thorny one: will it work? Many of your Lordships have presumed to leap to the wrong answer to that. I would however want to enter a modest reservation ahead of general claims. The material—the data—we are dealing with is. as I earlier described it, comparatively new. It is somewhat elusive and highly transmittable. I would not pretend that what we now put before your Lordships will see that it is controlled absolutely. But what it does do is to set out the rights of individuals, the rights of society and the rights of agencies and establish an authority to oversee their application.

Some of your Lordships have said that it is too big, an enormous quango. Then the figure of a registrar and a staff of 20 was berated as derisively small. We have had the advantage of seeing what other countries manage to get along with effectively. What we propose is not significantly smaller than that and we believe that it is adequate. From our investigation of the different schemes in Europe we concluded that data protection legislation should have four principal aims.

First, it should oblige data users to review the purposes for which they hold data, to whom they disclose data, and their operational practices—in other words, it must establish user discipline. Secondly, it should set up an overall code of practice for users that they all know they must abide by—in other words, it must establish public standards. Thirdly, it should reassure the ordinary citizen that he is not defenceless among the information greedy but inscrutable machinery of data banks—in other words, it must establish subjects' rights. Fourthly, it should provide an effective means of bringing to book those users who transgress—in other words, it needs to establish sanctions. We have provided user discipline by requiring users to register. By that process we are obliging them to submit themselves to the discipline of defining their purposes, analysing where they get data from and to whom they disclose them, and stating this on a public register. The noble Lord, Lord Mishcon, who I regret to say was wrong in many things, was right in pointing out to my noble friend Lord Colville of Culross that Clause 9 refers to that register only and does not give access to the public to the contents of individual computer tapes registered on the register. That preparation to register is not an onerous task but it is an invaluable one in establishing the right general atmopshere.

We then move on to ensure public standards by setting out the eight principles, drawn from the European Convention, that users must abide by. Here is a general code of practice with which users must conform. This, together with the discipline of registration, will ensure that the vast majority of personal data processing is not only beyond reproach—but accepted as being so.

We establish subjects' rights in the Bill in two different ways: on the one hand, we provide the right of subject access, which can both reveal to the subject what data are held about him, and enable him to discover if the user is falling short of the public standards for the holding of data; in addition, by setting up the registrar, we are providing a central authority to whom subjects can go in the event of difficulty or dispute. In the fourth area of sanctions we again have a dual approach: civil remedies to ensure adequate redress where damage has been caused; but above all, a registrar who can respond appropriately to the vast range of circumstances that may arise—from consultation and informal advice to users, at one end of the spectrum (which for the noble Lord, Lord Hankey, is a carrot), to the issuing of notices and the possibility of criminal prosecution if the notices are defied, at the other end. That, for my noble friend Lord Mottistone, is the stick. We do not expect these latter cases to be anything but rare but, where they occur, they can be dealt with.

We therefore believe that the Bill will work and it will work within a framework which is balanced, flexible, sensitive to the needs of both users and subjects and, where need be, tough. But we do not believe that we have somehow created a new Utopia where absolute standards unfailingly prevail and mistakes can never be made. Whatever scheme is introduced, it cannot ensure that data in every case carries a copper-bottomed guarantee of accuracy. We all rely heavily on information given to us by others, whether we hold that information on a computer, in a manual file or even in our heads. We can get it wrong and we can do so quite innocently. I am sorry that my noble friend Lord Mowbray and Stourton is not here, because he knows that for a number of years I thought he was not one person but two! That was an innocent mistake, but it was not culpable.

The recipient of data therefore cannot always be 100 per cent. certain of the accuracy of data he receives. That is true even if he receives it from the subject itself. If that were obligatory, the vast majority of data could not be held at all. We recognise in the Bill that limitations are both necessary and desirable. What we are seeking to achieve is a realistic scheme that ensures that, where computers are used, reasonable standards are maintained, data subjects are adequately protected, but that data users are not faced with unrealistic or impossible demands, such as was feared by the noble Lord, Lord Hankey, among others.

May I now deal with some of the more particular points that have been raised. First, exemptions from the Bill. I will not dwell long here because my noble and learned friend has already said most of what there is to be said. The Government firmly believe not only that the scheme in the Bill strikes the right balance between user and subject, in a field where that balance is of particular importance, but also that it compares well with the standards that apply in most European countries.

We make no apology for exempting national security data from the Bill. We have to deal with the world as it is and not as we might wish it to be. We cannot submit these data to the provisions of the Bill; but let me say that the Government take, and will continue to take, every step to ensure that personal data, held for reasons of national security, are themselves subject to the highest possible standards of security against improper or unauthorised access or disclosure. By the very nature of things, it is in the Government's own interest, as well as that of data subjects, to apply the most stringent standards to data of this kind.

Noble Lords spoke at some length on the exemptions, particularly from the first principle in Clause 28, and I would not want to spend too long on this since I have had ample notice that we shall be dwelling on it repeatedly and—as the noble Lord, Lord Hatch of Lusby, would say if I were to go on long enough for him to return to attend the close of this debate—even longer. It is perhaps a pity that he has threatened us with such a late sitting and cannot be here at this moment to defend that position—my Lords, he is with us and I withdraw most, but not all, of what I have said.

Speaking of Clause 28, I would say that the first principle derived from the European Convention requires data to be collected fairly, This is an imprecise term, liable to subjective interpretation, and there are unfortunately occasions when the effective pursuit of the prevention and detection of crime and of the other purposes set out in Clause 28 dictate that information must be collected in a manner that might be regarded as not being fair, and thus it may prove necessary to collect information by covert observation of the data subject or by listening to other people's conversations—a method which the registrar might conceivably be forced to conclude was not fair.

But the Bill must not put at risk essential information collected by these necessary means; nor must it exclude, for instance, information about the contents of one malefactor's dwelling revealed by another malefactor subsequent to his arrest or about his intended or already-committed nefarious activities. Therefore, in effect Clause 28 exempts data held for the various purposes set out in the clause from the first principle, where those purposes would be prejudiced by the application of that principle.

I should like to make one other point regarding exemptions. The very limited exemptions in Clause 28 are all subject to what may, for convenience, be called "the prejudice test". They apply only if it is necessary for them to apply in order to avoid prejudice to crime prevention or the other matters mentioned in Clause 28(1). The registrar can form his own view of whether that prejudice test has been passed, and this is important in two ways. It reflects the Government's view, which I am confident will be shared by the vast majority of your Lordships, that, important though data protection is, it must not diminish or prevent the protection of the public from crime; and of course the authors of the European Convention accepted that, too.

But over and above that, the inclusion in the Bill of the prejudice test, with the independent registrar invigilating over its application, is an assurance that crime detection and the other Clause 28(1) matters will take precedence only when it is essential for them to do so. They are policies which we have to have, and there is no point in having them if they do not work. This part of the Bill will apply only if the effect of not applying it would be that they did not work. The prejudice test is an important matter—more important than some early commentaries on the Bill have recognised. Taken together with the limits on the provisions from which exemption is permitted, it is what ensures that there is no blanket exemption from the regulatory régime established in the Bill.

If I may now pick up other points made by your Lordships, I would say, referring to the subject access to health and social work data, we have not reached a final view on the appropriate restrictions upon subject access to health and social work records. In these areas it is essential that there should be full consultation with the medical and other professions involved. Those consultations are going on now. Clearly the restrictions on the right of access must be kept to a minimum, consistent with protecting the subject himself from coming up against information which could be seriously harmful to him. I am sure noble Lords would agree that we ought only to decide where that frontier of discretion lies in the light of the fullest discussion.

Personal data are held by a very large range of users for a very wide range of purposes. The Lindop Committee thought it would take more than 50 separate codes of practice to cover the field. When we attempted to draft some experimental codes to give ourselves some idea as to what they might contain, we found it quite remarkably difficult to do if they were to have legal effect and be applicable to all users in each of the various sectors—for though two users might operate in the same sector they might use quite different kinds of data in quite different circumstances. That is not to say that voluntary codes of practice, drawn up perhaps by representative bodies, will not prove extremely useful as guides to data users; but I think it is an additional reason why we were right not to delay the publication and enactment of the Bill in order to get this very large range of detailed provisions perfected in advance. That might have satisfied the noble and learned Lord, Lord Elwyn-Jones, but would have annoyed the noble Lord, Lord Mishcon, unconscionably.

We have certainly not ruled out the possibility of setting up an advisory committee, which some of your Lordships suggested, made up of people with experience in various fields. That committee might advise the Government not only on data protection matters, but could also advise the registrar on particular issues or subject areas, and in this I would recall that the noble and learned Lord, Lord Elwyn-Jones—my Lords, I am sorry: I am confusing two ideas. I will revert to the noble and learned Lord, Lord Elwyn-Jones, in a moment. It is always an agreeable thing to do towards the end of a debate.

The registrar, of course, in any event will be free to seek advice from wherever he wishes, but in the interests of maximum flexibility and given the doubtful desirability of the committee advising, as it were, in two directions, we tend to the view that it would be best established on an extra-statutory basis. However, we shall be interested to hear views on this.

What the noble Lord, Lord Elwyn-Jones, mentioned was the area where advice will certainly be needed and that is in crime prevention. If I might ask the noble and learned Lord to look at Hansard, I think he will find that my noble and learned friend the Lord Chancellor has already said that Her Majesty's Inspectorate of Constabularies of both England and Wales and Scotland are prepared to give exactly that expertise.

I do not want to follow too closely behind my noble friend Lady Trumpington in her proposals to introduce an intervening tier of law between civil and criminal, but I will say that we will look at it. I do not think we ought to look at it in the narrow confines of this Bill since it applies across the whole spectrum of interests.

I would like to reassure both my noble friend and the noble Lord, Lord Hankey, of our intentions in the Bill as regards the carrot and the stick. I have already referred to that earlier. There is a progression of steps that the registrar can take to influence what is done. The Bill is constructed so that he will normally operate by consultation and advice and persuasion. The issue of notices will be a much later and a much rarer step, and deregistration will be rarer still. If he does have to exercise those powers he must have some penalty beyond the civil remedy to back them up. It is simply as a back-up to the notices that the criminal offences are included. The experience of the earlier steps and the existence of the later steps will. I think, amount to an educative process desired by both him and my noble friend Lord Mottistone.

If your Lordships will indulge me for about three minutes longer I think I can avert some of these dreadful threats of things being brought up in Committee because they were not mentioned in the wind-up. Although, as the noble Lord, Lord Mishcon, has rightly said, we should be addressing ourselves only to principle, some of them relate to principle; for instance, the principle of whether a public and powerful figure such as the registrar should be bound more by duty or by power. We see that discretion, which is what is involved in power as opposed to duty, as a virtue and not a weakness. We believe in allowing the registrar to react with common sense, flexibility and pragmatism to the particular cases he confronts—and do not forget that the variety of cases will be enormous, as your Lordships have all been at pains to remind the House. It would surely be quite unreasonable for him to have to issue an enforcement notice on every occasion he found a breach of principle, however minor or however serious; if he had to issue or start an investigation when he received any complaint, however frivolous or tendentious. I think we have the balance between powers and duties right, because the expectations of the Government of this new and powerful official will be reinforced by the requirement to make reports to Parliament, which will be subject to public and detailed criticisms, no doubt, if your Lordships have a hand in it.

I have already touched on the question of orders under Clause 29, but I think it was my noble friend Lord Digby who was anxious about the question of consultation. The Government are actively consulting the various professional groups most closely involved with the health and social work data, he is concerned with. We will decide the precise contents of orders under Clause 29 after these consultations with the doctors. The other health professions are also being consulted; and the noble Lord, Lord Kennet, will be reassured to hear that on the social work side the professionals will be consulted too. They include the social work departments of the local authorities. I think that was his particular concern.

I do not think I should go on longer. I should like to conclude, therefore, with one point only which was raised by a number of your Lordships. Several of your Lordships have wanted the Bill to embrace written material. The noble Lord, Lord Wigoder, wanted this. The noble Lord, Lord Hankey, said it was absurd not to have it. The noble Lord, Lord Mishcon, threatened us with totalitarian repression if we did not get it.

Lord Hankey

My Lords, will the noble Lord give way? I do not think I wanted to include written material. I blanched when the noble Lord, Lord Wigoder, mentioned it.

Lord Elton

My Lords, I was not observing the noble Lord's complexion at the time but I understood that he thought there was an absurdity—I think he was referring to Who's Who—when he said it would be a written biography at one minute, outside the law, and a computerised biography the next minute, inside the law. He saw an absurdity in that and I am sorry if I misrepresented him. The noble Lord, Lord Smith, and the noble Lord, Lord Hunt, shared that anxiety in a medical context. Of course, I agree that individuals can be damaged by the misuse of information about them, regardless of whether it has come from a computer, from an ordinary manual file or, indeed, from a malicious gossip. But what we are discussing today is not a measure for the general protection of personal information, nor indeed is it intended to replace the Hippocratic Oath, as the noble Lord, Lord Hunt, would have us do. It is a measure specifically designed to meet the particular threats, actual or perceived, which derive specifically from the use of computers.

I must say that there would be very considerable practical difficulties if we sought to cover manual data in the same way as computerised data. Just consider the amount of personal data that exist in manual form in almost every office—far too much. How would the principles of data protection be effectively applied to such an enormous, diffuse and disparate collection of information? How would subject access be given to manual data held by governmental or commercial institutions of any size? There is a potential data bank in the office of every employer and librarian in the country, including this House. For all these reasons the Government have restricted this Bill to automatically processed data. To do otherwise would require a huge bureaucracy such as some of your Lordships have said they fear and that would place intolerable burdens on users—and even then there would be grave doubts as to whether it would be enforceable. It would certainly require a scheme totally different from that contained in the Bill, so let us not overreach ourselves unnecessarily.

Some of your Lordships called this a white mouse among the white tape. I thought it was a white mouse among red tape, but I got it wrong. Other noble Lords have referred to it as a jelly fish, a pig in a poke, and none of your Lordships has rung the bells of welcome that the Bill rightly deserves. But we are setting out to do something which the British people have basically wanted for some time: to reassure the British people—and that is us, my Lords, as well as the public outside—that the information held about us has been fairly and lawfully gained; that it is properly handled, that it is not mischievously used; that it is not put in the wrong hands, and that if it is inaccurate it can be put right. That is what the Bill does. It does not set out to do more. I think it has set out in the right direction to achieve a limited but extremely important aim. I beg to move.

7.19 p.m.

Lord Hatch of Lusby

My Lords, before the noble Lord sits down I have already made my apologies to him and I repeat them now. But I was here when he made a particular issue of the question of the prejudice towards the carrying out of the law. Will he help the Committee stage by telling us why it is necessary to include control of immigration when already there is, in the exemptions, any breach of law? Is this not saying in effect that we are lumping together in these exemptions people who are suspected of being criminals and coloured people?

Lord Elton

My Lords, I really do not like responding to this, because I had sat down, we have other business before us and the noble Lord asked me to justify myself in Committee. But what the noble Lord imputes to the Government is so damaging that I must reply. This is not a racially prejudiced piece of legislation. I was at pains—and the noble Lord was already in the Chamber when I did so—to say that the powers to which he refers and to which he takes exception would be used only subject to the prejudice test exercised by the registrar; in other words, if they were prejudicial to the operation of the policy in one of those five areas endorsed by Parliament.

If they will stop the will of Parliament, the policy of the Government endorsed by Parliament, from operating, then, if they are prejudicial, they pass the prejudice test and the power can be used. I am not going further. I have gone that far only to try to disabuse the noble Lord, and whom he may converse with, of the idea that the Government are pursuing a vindictive or racist attitude towards one section of the community. That is not the intention of the Bill and it is very harmful to suggest that it is.

On Question, Bill read a second time, and committed to a Committee of the Whole House.