Data Protection Bill [H.L.]

HL Deb 05 July 1983 vol 443 cc509-46

3.25 p.m.

The Parliamentary Under-Secretary of State, Home Office (Lord Elton)

My Lords, I beg to move that this Bill be now read a second time. I should like to welcome your Lordships back to consideration of the Data Protection Bill. It is an occupation very familiar to those of us down to speak in this debate and one in which many of your Lordships have developed a subtle expertise—an expertise perhaps more subtle in some than in others.

Your Lordships will recall that the Bill is drafted to fulfil two purposes. The first is to protect private individuals from the threat of the use of erroneous information about them—or, indeed, the misuse of correct information about them—held on computers. The second is to provide that protection in a form that will enable us to satisfy the Council of Europe Convention on Data Protection so as to enable our own data processing industry to participate freely in the European market. In this context, data processing is not only a free-standing activity, but an integral and essential part of the operation of many major companies familiar to all of us, employers of many of us, and an essential part of national economic activity. Achieving the first of these purposes will reassure a sometimes anxious public that advances in information technology are harmless and that their extension can be beneficial. Achieving the second will assist that extension to take place. Many companies depend upon the information about their customers, their staff and their suppliers flowing freely across international frontiers. Non-ratification of the convention would impede that flow and be against the national interest. On the other hand, ratification will secure us the hallmark of respectability without which a great part of the flow would be restricted—with many disagreeable consequences including the loss of jobs.

I am, of course, treading on all too familiar ground and speaking on a subject on which your Lordships have, as I said, developed an expertise of your own. Perhaps, therefore, in describing the substance of the Bill I may be forgiven if I go into a little less detail than is normal at this stage, and lay rather more emphasis on those parts of the Bill that have altered since it last left this House—and, indeed, the other place—than on the provisions that remain unaltered.

The basic structure of the Bill remains as it was. Fundamental to it are the data protection principles set out in Schedule 1. These principles were put forward in the Younger Committee's Report on Privacy in 1972 and form the basis of the Council of Europe Convention. The eight principles are general in nature—as indeed they must be if they are to be sufficiently flexible to apply in all the many areas of data use. They are the heart of the convention, and remain the heart of the Bill. Indeed, the prime aim of the Bill is to enable them to be sensibly and effectively applied.

Because their nature is so general, it would not be appropriate to make them directly enforceable through the courts. Therefore, the Bill provides for a system of public registration, and compliance with the principles is enforceable through the powers of an independent data protection registrar. In addition, a combination of existing and new civil remedies will provide redress where, broadly speaking, the principles are breached.

So that structure remains. But we have sought to refine its design and improve its effectiveness by a number of changes since the last Session. The great majority of these were prompted by comments made in the course of the last Session by noble Lords in this House, honourable Members in another place and various others outside. To that extent, they are not wholly new departures; in many cases we had already given commitments to consider amendments. Indeed, I have no doubt that, if last Session's Bill had run its full course, the amendments would in due course have come before your Lordships' House from another place. Some of the changes have involved important new provisions, while others have been relatively minor. I hope your Lordships will agree that all represent improvements. I will not list them all; I will pick out a number to give your Lordships a flavour of what has been done, and I will certainly point to those that I consider to be most significant.

Let me start with one of the lesser changes—but one which illustrates how we have gone about considering the points that were put to us in the course of last Session's Bill. We spent some time in this House debating the important and complex definitions in Clause 1. Clause 1 defines the key terms that are used and, in effect, limits the application of the Bill to automatically processed personal information and persons "holding" it. In the previous Bill "processing" in relation to personal data was defined in Clause 1(7) as amending, augmenting, and so on, "in relation to a particular data subject". This was criticised by, among others, the noble Lord, Lord Mishcon, as being overly restrictive. And, on reflection, the Government accept that these words could be seen to carry an implication that the individual concerned was known before the processing was undertaken, the machine being instructed to extract information about a particular Mr. Smith or Mr. Jones. That will, of course, not always be the case. So we have sought to avoid that implication by using the phrase, "by reference to the data subject", in Clause 1(7), retaining the substantive effect but, we hope, improving the precise drafting.

The next change to which I would draw attention is the new subsection (8) of Clause 1. This was in fact approved in Committee in another place last Session. It was, I believe, the noble Lord, Lord Wigoder, who first raised the question of whether the Bill covered word processors. I am sorry not to see him participating in today's proceedings in order to savour the pleasure of that concession. The question of whether the Bill covered word processors was a point often returned to in our debates. Clause 1(8) makes it clear that the Bill does not apply to processing where the equipment is used only for the purpose of preparing the text of documents.

We have to be careful here because many pieces of equipment described as word processors are in fact computers used in a particular way—and are also capable of being used for a thousand and one other purposes. That is why we have focused on the task, rather than trying to define the equipment. But we hope that Clause 1(8) will reassure those who feared that the Bill in its original form might quite unnecessarily have caught certain entirely innocent forms of data processing that should properly be beyond the scope of this Bill.

In Clause 3(5) we have a change which I hope will be welcomed by my noble friend Lord Mottistone. He argued that the Bill should make express provision for persons to be included on the Data Protection Tribunal to represent the interests of data subjects. Paragraph (b) of Clause 3(5) and paragraph 2(1) of the third schedule now make explicit provision to that effect.

One of the more fundamental amendments to the previous Bill is the recasting of Clause 7. Under the previous drafting, applicants for registration or for the alteration of registered particulars would have had to await notification from the registrar that they had been registered before they could lawfully commence their new operations. This could take up to two months. A number of organisations representing users were concerned at the potential for delay. And it was again my noble friend Lord Mottistone who pressed us in this House on the matter.

We are persuaded that, particularly with the spread of small computers where new uses do not necessarily have a lengthy lead-in period, the original arrangements for registration could have caused undesirable delays. Clause 7, therefore, has been so revised that applicants for registration or for the alteration of registered particulars will, with certain exceptions designed simply to eliminate the possibility of abuse, be deemed to be registered pending the determination of their application. Thus applicants will be entitled to get on with their operations just as soon as they have made their applications. This should help users without reducing the protection offered to subjects.

I now turn to Clauses 10(8) and 12(10), which provide that it is an offence to fail to comply with, or to contravene, an enforcement notice or a transfer prohibition notice issued under those clauses. It was argued when we last saw this Bill that statutory defences should be included where the data user was in breach of a notice through no fault of his own. To meet this valid point, defences of "due diligence" are now contained in Clauses 10(8) and 12(10).

Clause 16 deals with powers of entry. It is a part of the former Bill that attracted the attention of noble Lords on both sides of the House. It has now been reformulated, and the substantive provisions concerning the registrar's powers of entry, search and seizure are included in a new fourth schedule. I will not go into all the changes now, but I ought to mention one or two. By virtue of paragraph 2(c) of the schedule, the occupier of the premises in question will normally have an opportunity of being heard by the judge considering an application by the registrar for a warrant. This of course builds on the amendments made on Report in March, when a circuit judge was substituted for a magistrate as the issuing authority for warrants.

Furthermore, under paragraph 1(2), the occupier will be given, on request, a copy of anything seized provided that this can be done without undue delay. This should go a long way to meeting the concern that was expressed about the consequences of the registrar seizing the only copy of a user's tapes or discs, thin preventing him from continuing with his business. Paragraph 9(1) provides that certain—though I would emphasise not all—legally privileged material is exempt from the powers of inspection and seizure—the noble Lord, Lord Elystan-Morgan, will tomorrow note that with interest; and paragraph 10 provides for the severance of non-exempt material, a point raised last time by my noble friend Lord Swinfen. Finally, paragraph 11 requires that the endorsement on executed warrants should indicate what powers have been exercised rather than showing simply whether anything has been seized.

All these amendments flow from debates on Clause 16 during consideration of last Session's Bill. I hope that they will find favour on both sides of the House as reasonable and valuable additional safeguards where search powers are being exercised.

The next important change is in Clause 24. Your Lordships will recall that the Law Society was critical of last Session's Bill, arguing amongst other things that a subject should be entitled to apply to the courts for rectification of inaccurate data whether or not damage had been caused. The point was also raised by members of the Opposition in another place. We recognise the force in their argument, and Clause 24(a) now allows the courts to rectify inaccurate data even though there may be no question of damage.

Of course, subjects will still retain the ability to go to the registrar rather than the courts if they prefer and to ask him to order rectification of data which are in contravention of the fifth principle requiring accuracy. So the Bill now allows subjects to choose what route they take to get inaccurate data corrected—either through the registrar or through the courts: and in neither case is proof of damage prerequisite for action.

We now come to a matter that exercised us for some considerable time during the previous Bill's passage—what became known as the hunt for the unicorn. Noble Lords on both sides of the House urged us in pursuit of a category of routine data which could be exempted from the scheme in order to reduce both the scale of the registration process and the burdens on users, and do so without significantly reducing the protection afforded to the individual. We had many beasts paraded before us, and the noble Lord, Lord Wigoder, and my noble friend Lord Mottistone joined forces in the chase. My noble friend Lord Drumalbyn also took part, and, during Committee in another place, the spokesman for the official Opposition tabled amendments maintaining the pressure.

What we now offer in the Bill is not one unicorn but three. The first two elements of the new exemption are to be found in Clause 31. This exempts personal data that are held only for payroll and accounting purposes, provided that the restrictions on disclosure set out in the clause are complied with. The third element is to be found in Clause 33(1). This exempts personal data held by a person who is already under a statutory duty to make the data publicly available. This will have various applications. Perhaps the most important result will be to exempt the various public registers which companies are required to keep under the Companies Acts.

My Lords, these are perhaps the most significant of the amendments made to the Bill. We have made them because we recognise that in the closely defined circumstances of use and disclosure set out in Clause 31 there will be no need to afford payroll and accounting data the protection that the Bill generally provides. That is also the case with data covered by Clause 33(1): where Parliament has decided that information must be made available to the public at large, it seems scarcely worthwhile to require the information to be registered and subject to principles designed to control and regulate matters such as use, disclosure and access.

This trio of exemptions should significantly reduce the burden on commerce and industry of complying with the legislation. We understand that a considerable number of smaller companies hold personal data on computers only in the circumstances that are now exempt. They will, in that case, be free of statutory obligations under the Bill. And although there will of course be many other companies which hold personal data also for other, non-exempt purposes, they will not need to concern themselves with the exempt data for the purposes of the new legislation, but can concentrate on the non-exempt. For many data users, therefore, the new exemptions have obvious attraction. But let me also point out that the advantage to the data user is not offset by any disadvantage to the subject. The protection afforded by the scheme is not reduced by the exemptions, given the strict limits on use and disclosure written into Clause 31. Indeed, I think subject and user alike will welcome the fact that the register will be free of these particular categories of data, as will the registrar himself.

Another subject which promoted considerable debate last Session was the question of duties on the registrar. Duties of various kinds were proposed by the noble and learned Lords, Lord Elwyn-Jones and Lord Gardiner, and the noble Lord, Lord Elystan-Morgan. During the previous Bill's Report stage we were able to clarify the position concerning the registrar's duties and powers to give information and advice by a reformulation of what was then Clause 33. But the Government have looked at this question again, and Clause 34(1) now places a general duty on the registrar so to perform his functions as to promote the observance of the data protection principles. We hope that this will eliminate any lingering doubts as to the active role of the registrar both in assisting users to know how best to comply with the principles and in pursuing complaints of subjects who are faced with contraventions.

The last of the changes which I should mention today was not in fact prompted by representations made to the Government in Parliament. Nevertheless, we did come to realise that it would be helpful to clarify the Bill's territorial application. The very nature of the information technology industry means that the operations caught by the Bill are not easily ascribed to a particular geographical location. A data user in this country might employ a computer bureau situated abroad to undertake processing, and vice versa. Similarly, a United Kingdom bureau might use processing facilities abroad; and data being used in this country might be under the control of a person resident abroad. All these permutations are not only possible, they already exist. Thus the Government see merit in making explicit provision setting out the Bill's territorial application, ensuring that no loopholes exist by virtue of the international nature of data processing and use. This has been done in Clause 37.

There are a number of other amendments, too, but I already feel that I have asked your Lordships to listen to a sufficiently long list of changes to the Bill. I should like to take this opportunity, therefore, to pay tribute to all those who contributed to the debates on the Bill introduced in the last Session, both within Parliament and outside it. When that Bill was published there was, I think, general agreement that data protection legislation was required, but there were very many different answers to the question: How should the legislation be framed? I hope that the revised Bill before your Lordships today provides a more generally agreed answer to that question. I do not for a moment claim that it meets all the points put to us last Session. Indeed, we would be in for a dull time were there not a few points on which noble Lords opposite and myself were forced to differ and to agree to differ. But that is for the future.

For the moment I would conclude by repeating that the Government believe that the measure before us today will guard effectively against the potential threat posed to the individual by the automatic processing of personal data, and will protect our commercial interests by enabling us to ratify the Council of Europe Convention. We believe certain improvements have been made to the Bill.

I am conscious that I conclude this speech in the shadow of the introduction of the Bill last time by my noble and learned friend the Lord Chancellor. My introduction has been necessarily simpler because I am, I fear, a simpler man. Nevertheless, I am confident that what we are putting before your Lordships is an improvement. Secure in the knowledge that all your Lordships are intent on improving it still further, I beg to move that it be now read a second time.

Moved, That the Bill be now read a second time.—(Lord Elton.)

3.45 p.m.

Lord Elwyn-Jones

My Lords, the noble Lord has averred that he is a simple man, but I hasten to say that the speech we have just heard is not the rattle of a simple man—to coin somebody else's phrase. This is a day not only of déjá vu but of déjá entendu. There are many new matters that have cropped up, and several old matters that I shall feel it right to indicate to the House as a mark of the fact that the Bill will not have an easy passage. I am sorry for the noble Lord because we still think there are serious omissions from the Bill.

I ask leave to make one apology for my inability to be present throughout the debate. I have a longstanding engagement to attend a graduation ceremony of the University of London and must ask leave to be absent at least during part of the proceedings for the carrying out of that duty.

The noble Lord, Lord Elton, has referred to a number of changes that have been introduced to the Bill since it left this House. I should be churlish if I did not acknowledge the usefulness of many of them and the importance of some of them. We will examine them with some care when we come into Committee, but it is gratifying to know that a number of them, as the noble Lord has willingly acknowledged, were the result of representations from both sides of the House (indicating the value of debates in this House) and some have emerged from proposals in another place. Some of them tend to make the Bill less oppressive than it was previously in some respects. For instance, in regard to the powers of inspection and seizure there is the amendment to Clause 10(8). The alterations to Clause 24, which have been referred to, are also clearly of importance in relation to the power of the person complaining of error that rectification proceedings may be taken, if the court is satisfied on the application of the data subject that personal data of which he is the subject are inaccurate. That is clearly a useful change.

But I regret to say that in very important respects this Bill falls far short of what was contemplated by the Labour Government's White Paper of 1975 and in the report of the Lindop Committee. The White Paper concluded, time has come when those who use computers to handle personal information, however responsible they are, can no longer remain sole judges of whether their own systems adequately safeguard privacy". It was admitted that the time had now come for a change; but what was proposed at that time, following the setting up of a data protection committee and the report of Sir Norman Lindop, was the creation on the recommendations of the Lindop Committee of a statutory data protection authority to fulfil the duties for the protection of the data subject and, to some extent, of the data user as well, with a function and role and with statutory powers rather like those of the ombudsman, with power to conduct spot checks to ensure that all personal data were handled with due regard for both security and accuracy. That has been rejected by the Government. There is to be no data protection committee, but there is to be a registrar. He is to be the most important person and the most important element in the machinery that the Government are bringing forward.

My Lords, I shall submit in a moment that despite the change that has been effected in Clause 34 of the Bill, there is still a failure in the Bill to set out what duties should be imposed upon the registrar to perform. We urged before the Bill left the House the importance of providing that the registrar, who will have a wide range of functions, should be assisted by a data advisory committee providing him with a wide-ranging service of expert knowledge and experience. Regrettably, this has been resisted and I understand by its omission from the new version that it is still resisted. We shall endeavour to seek to persuade the Minister of the value of this addition to the machinery to help both the registrar and those who will be affected by the functioning of the provisions of the Bill.

Another important proposal of Lindop was for detailed codes of practice to be introduced for various categories of computer users in order to amplify the principles contained in the Bill and to help those affected by it. Lindop proposed that the codes should become statutory instruments with the force of law. After all, in many fields of legislation self-regulatory codes are used to give guidance on general requirements in Acts of Parliament. Instead, what I gather is contemplated here is that guidance on compliance with the Bill will be left to the voluntary efforts of data users and computer professionals—who could hardly be called independent sources of guidance, if I may say so. The registrar himself is to be independent; but we shall once again look as to whether the arrangements made for him in the Bill really ensure that he is truly independent and not subject to the risk of irresistible pressures from the Secretary of State and those functioning for him.

As I ventured to say, the Bill still lacks a clear statement as to the duties which ought to fall upon, and are intended to fall upon, the registrar. We tried at various stages in the progress of the Bill to set out as statutory duties some of the things that the registrar ought to do: for example, to investigate complaints made to him that the registered person has materially contravened any of the data protection principles and to notify both the complainant and the registered person of the outcome of his investigation. While we welcome the new provision in Clause 34 that, It shall be the duty of the Registrar so to perform his functions under this Act as to promote the observance of the data protection principles by data users and persons carrying on computer bureaux", it is expressed in such general and imprecise terms as, I submit, to be insufficient for what is needed. The words lack precision and impose a duty which seems to us to be so vague as to be unenforceable. In passing, it is interesting that Clause 34(1) is directed to data users and not to data subjects; but we submit that it is important that data subjects too should be aware of their rights and be able to seek assistance in cases of difficulty.

In relation to the absence of provision for a clear statement of statutory duties, it is significant that the important Clause 10 of the Bill which deals with enforcement notices still provides, as it did before, in subsection (1) that If the Registrar is satisfied that a registered person has contravened or is contravening any of the data protection principles he may serve him with a notice ('an enforcement notice') requiring him to take, within such time as is specified in the notice, such steps as are so specified for complying with the principle or principles in question". It is purely a permissive power. He may serve a notice in those circumstances and it is left to his discretion whether or not he does anything about the situation. We submit that if the contraventions are substantial he should be placed under a duty to intervene. He has been given no such duty in the terms of the Bill.

I noticed that the noble Lord, whether out of prudence or avoidance of trouble, made no mention of Clause 28, the much-maligned, universally disapproved, universally attacked clause in the Bill. We have endeavoured, we have done our best on all sides of the House to improve the provisions of the Bill; but in this case we have run our heads against a brick wall. Indeed, on this issue the Minister seems to be carrying his own brick wall around with him. We have made no progress at all. It has been condemned by a wide variety of interests: the National Consumer Council, the National Association of Citizens Advice Bureaux, the National Council for Civil Liberties, Justice and, not least—and perhaps very precisely and most interestingly—the medical and other health professions.

The British Medical Association has communicated with me and possibly with other noble Lords as well, and has come out very strongly against the clause. It stresses: The key principle of data protection is that 'information should be regarded as held for a specific purpose and not be used, without appropriate authorisation, for other purposes'.". That principle, which would seem to us to be quite fundamental, was the first of ten recommendations by the Younger Committee on Privacy and was subsequently affirmed by Lindop.

My Lords, the House well knows by now that Clause 28 deals with exemptions from that main principle. Subsection (1) provides that: Personal data held for any of the following purposes—

1. (a) the prevention or detection of crime;
2. (b) the apprehension or prosecution of offenders;
3. (c) the assessment or collection of any tax or duty; or
4. (d) the control of immigration,

are exempt from the subject access provisions". The subject is denied access to them about information which may very greatly affect him, his character and his career. Subsection (2) sets out the circumstances in which data on an individual may be passed on without that individual's knowledge or consent.

What has troubled the British Medical Association most particularly is that doctors will be unable to safeguard the confidentiality of medical records if transfers of information can be made in secret to computer systems when those individuals cannot check the existence of records. They point out that medical information is particularly sensitive. Patients tell doctors things in the greatest confidence, so that their problems may be accurately diagnosed and treated. Doctors, in turn, of course, welcome the maximum frankness from their patients. But if patients believe that confidential information can be passed on without their knowledge or consent, or if doctors think that people with access to their records could pass on the contents without their knowledge, then both patients and doctors will limit the information which is given and recorded, whereas medical confidentiality is a vital aspect of health care.

The BMA point out in this communication that if the proposed exemptions to the fundamental principle become law it could mean, for example, that a hospital employee with access to a patient's notes could transfer that information to the police without the patient's or the doctor's knowledge or consent, and that information could then be held by the police indefinitely. They suggest safeguards, which we shall go into when we resume discussion on this matter, which are of prime importance to them.

The inclusion in the four categories of control of immigration has been fiercely and, if I may say so, rightly condemned by the Joint Council for the Welfare of Immigrants and many other bodies. It has caused more anxiety than any other provision in the Bill, and not merely because the category of control of immigration is an enormously broad purpose liable to misuse. The publication of the clause has caused anxiety not only for those lawful immigrants who are already here but even for those who were born here and have been settled here for a long time. It has created a sense of uncertainty, unease and, indeed, discrimination which is regrettable at this time, above all, for those who are likely to be affected by it are not white persons born and settled in this country but those who have come here, the minorities. We entreat the Government to remove this highly disturbing provision from the Bill. If it is illegality or criminal offences that are sought to be covered, then 21A and 21B are adequate classifications for the achievement of those purposes.

While no one is obliged to give information under the Bill, it will certainly make persons more inclined and ready to give such information than they might otherwise have been, and will make unauthorised disclosure of the kind that the medical profession is worried about more easy to bring about, from whatever motivation.

We have previously commented on the inclusion of the assessment or collection of any tax or duty. I recollect that one noble Lord said that this part of the Bill is not a data protection provision but a data transfer provision. It is something that we do not think is suitable for inclusion because, here again, if the intention is to deal with cases of fraud, then 20A or 20B should suffice. It is quite excessive to exclude material relating to tax altogether from access provisions.

There is one matter of great concern which I think the Government should examine with even greater care than they have so far given. The noble Lord has emphasised that one of the two main objects of the Bill, apart from the protection of privacy, is to ensure that the Bill will bring us into compliance with the provisions of the international convention. We gravely doubt whether that is so, particularly as regards the aspects of control of immigration. In our view, those responsible for interpreting the international convention may very well rule that this clause puts us out of court, and that will destroy one of the main objects of the whole exercise; and so we entreat and beg the Government once more to have a fresh look at Clause 28 of the Bill.

4.6 p.m.

Lord Avebury

My Lords, the noble Lord the Minister confessed that he is a simpler man than the noble and learned Lord the Lord Chancellor. I do not know about that, but he is certainly more likely to act under the direction of Sir Humphrey Appleby—a character who figured in our discussions on the previous Second Reading—because he clearly is alive and well and working in the Home Office. We frequently see his hand in the activities of the noble Lord the Minister.

When the Bill to which this one bears some resemblance came before your Lordships in January, my noble friend Lord Wigoder said that it ought to have three main objectives. I will not repeat his words but, broadly speaking, the objectives he had in mind corresponded with the data protection principles which we find in Schedule 1, together with another objective which my noble friend enunciated; namely, that business efficiency should be promoted through computerisation and that no barrier should be raised to international trade because of inadequate data protection in this country.

My noble friend did not say, and we do not maintain, that the methods which have been adopted by the Government in this Bill are incapable in principle of satisfying those requirements. We concede that the data protection principles set out in Schedule 1 are those we would want to see applied, and we accept that an independent registrar can effectively exercise powers of supervision over data users to see that they do comply with those principles. We agree that legislation on something like these lines is necessary to enable the United Kingdom to ratify the Council of Europe Convention for the Protection of Individuals with regard to Automatic Data Processing of Personal Data, and that we must accede to the convention or there could in future be restrictions on the flow of data into this country from states which have signed it, with damaging effects on business.

However, we very much regret that a Bill which ought to have received a universal welcome as an extension of the civil rights that we enjoy in this country has been framed, on the contrary, in such a manner as to cause grave and justified alarm, as the noble and learned Lord, Lord Elwyn-Jones, has pointed out, among many sections of our community, and in particular lawyers, doctors, bodies representing ethnic minorities and civil liberty organisations. That is because of the Government's insistence, in the face of powerful arguments against it, on exempting personal data held for the purpose of the control of immigration from the subject access provisions of the Bill, and exempting personal data from the nondisclosure provisions where disclosure is for immigration control purposes.

We understand there has to be derogation from the data protection principles in the case of personal data held for the purpose of national security, the suppression of criminal offences and the monetary interests of the state, or, in the case of personal data held by other users, disclosure for any of these purposes. Of course, those matters are specifically dealt with in Article 9(2) of the convention. But the convention does not say, and nor did the Government in their White Paper, that there should be any derogation from the principles for the purposes of immigration control, except where criminal offences are at issue.

My reading of the convention, like that of the noble and learned Lord, Lord Elwyn-Jones, satisfies me that what the Government are doing here is ultra vires the convention and could be challenged by another party before the consultative committee under Article 19. It could also, as I see it, be the subject of a petition to the European Parliament as provided under Rule 108 of the Parliament's Rules of Procedure, which could then result in an impartial examination of the compatibility of our legislation with the convention. I am sure nobody wants to see that happening, and the United Kingdom being put in the dock for its violation of a convention which it purports to sign.

Article 11 provides that no limit shall be placed on the power of a party, to grant data subjects a wider measure of protection than that stipulated in this convention. It was never envisaged that paragraph (b) of Article 9(2), which allows derogation where it provides a necessary measure in a democratic society, in the interests of protecting the data subject or the rights and freedoms of others, should be used, on the contrary, to narrow the measure of protection of particular classes of subject, as the Government are, in effect, doing to ethnic minorities by including the control of immigration in Clause 28.

The Minister said, when he was challenged on this matter during the last round, that paragraph 9(2)(b) did cover what the Government are proposing to do. He said at col. 644 of the Official Report for 15th March: the proper enforcement of immigration control is clearly in the interests of people who are lawfully in this country. Immigration control is concerned not only with numbers, although we must not forget the pressures and strains on our multiracial society which would follow from unbridled immigration. In other words, he was saying—and I hope that the noble Lord the Minister will correct me if I am wrong—that the rights and freedoms of others would not be protected in the absence of a provision such as I am now discussing. He did not attempt to show that what is now being done is, a necessary measure in a democratic society"— a phrase which has been construed in a far more limited way in other contexts. This is a matter which we shall want to come back to in Committee.

The Minister's interpretation must be wrong on two counts. First, we are here concerned, as the noble Lord the Minister explained, with the detection and apprehension of over-stayers who are not subject to prosecution, and the exclusion of short-term entrants who may have been refused leave to enter on a previous occasion. The number who will be refused leave to enter, or who will be deported as a result of the flow of information from other systems into the Harmondsworth computer, will be very small, and by no stretch of the imagination could their presence in the United Kingdom be said to constitute a threat to the rights and freedoms of others. But, more importantly, in the context of a convention which deals with the rights of individual data subjects, it is clearly the rights of individuals which are referred to in paragraph 9(2)(b), and not the collective rights of the people settled here, to which the Minister presumably was referring. On the other hand, we demonstrated before that the rights and freedoms of people legitimately in this country were threatened by the Government's proposals, and I shall briefly recapitulate those arguments now.

As matters stand today, data users who control personal data, such as banks, financial institutions, local authorities, hospital authorities or the Inland Revenue, would not release information about a client in response to an inquiry from an immigration officer particularly where there is no suggestion that the person in question may have committed some criminal offence. But, if the Bill becomes law in its present form, they will be statutorily relieved of the obligation of confidentiality, and although, as the Minister explained, that does not mean that they will be compelled to disclose information, there will certainly be the very strongest pressure on them to do so.

The particular case of tranfers of information from other Government departments to the Home Office is of paramount importance. The Minister said that, by virtue of what is now Clause 36(1), each Government department will be a separate user and, therefore, a tranfer of information from one department's computer to another would be a disclosure under the Bill. Clause 28(2), he added, would not lead to more such disclosures than there are now. The question is whether, for instance, the Department of Health and Social Security or the Department of Employment give information about their clients to the Home Office now. If they do not, it would be quite simple for them, when registering, to give the name of the Home Office as a person to whom they may wish to disclose data when asked to do so for the purposes mentioned in Clause 28.

But the effect of this provision, as the noble and learned Lord pointed out, on the minds of people who are lawfully resident here is likely to be traumatic. Mr. Hugo Storey of the Hareshills and Chapeltown Law Centre in Leeds has said that, because of interchanges of information which are occurring already between welfare state agencies and the Home Office, the overwhelming experience of people working on the ground in ethnic minority communities is that some people who are entitled …are being deterred from use of services and benefits. Since everybody knows that it will be overwhelmingly the members of ethnic minorities who will be the subject of transfers of information for the purposes of immigration control, black people may fear coming to the notice of any agency of the state if they can avoid it, just in case their names are then recorded and passed on to the Home Office computer. They may even refrain, as the noble and learned Lord pointed out, from seeking medical treatment that they need. The British Medical Association's strong views on this have been expressed to us again, though I shall not repeat what the noble and learned Lord has already said on that point.

I believe that the Government are now turning their attention from the contol of immigration at ports of entry, where a declining number are seeking admission to this country for settlement, or qualify to do so, to the tighter control of immigration within the boundaries of the United Kingdom. It used to be said that we needed a strict control at the ports of entry because, unlike some other countries such as France, we allowed free movement within our boundaries, and persons once having entered were not subject to checks of any sort. But that situation is now changing, as access to employment, education, social security benefits and medical treatment are all made subject to increasingly rigorous checks of a person's eligibiltiy. To the extent that this Bill reinforces the system of internal controls, it will have the effect of damaging race relations, reinforcing the alienation felt by some minorities and denying access to essential services to many people who are legitimately entitled to them.

I now turn briefly to some other criticisms and, first, I must agree again with those who suggest that manual systems ought to have been covered, as well as personal data held on computers. The convention provides for this in paragraph 2(b), and I believe that some other signatories of the convention have drafted their legislation accordingly. I would remind your Lordships of what was said by the Younger Committee in paragraph 580 of their report. They said: Of all the forms of invasion of privacy which have been cited in evidence to us that involving the use or misuse of computers has been the least supported in concrete terms. Although 11 years have elapsed since then, I doubt whether a committee which was examining the matter today would reach any different conclusion.

Manual systems are far easier to penetrate by burglary, as we saw from the recent offences committed by South African agents who stole confidential files from the anti-apartheid movement. They are easier to access by impersonation, too. In the old days, it was fairly common for unscrupulous inquiry agents to impersonate police officers to get details of, for example, car ownership. However, we know that the Government are not really so much concerned with the protection of data subjects, but merely with ratification of the convention, for which purpose manual records can be safely ignored. I would only say here that the distinction is likely to become blurred with the spread of machines which are capable of reading ordinary text, as we pointed out before, and we shall have to return to this subject at Committee stage.

The next reservation we have about the Bill concerns the powers of the registrar. Under Clause 40, he cannot refuse an application for registration except in very limited circumstances, nor can he issue an enforcement notice until two years after the date appointed by the Secretary of State for registration to begin. During the whole of this period, there is nothing to stop a data user from contravening every single one of the principles set out in Schedule 1. The Minister may say that retribution awaits him after that period has expired, but the unscrupulous data user might set up a company for this purpose, go into liquidation after two years and then start up again under another name.

When the Bill is fully in operation, if the registrar suspects that a user is contravening the data protection principles he has no power to require the user to provide information. He has to get a court order to go in and search the suspect's premises. There is no specific requirement on the registrar to investigate complaints, and if he declines to do so there is no right of access to the Parliamentary Commissioner for Administration. So we cannot agree with the Minister when he says that what is being done in Clause 34(1) should remove, as he put it, lingering doubts about the active role of the registrar. Very much will depend upon how the registrar interprets his responsibilities under Clause 34, but we should prefer to have those spelled out in the Bill in the manner I described.

Finally, the Lindop Committee recommended, as the noble and learned Lord pointed out, the use of codes of practice to which particular classes of user would adhere. We still consider that the idea is a very useful one. The main objection raised by the Government seems to he that the registrar might have to cope with very large numbers of these codes. I do not believe that that has happened in the case of the health and safety legislation, where one would imagine that the differences between one employer and another are likely to be very much greater than the differences between data users and therefore that there would be more codes in the case of health and safety than there are likely to be in the case of data protection. Nor do I accept the Minister's comments on the inflexibility of codes of practice. Undoubtedly this is a matter to which we shall have to return at the Committee stage.

Having disposed of the main criticisms which we have to offer, it is fair that I should conclude with a small cheer for the new exemptions from registration. We welcome the exemption of payroll and accountancy systems and of personal data which the user is statutorily obliged to make available to the public, which includes the electoral register, as I understand it. If we can avoid clogging up the registration process with systems which are perfectly innocuous, it should enable the registrar to concentrate his limited resources in the areas where scrutiny is likely to be more necessary, although I realise that a contrary view has been expressed and that some people believe that these payroll and accountancy systems, while they can he excluded from registration at the beginning of the system, might have to be brought in at a later date, if this is found to be necessary. That is something we may like to consider.

We also very much welcome the attempt to exclude text processing in Clause 1(8), even if we may have some doubts about its effectiveness. However, my noble friend is grateful for the attention which was given by the Government to his proposal.

The inclusion of persons representing the interests of data subjects on the Data Protection Tribunal in 3(5) (b) is an improvement, as is the power of the court to order that inaccurate data be rectified or erased without the data subject having to prove that he has suffered any damage. The new Schedule 4, setting out the powers of entry, search and seizure—which retains the circuit judge which your Lordships inserted last time—sets out the exemptions from seizure (mainly communications subject to legal professional privilege) which many of your Lordships were demanding. And the additional safeguards in paragraphs 2(c) and 7(2), which were mentioned by the Minister, are good.

There is one other change upon which I ought to comment before I sit down. It is to Clause 33(5)(c), which quite sensibly exempts from the non-disclosure provisions any case where the disclosure is by a data user to his servant or agent. As I understand it, in consequence of this Clause 36 has had to be amended so that a person who is in the public service of the Crown is to be treated as a servant of the department to which his responsibilities or duties relate. This appears to have the effect of enabling personal data to be passed by the mother department, as it were, to bodies such as the Health and Safety Executive, the Commission for Racial Equality or the Civil Aviation Authority, unless it be that the definition clause, Clause 39, has the effect of making each of these bodies, and others similar to them, into government departments. If that were so, I would suggest that it is a rather misleading definition, but perhaps the noble Lord could clarify this point when he winds up.

If my first interpretation is correct, it appears to me that none of these bodies would have to register as separate data users but that they would come under the blanket registration of the department to which their duties or responsibilities relate. Indeed, since chief officers of police—I think the noble and learned Lord mentioned this—are "persons in the public service", all of them would fall to be treated as servants of the Home Office under this provision, and all police computers would be registered under the one application of the Home Office. If that is the correct interpretation, it must surely be an unintentional effect of the drafting. The spirit of the Bill must require separate registration of individual police forces and also. I would suggest, of statutory bodies. It is bad enough that all systems owned by large federal departments such as the Department of Health and Social Security should be covered by one registration. I hope that the Minister will be able to assure us that, even if that is so, the entries in the register will enable a person inspecting them to distinguish separately each of the major systems operated by the Department of Health and Social Security, for example, or the Home Office.

The Bill has been somewhat improved at the edges as a result mainly of the work done by your Lordships last time. It still includes, however, features which have attracted strong criticism from bodies as diverse as the Consumers' Association, the British Medical Association, the National Council for Civil Liberties and the Joint Council for the Welfare of Immigrants. I urge the Government not to use their majority to force through proposals which arouse widespread and reasoned opposition but to remember the dictum of a former Prime Minister and distinguished leader of the party opposite, Lord Salisbury. By a free country". he said. I do not mean a country where six men may make five men do exactly as they like". Still less, presumably, did the noble Marquess mean a country where four men may make six men do what they like. It is on controversial Bills such as this that we should test this Government's commitment to the principles of democracy.

4.27 p.m.

Lord Mottistone

My Lords, like the noble and learned Lord, Lord Elwyn-Jones, I have to apologise to your Lordships for the fact that I shall have to leave the Chamber shortly after I have ended this speech in order to attend a meeting in another part of this House which has been long arranged, though I hope to return here before the debate is concluded.

I did not think that the words of the noble Lord, Lord Avebury, were very generous. Notwithstanding the fact that some of his words were all right, there was a rather unpleasant ring to his tone. This Bill deserves three cheers, not just a little cheer. My noble friend and his officials have done a splendid job in incorporating so many of the improvements which we debated when a similar Bill passed through this House in the previous Parliament. I should like to congratulate and, indeed, to thank them.

Because of what was said by the noble and learned Lord, Lord Elwyn-Jones, and even more by the noble Lord, Lord Avebury, it will not be so easy for us this time to do what we did when the Bill came before us previously. All of us, including the Front Bench, sought to obtain something which was within the parameters which had been clearly laid down by the Government. I believe that we nearly reached that stage. There will of course be ways in which the Bill can be improved. There always are.

I hope to be advised in such a way as to encourage the Government to make some amendments of detail; but I really do believe that we have already fought the main battles and that we should view this occasion as the time when those battles have been fought. It would be slightly tedious for the House to have to go over ground that we have already covered and for all the arguments about immigrants, which the noble Lord, Lord Avebury, has already put forward and which clearly have been rejected, again to be trotted out. It would not be in the interests of the House as a whole for that kind of debate to be repeated for its own sake. Therefore I hope your Lordships will agree with me that the main body of work has been done and that we can treat the Bill as we treat Bills which normally start in another place. It just so happens that the earlier battle was fought here, but we are a revising Chamber, which seeks to improve Bills rather than to fight the main battles.

I hope, therefore, that we shall be able to deal with this matter reasonably expeditiously, and get it on to the statute book as quickly as possible, because I believe it is very much needed. It is needed not only to ratify the convention—and I discovered today that there is only one country, so far, that has ratified the convention—but also so that our companies dealing in the appropriate areas of computer bureaux and the like will be acceptable to other people who have ratified or will ratify the convention as being companies with whom business can be done. It has, if you like, an important export role in the sense of international trade coming to us as a result of this Bill having gone through. We should not delay matters any more than we have to.

I do, however, have a criticism of the Bill. As last time, this is not in relation to the Bill itself—and therefore I believe it is more appropriate for this stage. It relates to the Explanatory and Financial Memorandum, where it states that, The Registrar will initially require about twenty staff. I am disappointed that the Government, after the remarks which were made in this House before, have not seen fit to look more closely into that aspect and to amend that figure, because I believe it is positively misleading. When the memorandum mentions 20 staff, it is not made clear what kind of staff are involved. Are they officials, and senior and expert officials? Does that figure include typists, of whom several will be required? Does it include the engineers and other people who will be needed to operate and look after the computer which the registrar will unquestionably require?

If it does not include those people, then perhaps it starts to make more sense—but I cannot believe that it should not include those people, because the people who operate the computer and the people who will be typing the many letters needed—quite apart from the input into the computers themselves—will he an essential part of the registrar's staff. The Government might correct this Bill, before it goes to another place, on that specific point.

This morning, I had the privilege—purely by chance because it was arranged to take place today long before the Second Reading debate on this Bill was arranged—to attend the first half of a CBI conference on data protection. That conference is still in session and is about to finish. We heard much interesting information concerning the experiences of other countries in implementing this kind of legislation. There are one or two points which relate to this question of staff, and which might be worth passing on.

First, in Norway and Sweden they started off with a system which was not unlike ours. Admittedly, Norway did keep written records as well as computer data and, it seems, Sweden did not. That might make a slight difference or it might make a very large difference; the point is that Norway and Sweden started off with a system which, in principle, was like ours. Norway began with 25.000 registrations and Sweden initially had 36,000. Those are very large numbers. Even if, because we are not having written records, we are talking about only half those numbers, it is still a large number to be registered. In the first instance, every single case will, if the forms are prepared and filled in perfectly, and if the advice that goes with the forms is produced in impeccable English (and that does not always happen in Government departments, and one wonders whether it will happen with the registrar), one will still have a whole range of small companies in particular, and some dumb-headed big companies. which are not going to get things right and which will have to ask questions. That will lead to an enormous amount of correspondence.

The Swedes, with this experience, found that it was not necessary to have such a comprehensive programme, and they have simplified matters greatly as from about a year ago. The Norwegians are in the course of doing the same. It may well turn out—and here I direct my remarks to the noble Lords opposite—that all the efforts we are making to get something that looks right may be more detailed and complicated than, in the event, is necessary. Two countries were quoted as examples where data subjects within a particular company had used the facilities provided by the legislation during the past five years. In the case of one, only two people within the company had used it, and they were both journalists seeking to see whether the system worked. In the other country, there were five users, of whom two were officials of the company, one was another journalist, and the other two were genuine cases. That was the case of one very large company in two particular countries.

We may find that we are going much further than we need to go. For that reason, it might be as well to let this Bill go through more or less as it stands, and to rely on the safeguards that we have put in. I note that those who have been grumbling about Clauses 28 and 29 have not drawn attention to the new subsection (3) of Clause 2, which provides safeguards in the sense that the Minister can make regulations to modify the legislation relating to Clauses 28 and 29.

I should have thought that we should have let this go and let this Bill get going; and, bearing in mind that we may be overdoing it, that we should review the matter in some five years' time and cut it down to such size as experience shows to be necessary, remembering that we may well find ourselves following the Norwegians and the Swedes. There are other countries which are not so far down the line as those and perhaps they will set us an example, too.

Lord Mishcon

My Lords, before the noble Lord, Lord Mottistone, moves on to another point, I wonder whether he can help me and, possibly, other Members of your Lordships' House? Is it not a fact that Sweden, for example, insists upon somebody who has been checked for security but who is entirely independent examining police records to ensure that they are properly kept?

Lord Mottistone

My Lords, if the noble Lord will allow me, I will look to see what remarks there are made about Sweden in that respect. The point about Sweden is that, whatever they have in detail, they have greatly simplified their total application of the system. The report I have shows that Sweden, until 1st July 1982, had registration plus licensing of all EDP files, a simplified declaration for standard files, and a detailed declaration for other files. They had 36,000 registrations—and one registration may contain several files. Sweden, since 1st July 1982, have had one licence for a data controller—that is, the data controller within a company—self-regulation within the company. and no inter-country approval for other parties to the European Convention. That is the difference.

The point is that it has come to self-regulation, and I suggest to your Lordships that that is probably what we shall come to. When I do come to put amendments down, I hope that my noble friend will give them the same due care and attention as he did before. I promise him that I shall not land them on his desk so that he has to sit up all night or even work over the weekend. We shall, I hope, have a happy Committee stage without too much aggravation caused by going over previous ground.

4.40 p.m.

Lord Richardson

My Lords, no one has to persuade your Lordships of the importance in the practice of medicine of communication and confidentiality. Therefore, I have no subject in that direction. I have, however, arrived with a brief from the British Medical Association and had the fascinating experience of hearing my clothes, or what I thought were clothes, being stolen by the noble and learned Lord, a past Lord Chancellor. It was slightly disturbing, but it was fascinating, and indeed humiliating, to realise how very much better he made use of exactly the material that I had in my hand. I am, however, left with a minimum of clothing in a brief from the BMA about the importance to patients. This is not concerned with doctors and the doctor relationship but with the doctors' concern for patients as patients. I refer to Clause 23 which deals with compensation for unauthorised disclosure. If the clause becomes law a patient would be required not only to prove unauthorised disclosure—which is fair enough—but that damage has occurred.

What is damage? If mental illness, marital stress, suspected child abuse, abortions and so on, are revealed, surely that must be self-evidently damaging. But there is much more subtle damage that can be done both to a man's reputation and perhaps to his financial expectations. One need only to have lived in a small village for a short time to appreciate that everyone knows everything about you through the local post office. If the doctor, or anyone else who happens to be in the data protection business, goes into the post office and says something indiscreet, damage can occur.

The BMA believe, and doctors such as myself with them, that a breach of confidentiality should in itself be a sufficient basis for proceedings. Otherwise, the proving of damage, either subtle or obvious, may in the first instance be very difficult and in the second instance very damaging and traumatic to the person who is trying to prove it.

My next point concerns Clause 13. This refers to the right of appeal. The clause begins: A person may appeal to the Tribunal". I wish to ask the noble Lord the Minister: who is "a person" in this instance? Is the person an individual who might have cause for complaint that his affairs had been revealed, or is he only a data user? If he is only a data user the patient would have no access to the tribunal to question whether either a decision by the registrar or the action of a data user had been improper.

Medical records are of course held in the service of patients. They are extremely vulnerable and sensitive, particularly in hospitals where they are handled by a vast variety of people with varying degrees of commitment to the patient and to the ethic of confidentiality. I feel that to deny the right of access to the tribunal or to claim that unlawful disclosure is not in itself sufficient for obtaining compensation is really to discredit the concept of data protection.

4.44 p.m.

Lord McIntosh of Haringey

My Lords, in rising to address your Lordships I console myself that I, at least, cannot be accused of repeating today what I said on Second Reading the last time because I did not have the honour to be a Member of your Lordships' House at that time. But I have taken the precaution of reading the debate and I hope that I have gained some benefit from it.

The first point which I took from the debate was the very wise observation of the noble Lord, Lord Digby, who attacked the Short Title of the Bill. He said, in my view quite rightly, that the Bill ought not to be about the protection of data but about the protection of people. That is where some of the remaining defects, despite the improvements to the Bill, still lie.

I go on from attacking the Short Title to say something about the Title of the Bill itself. It is in the Title that the phrase "automatically processed" occurs. In Clause 1 that is defined as 'Data' …information…in a form in which it can be processed". The attempt which is made to draw a distinction between "automatically processed" data and other kinds of data might just about have been plausible in 1970 when Justice produced the first report on this subject. However, it is becoming less and less plausible and less and less technically possible to sustain, and the present attempts to improve it with, for example, the addition of provisions for tax processing to be excluded from the definition, are bound to fail.

In my lifetime at work there have been innumerable changes in the way in which we handle data. I started 25 years ago with a single bank counter sorter into which we fed punched cards by hand and ticked off the numbers that fell into the different slots as we went through column by column and hole by hole. Nowadays most people in my business have by our desks microprocessors with a 64K memory which are capable of doing far more than computers which 25 years ago took up a whole air-conditioned room. It is not merely a matter of sheer mechanical power but what types of data are being processed and the nature of that processing.

May I consider the distinction between numerical data and text, because this is one of the points made in the new subsection to Clause 1. The definition of automatic "processing" in the clause is, amending, augmenting, deleting or re-arranging …information". That definition will simply not work if we try to make a distinction between numerical data and text.

Consider data bases. I have in my office passwords for about 300 or 350 data bases, some of them with thousands of records and some with millions. The way in which these data bases work is not by analysis of numerical data. They proceed by a process of a key word to reduce from an unmanageable number of references the user's attention to those references which will be useful to him in his work. These are texts, not numerical data. The outcome of that may well be a bibliographical reference; it could be an abstract or it could be the full text. In other words, there is no processing in that sense. One has automatic processing of data because one is using automatic processing machinery, but one is doing something from published records in order to gain a greater understanding and to achieve a greater promulgation of information which may be of value.

That very necessary function in the modern world of both business and science falls within the scope of the Bill, as I understand it, and yet it has no relation whatever to the protection of people either as data users or data subjects.

Let me pursue the issue of data which may be produced in a non-automatic way. It is perfectly possible nowadays to have mark sensing of written data which is capable then of being read by a computer, whether the person making the mark on paper with a pencil realises it or not. Is that automatic processing of data? Does the person who is inputting it (writing with a pencil on paper) know that what he is writing comes within the scope of the Bill? I suggest that that matter has not been adequately thought about. Then there are many records which start off as being automatically recorded, where the intention is not to analyse or process but where the records are capable of being transformed to other users by Telex, by using data lines and in many other ways; and those users may, unbeknown to the original user, have data base management systems which will enable them to carry out analyses which had not been thought of at the outset. That again is a serious issue. It is one which affects the privacy of the people concerned at the outset. It is not considered in the definitions to the Bill and it deserves more consideration.

I have only scratched at the surface of the difficulties which the Government will have if this legislation comes into effect. I can assure the Government that these difficulties will become greater and greater year by year as the complexity of data and information processing proceeds and the divisions between the different methods of data and information processing disappear as well.

What this Bill ought to be about is two things: the first is access and the second is denial of access. I suggest that in both of those aspects the Bill is still seriously defective. I shall not go over the many arguments made by other noble Lords both this afternoon and in the stages to which I was privileged to contribute when the Bill came before the House previously. But I must repeat the point which did not seem to be taken by the Government with regard to access. The noble Lord, Lord Elton, in answer to amendments moved from this side of the House about access to criminal data, for example, talked as if what was being proposed in the amendments was to open up records to the criminal fraternity. That was the phrase he used. The point that we were trying to make—perhaps inadequately, but I think that the point has to be made again—is that what is required is access of individuals to the data which refers to them; not to anybody else's data but to their own records.

Experience time after time has shown, particularly in the immigration field, that what purports to be data about an individual, and to be something of value, is inaccurate. My noble friends and other noble Lords who have been members of another place will know from the correspondence and disputes they have no doubt had with the Home Office about immigration cases that over and over again there are errors in the records of the Home Office which even extend to errors about the names of the individuals concerned. It is the right of those individuals to see what is said about them on these data bases. It includes the information which is covered by Clause 28. It is that right which is absolutely vital when we are considering access and it is that right which is not adequtely provided by this Bill.

I turn now to denial of access which is also a basic right: denial of unauthorised or unwanted access by individuals or organisations other than those for whom the information was originally intended. My noble and learned friend Lord Elwyn-Jones has referred to the code of practice which we proposed before should be inserted after Clause 7 of the Bill. I remind the House that those amendments were defeated by only 81 votes to 73. It certainly gives us some encouragement to think that it will be the wish of a number of noble Lords, not merely from the official Opposition, that such amendments should be introduced again.

The point about codes of practice is that they are the only way in which a registrar with a staff restricted to 20 is seriously going to get a grip of the types of data and promulgation of data which are about in the market place, the business world and the scientific world. If there are no codes of practice made voluntarily by groups of people concerned with data, the registrar will find himself in a morass of individual cases and will have no specialised knowledge to analyse them and no ability to deal with them effectively and economically.

I have been concerned with codes of practice for the protection of persons involved in data for all of my working life. As a former chairman of the Market Research Society, it was my responsibility to see that the society had adequate codes of practice defending those who answer questions, who carry out inquiries and who commission the inquiries. There is no difficulty about having codes of practice talking about the protection of all those concerned in data. There is no reason whatsoever why the Government should resist the very reasonable arguments which were put forward the last time and which must be put forward again for codes of practice.

I have selected only a couple of issues: one on access and the other on denial of access. I have deliberately refrained from going into the issues which were raised by the noble Lord, Lord Avebury, and which no doubt will be raised by other noble Lords, despite the wishes of the noble Lord, Lord Mottistone. We will have to go over some of these things again—these issues of civil liberties. Although I welcome many of the amendments put forward, I suggest that the Bill, as redrafted, will still prove to be seriously defective and will deserve the earnest consideration of this House.

4.57 p.m.

Lord Swinfen

My Lords, the noble Lord. Lord McIntosh of Haringey, who has just spoken, has stolen my thunder on both the points that I wanted to raise. He has said very much what I was going to say but very much better. However, I was deeply concerned that all the stages I took part in of the previous Bill in the last Parliament the Government advisers did not seem to understand what a modern computer could do—what it was capable of doing—and did not have a great deal of imagination.

A point that has been worrying me is that the data subject has the right of access to data held by a data user on equipment owned and operated by that data user. But I understand that it is technically possible for a computer to be so programmed that, if it does not have the information required when asked a question, it can get in touch, if properly connected, with other computers owned and operated by other data operators. What is the position if a data subject asks an operator what information is held on him? Does he have to be given only the information held on that particular computer or must the data operator advise him that he has means of getting additional information or data, where that data is coming from and indeed of what it comprises? This is a problem that can grow.

I am told that it is not always easy at the moment to use the telephone lines to connect one computer to another, but British Telecom is about to go into private hands, your Lordships being willing, and I am sure that over the years to come the telephone lines will be vastly improved; or, if they are not improved, the equipment used to transmit messages over them will be improved in such a way that the messages will come through quite clearly. The difficulties of one computer talking to another will be reduced. This is a knotty problem which I feel needs some looking at.

The other question that I wanted to raise—it was also raised by the noble Lord, Lord McIntosh—is that of codes of practice. Like the noble Lord, I believe that such codes are absolutely essential, and I trust that my noble friend on the Front Bench will seriously look at the question of their provision. I was going to urge him to make certain that he does not impose codes of practice on the industry, but that he gets the industry to advise him on what codes are necessary. The people in the industry know from first-hand knowledge how the industry works. They know where the industry can go wrong, how it can be unfair to individuals, and they know how to phrase the codes in such a way that the loopholes that are there can be plugged, or at least reduced. I say that because they are the people who, if the codes of practice are there and they want to get through them, will know how to make the loopholes and how to get through the codes. So in this case it is essential to make the poacher turn gamekeeper and assist the Government.

I hope that my noble friend will bear very seriously in mind what the noble Lord, Lord McIntosh, has said, and come up with some sensible answers on both points.

5.1 p.m.

Lord Hatch of Lusby

My Lords, on the surface one would expect a Data Protection Bill to have as its main purpose the rolling back of the dangers foreseen by George Orwell in 1984. To an extent this Bill does that, but in one respect it denies itself and, in fact, increases the 1984 dangers for one community in our country, and by doing so it thereby invalidates its basic principle. I say that because if the Bill becomes an Act still allowing the exception of one community, if it is not universal in its application to all members of our society, then it will have turned and eaten its own tail.

I make no apologies for returning to the theme of my Second Reading speech when the Bill was brought before us on a previous occasion, and I do not apologise to the Government for saying that it is with very deep regret that I, and many people in the country, have seen the obduracy with which the Government have refused to recognise the cogency of the arguments put to them on Clause 28. I could not better the words of my noble and learned friend Lord Elwyn-Jones. I would again stress what he said about the opposition of the BMA and the importance of the whole question of doctor-patient relationship, about which at least very grave doubts are raised by Clause 28.

Again I ask the noble Lord the Minister to reflect on the way in which Clause 28 denies the very principles that are written into Schedule 1. With those principles we could totally agree. Those principles have the effect of doing what I have just described—rolling back the dangers of George Orwell's 1984. I refer in particular to Principle 2 and Principle 3. Principle 2 states: Personal data shall he held only for one or more specified and lawful purposes". Principle 3 states: Personal data held for any purpose or purposes shall not he used or disclosed in any manner incompatible with that purpose or those purposes". Yes, those are the principles on which the Bill is supposed to be based—with the exception of those who are classified as being subject to immigration control. I say advisedly that the exception relates to one community, because the individuals who break the law, the individuals who are guilty, or who may be guilty, of fraud, are not a community; they are individuals. But everybody in this House knows that the control of immigration applies to one set of communities in this country, and to one only. I hope that nobody will suggest that the control of immigration applies to Australians, Canadians, Americans and so on, because we know very well that it does not. The control of immigration in this context refers to the ethnic minorities—to the West Indians, to the Africans, to the Asians. It refers, in fact, to coloured people.

In the previous Second Reading debate I suggested that it was an insult and was highly offensive to lump together the community of the ethnic minorities in this country along with those who have broken the law; with thieves, with tax evaders, with those who have become criminals. But the Bill still does exactly the same. I agree with much of what has been said so far in today's debate but whatever we may say about the minutiae, about the particular points, about the codes of practice and so on, so long as paragraph (d) of Clause 28(1) remains, so long as the ethnic minorities in this country, those under the control of immigration, are lumped together with thieves, tax dodgers and criminals, so long will there be an open discrimination within the Bill against those ethnic minorities.

That completely invalidates any claim that, as it stands, the Bill itself is a defence against the 1984 syndrome. It denies itself by including this specific discrimination; this specific division of the British nation into those who are considered to be fit to have access to their own data, and those who are not; and it divides them on the grounds of colour. I specifically do not say "racial grounds" because that is a misused term. The Bill divides them on grounds of colour.

As my noble and learned friend has stated, the doctors themselves are very worried that as this point becomes known so many patients who should be revealing to doctors facts about their state of health will not feel confident enough to do so. They will deliberately hide some of their complaints because of their fear that the information may be passed on—it may not be passed on by the doctor; it may be passed on without his knowledge—to the Home Office under the very loosely termed "control of immigration" provision. Can it be defined in legal terms what "control of immigration" means? Is it not an over-generalised term which can be used for many different purposes? If so, then it is a great danger to any Bill to include such a term in it but particularly in this kind of Bill where, as my noble friend Lord McIntosh has pointed out, it concerns people whom we wish to protect and whom the Bill should aim to protect.

I wish to strengthen and deepen the concern of this House about the dangers to community relations in this country, to the concept of racial equality and to the attempts now being made to consider ourselves as one nation and not a set of communities at odds with each other. It was stated in the other place, I believe, by the spokesman for the Government, that one of the defences for the clause was that it does not diminish the rights and the protection under the present law. It does. We must face the fact that it does.

If the Home Office today wants to get information on someone who, in the words of the Bill, is subject to immigration control, that individual has to sign a form to allow the Department of Health and Social Security to secure that information from the doctor and then to pass it to the Home Office. In other words, the individual and the doctor are fully aware of the fact that the Home Office wants such information. No doubt, the individual concerned can ask the doctor, if he is supplying that information to the Home Office, to supply him with a copy. Under this clause, that cannot be done and will not be done because the exemption from the protection of personal data—the exemption (d) in Clause 28 relating to control of immigration —means that what can happen and what is very likely to happen is that the decision on whether health data are passed to the Home Office will be taken, not by the individual and not even by the doctor, but by some administrator, probably some health administrator, who has to decide whether or not he is convinced of his justification in passing on such information. No one should be placed in that position and no Bill should give such power to an administrator to pass on information without the knowledge of the doctor or the individual.

When the Government say that the administrator is not compelled to pass on this information, what does that do? It puts the administrator in the position of becoming the judge as to whether the application for the information is justified or not. Surely, no one should be put in such a position of power over intimate and important information on an individual citizen. I suggest that this clause takes away existing rights solely on the ground of the Government's commitment to their own suporters to limit and, if possible, to reduce immigration. This is a shabby way and a very dangerous way—

Lord Inglewood

My Lords, may I ask the noble Lord a simple question to clear up the point that he makes? The noble Lord was speaking about doctors perhaps parting with information that comes their way because an administrator in the Home Office may require something of that kind. Has he made clear the position of the police who are in a difficult situation and who, under the terms of the Bill, can be put in an extremely dangerous position?

Lord Hatch of Lusby

I agree entirely with the noble Lord. I would, however, correct his interpretation of what I was saying. I understand that, under the Bill, the doctor himself may not know that the information is being passed on. It is not necessarily the doctor. The doctor, or his assistants, can feed the information into a computer. But that information, under the Bill, can be passed on to the Home Office authorities without the doctor knowing at all. The doctor does not own the computer. In all likelihood, the doctor does not even control the computer. So the information on the patient supplied by the doctor into a computer can be passed on by whoever controls the computer without the knowledge of the doctor and certainly without the knowledge of the patient. That puts health administrators into the impossible position of having to make a judgment and also into the very dangerous position of being the individual with the power of decision.

These kinds of circumstances are bound to lead, and have already led, to great fears, great community fears and great racial fears, and also to great fears of division within the British nation. That is surely not the purpose of the Bill. The purpose of the Bill, despite the fact that the Government had to be prodded by the European Convention to produce it, is surely to increase the control of the individual over his own personal privacy and over the private facts to which only he and those to whom he reveals them, like his doctor, should be privy.

As the Bill is drafted, it will not achieve that purpose. It will divide this nation into those who have extra privileges and extra rights compared with the present position and those who have less. That must surely not be the intention of the Government.

5.18 p.m.

Lord Donaldson of Kingsbridge

My Lords, I do not by any means always agree with the noble Lord, Lord Hatch of Lusby. The noble Lord sometimes expresses his views rather more strongly than I should. However, I stand behind his general approach to Clause 28, and I shall come back to that. It is the crux of the debate. But, before doing so, I propose, unlike many noble Lords here, to make a short Second Reading speech. Most of the speeches have been Committee stage speeches. We are accustomed to doing things the other way round. There is hardly a Committee stage that does not contain a number of Second Reading speeches. Today is rather unusual. This is because you have all heard it before.

I have been luckier than a good many noble Lords in the Chamber today, in that I was abroad for pretty well the whole of the debate in Committee on the previous Bill. To be doing the whole thing over again does not seem quite so tedious for me as for others, not least, I suppose, the Minister. My noble friend Lord Perry, who, unlike most of us, is well versed in computer technology, and who sat through every part of the Bill except Second Reading, voted in general with the Bill's critics. He was, however, so sceptical of its usefulness that he seldom intervened. He felt, I think, that it was beyond useful amendment. He began to express this scepticism during the debate on the Motion. That the Bill do now pass, but was abruptly and improperly stopped in his tracks. So much is on the record.

What is not recorded—and it is to bring it on to the record that I refer back in this way—is that he received two handsome apologies which he gladly accepted, and no hard feelings remained. But the House was the poorer for not hearing what he would have said. Indeed, what he would have said would have been a good preliminary to the excellent two speeches that we heard from below the "generation gap"—that is, from the noble Lord, Lord McIntosh, and the noble Lord. Lord Swinfen, both of whom have some acquaintance with computers whereas most of us are fairly remote from them.

The type of thing that my noble friend would have said would not have been very different from the uneasiness about the Bill felt by my noble friend Lord Flowers an ex-chairman of the Computer Board who knows more, or certainly not less, than anybody else in this House about computers and computer technology. He feels that there is a lack of appreciation in the Bill and. indeed, in the EEC, of the scale and impetus of the computer explosion. He feels that the very complex regulations to protect the private individual from unfair treatment may easily put a brake on the healthy and extraordinarily rapid expansion and technical evolution going on month by month, and that would be disastrous. I think that he is right in that respect and I am sure that the noble Lords to whom I have referred would agree with me. Perhaps I may amuse your Lordships by an example from my own family.

At the time of the publication of the Lindop Report my elder daughter had just "touched me" for a little bit to help her buy her first microchip computer. Today she has two, and is making a nice living. My second daughter also has two computers and is also doing well with them. Three of my grandchildren have one each and there are eight more grandchildren to follow, if they can find the cash. Each one of these is in a position to make a data bank of any information that may be useful or amuse or interest her or him. And this is happening all over the country and indeed all over the world, not excepting the third world.

I do not think that we can have a new and entirely different Bill now, and even if I thought that we could do so the Government's majority would see that we did not. But what we can and must do is to insist on flexibility at every turn. In particular, I think that the Bill, where it fails to follow the Lindop Report, is usually wrong. Flexibility is best obtained, surely, by a registrar who is entirely independent and able to accept and enforce codes of practice, as so many noble Lords have said, and he must be supported by a strong advisory body. We are not allowed to have a data protection committee which we should have liked, but even without that, the advisory body must advise him rather than the Minister. All vulnerable bodies should be represented on this advisory body, such as the BMA, those concerned with civil liberties, mail order firms, the police, and so on. However, those are points which we must deal with in Committee.

I visualise that within five years there will be so much computerised information available in all subjects and in all directions that it will become impossible to regulate it as the Bill proposes. I think that the eventual solution may lie along the lines of coding sensitive information rather than trying to regulate it, but that is for the future. At any rate, several noble Lords including the noble Lord, Lord Mottistone, and the noble Lord, Lord Swinfen, have asked for eventual self-regulation. In a sense I take the view that that is absolutely bound to come and so it is very important that we do not saddle ourselves with a lot of regulations that we cannot get out of when the time comes.

I should like to make one or two comments on the debate. Of course we are pleased with the changes which the noble Lord announced. Without exception they are improvements, but as everybody else has said, two matters have not been dealt with and they arise under Clause 28. Under subsection (1)(d) we have not dealt with the civil liberties problem of immigration. Also, as I think the noble Lord, Lord Richardson, made clear, we have not dealt with the doctors' problems to the satisfaction of the doctors. The Bill cannot be accepted if both those matters are, frankly, wrong.

Therefore, I was astonished by the appeal of the noble Lord, Lord Mottistone—and he will forgive me for referring to him in his absence—that we should not make too much fuss about matters that have already been discussed. The point is that we now have a chance to put right two things which are grossly wrong. I hope that we shall fight to the last minute of the last hour to do so regarding those two matters because they are absolutely fundamental to civil liberties everywhere. There is the question about interfering with the doctors' freedoms. I do not wish to go into the details because such matters are for the Committee stage. The immigration control aspect has been discussed over and over again. The noble Lord, Lord Mottistone, made the appeal that we should not use the arguments too often. We have to go on until we get some appreciation of them from the other side. We must do that.

The noble Lord, Lord McIntosh, was most interested in the difference between the manual and the processed information. As regards those matters, I think that I agree with the noble Lord, Lord Mottistone. We must accept that this Bill, imperfect though it is bound to be, would be even more restrictive and difficult if we tried to include manual information. We must strengthen the civil and criminal offences for misusing information of this kind, and that will come later on.

The question of codes of practice seems to be absolutely fundamental. For example, if one talks to the mail order firms one finds that there is not the slightest doubt that what they are doing is perfectly innocent, except it is rather a nuisance to some of us to receive so many letters, but that is their business and we can always throw them away. It is absolutely innocent. It would be intolerably restrictive to prevent them doing it in any way. On the other hand, exactly how to frame the regulations is not at all clear from the Bill and I think that the mail order firms should put forward their code of practice which should be discussed by the registrar who should deal with the matter. I very much hope that we can get some movement on these fundamental questions.

From this Bench we shall support the main and stated intentions of the Bill—namely, to bring us into line with the European Convention which we have, after all, signed, and to go some way to relieve the manifest anxiety which exists that individuals may easily suffer damage from the release of confidential information held, processed and exchanged by these new and rapid methods. We believe that the importance of our discussions in Committee should be to prevent the legislation passed from being so rigid that the nation later fails to take advantage of the new technology which is advancing so fast that legislation may not be able to keep up with it.

We shall support the efforts of my noble friend and colleague Lord Avebury in the defence of civil liberties—nobody is more active in that field than he, and I shall be very happy to play second place to him as regards that matter. On the question of the legal problems, as so often in the past, we shall follow and support the noble and learned Lord, Lord Elswyn-Jones, and the noble Lord, Lord Mishcon. I hope, with their help, to be very nearly as quiet in Committee as my noble friend was before me, although perhaps not quite so quiet, but I will do my best.

This Bill is rather a mess. It would have been much better not to have had it until it had been better thought out. But it contains two monstrous clauses with two monstrous effects which must be removed. Otherwise, so long as we make it flexible enough to be altered as situations alter—and they are altering day by day—we on this Bench will support it.

5.30 p.m.

Lord Mishcon

My Lords, I am one of those who have to plead for your Lordships' tolerance, since as I am winding up for the Opposition on the Second Reading on this occasion, some of your Lordships may remember—possibly not with infinite pleasure —that I similarly wound up for the Opposition on the Second Reading when the Bill came before your Lordships previously.

Apart from the question of tolerance in this House, there is a golden line of courtesy which is part of our tradition, and I try to follow that line when I remind your Lordships of some words that were spoken by the noble Lord, Lord Donaldson, about the noble Lord, Lord Perry, who indeed intervened on the last occasion when the actual Motion was the very last one concerning the Bill—That the Bill do now pass. I was the guilty person who rose and drew the attention of the noble Lord, Lord Perry, to the fact that one had not heard him contribute before and it was not very helpful to make, as I thought, a destructive speech about the Bill on an occasion when it was too late to do anything. I regretted that remark very much indeed when I heard that in fact the noble Lord, Lord Perry, had been present at every stage of the Bill. 1 own up to your Lordships—the noble Lord, Lord Donaldson, did not mention my name—that I was the person who intervened and I was the person who gave the humble apology, and I meant every word of it.

I now revert to the Bill and its Second Reading. In his very interesting opening speech, the noble Lord, Lord Elton, spoke in terms of "subtle expertise" that was the property of others and not himself. I know of nobody who has such subtle expertise as his in the art of debating, and this was exploited to the full in the way he conducted with such elegance the proceedings on the last occasion; and that elegance has been repeated today. With his subtle expertise he will say that if no organisations oppose any Bill he moves, how right the Bill must he because there is no opposition. Then, when he moves another Bill and you point out that the National Council for Civil Liberties, the doctors, the lawyers, the immigrants and goodness knows how many other associations are, from one side or the other, attacking the Bill, he says, "We must have got the balance about right". Therefore, upon this occasion I suppose we shall hear that we must have got the balance about right in this difficult task of trying to protect the users and the subjects and also of obeying the words of the convention.

I thought that the speech of the noble Lord, Lord Mottistone—and it is not the first time that I have had to say this—was very amusing. I usually say it when the noble Lord means it to be amusing, but on this occasion I say it when he did not mean to be amusing. It was so amusing because every amendment that was suggested by the CBI and was accepted meant that, from the point of view of the noble Lord, this was now a very acceptable Bill: whereas, of course, the fact that the Government did not accept any one of the major amendments of the National Council for Civil Liberties also meant that it must be a very good Bill and that no further discussion was necessary.

It is a frightening Bill. It must be tackled because the convention makes it necessary and the age—this electronic era—makes it necessary that one should look at precisely what is happening on computers and at how the data subject must be protected, and the data user himself not oppressively used. It is a difficult balance. I envy my noble friend Lord McIntosh his knowledge of this subject, but you do not have to be a Lord McIntosh or a Lord Swinfen, who also has a great knowledge; all of us know how frightening the computer is. In the days of my youth it used to be a great event to be able proudly to write to a bank manager and say that he had made a mistake in the bank statement, which was then typed or written. Now it becomes an event in one's life if one does not have to write to the bank manager and point out that on his computerised system there is one mistake after the other and that he has in fact put in your account, if you are very fortunate, what ought to belong to somebody else. However, what is much more likely is that he has debited your account with something that ought to be debited to somebody else.

Lord McIntosh of Haringey

My Lords, I wonder whether my noble friend would accept that logically the two must be equal in the end?

Lord Mishcon

My Lords, my powers of arithmetic are extremely feeble. It may very well be that it results in an equality in the end, but I can only assure your Lordships that in my case so far it has not.

I raise this point, and I raise it at the very beginning, because it seems to me to have gone right the way through this debate when we have dealt with major matters. It is not the fact that somebody may have something correct about you on a data machine—that the Home Office might or that the police might. It is often repeated and I think that it is absolutely right that there should be concentration on the plight of the immigrant and on the plight of the patient. All these matters are right to emphasise. But, to bring the matter home, it could happen to any one of your Lordships present in this Chamber tonight. I wonder whether your Lordships realise the extent of this great area of computerised information just in the police force?

In no way do I detract from one single word that the noble Lord, Lord Hatch, said, supported as he was by the noble Lord, Lord Donaldson, and by my noble and learned friend Lord Elwyn-Jones. I am asking for the safeguard of civil liberties and of the reputation of every single citizen of this country, whatever his colour and whatever may be his status—even the status of a member of your Lordships' House. I say this for the following reason. In February 1983 15 police forces outside London were listed as operating or planning a criminal information system, including criminal intelligence.

I should like to remind your Lordships of how criminal intelligence was defined by the Lindop Committee. It was defined as. speculative, suppositional, hearsay and unverified, such as notes about places frequented, known associates, suspected activities … The police national computer holds information including intelligence on over 5 million people and 400,000 vehicles, as well as keeping an up-to-date copy of information held by the Driver Vehicle Licensing Centre in Swansea on 30½A million vehicle owners. The police national computer handles over 30 million inquiries a year from the police, and I am told that it is now technically possible to link local criminal information systems to the police national computer, thus creating a national police computer network.

The metropolitan police force is a great force, and I shall be the last person from this Dispatch Box to say anything disparaging about it. But although a great force—and I believe that the noble Lord opposite had something of this in mind when he intervened in the middle of Lord Hatch's speech—it has had, as most forces do, as most groups of human beings do, a minority who have let down the tradition and reputation of that force. We have heard about the cases, and we know them. We have to remember that that unfortunate minority exists, quite apart from questions of carelessness.

The metropolitan police force alone has 30 computer systems, including the highly secret 'C' Department computer which handles Special Branch files. I am informed that by 1985 the 'C' Department computer is likely to be holding records on over 2 million people, of whom under 10 per cent. Will be in the category of major, or other, criminals. We are dealing with records that may well involve any single one of the Members of your Lordships' House, of another place, or of other bodies just as respectable as your Lordships.

I am not going to detain your Lordships on this occasion on the question of advisory committees. We have heard all about it. A speech from me on the subject will not add anything to the force of that. We pleaded for codes of practice last time. The point has been made eloquently by others and repetition by me will do no good. The case for the immigration information has been made by others very eloquently. There is no point in my repeating that. But the point I make, and make forcefully, about Clause 28 and other clauses in this Bill is that your Lordships will not know whether there is any information about any one of you on one of those police computers. You will not be able to find out. You will not be able to find out to whom it is passed; to what agency it is passed. You will not be able to have it corrected, because you do not know that the mistake exists.

While the noble Lord, Lord Mottistone, was speaking with his usual collection of information from various sources, one of the points he made was about Norway and Sweden, and how good they were. With his customary courtesy—and I really mean that—he allowed me to intervene and to ask him a question. He was admiring Sweden, and I asked whether it was right that Sweden had seen fit to see that there was a special officer, as I said, checked by security, cleared by security, who had the right to look at police files and see what they were doing and whether they were correct. The noble Lord, Lord Mottistone, said with frankness that that was not in his notes about Sweden. Well, it is in my notes about Sweden, and I have every right to believe that my notes are correct. There is, however, no such safeguard in this Bill.

Therefore, instead of taking the advice of the noble Lord, Lord Mottistone—his speeches are always so good; it is the conclusions he reaches that are so wrong—who asks, since we have been through all this exercise before, what is the point of going through it again? I am going to tell him in my concluding words what the point is. I believe, and not narrowly from this Front Bench, that every part of this House wants to see that our proper liberties are preserved, and that this great big machine does not envelop us, whether it be an envelopment by the State and by the huge—I almost said octopus—Home Office with all its tentacles throughout the police, and so on and so forth.

It is not a matter for the Labour Party only. It is not a matter for the Alliance only. It is a matter for those on the Government Benches who have independent views, and it is a matter for the Cross-Benches as well. I am going to continue this fight, with my noble friends from these Benches, to try to preserve those liberties, and to try to see that they are protected by this Bill. I believe I am entitled to expect that, if we make out a reasonable case in the Committee and Report stages, we shall have the support of all your Lordships.

5.45 p.m.

Lord Elton

My Lords, in my opening remarks I considered how last Session's Bill had been changed to produce the new one now before your Lordships' House. Noble Lords opposite have chosen to concentrate more on what has not changed but in their view should have been. I did not expect that our amendments would satisfy them. After all, there are certain points on which we fundamentally disagree with noble Lords opposite, and it is of course the Opposition's business to oppose. It is therefore the noble Lords' prerogative to dwell upon the ground we trod in the early months of this year, and to remind us that they will be making sure that we tread it again in the coming months—although I hope not with too tedious regularity.

However, try as they might, I think a little glimmer of satisfaction crept in in response to one or two of the amendments by which we have sought to improve this Bill. I hope that at the very least we shall have persuaded noble Lords—contrary to the suggestion that escaped Lord Mishcon's lips last Session; I was happy not to hear it repeated—that we as a Government are only too ready to listen to the views of those who differ with us on the form this legislation should take, and that we are ready, where persuaded by the arguments but not of course otherwise, to take appropriate action.

Let us not forget that as well as many noble Lords well qualified to represent data subjects—indeed, we are all data subjects many times over—there are also many Members of this House with experience and knowledge which will help them to assess the impact of legislation on the persons using computerised personal information. The noble Lord, Lord McIntosh of Haringey, clearly identified himself as one of these. This combination of expertise has ensured a creative debate notwithstanding the difficult and complex nature of the subject.

May I now turn to individual contributions. The noble and learned Lord, Lord Elwyn-Jones, and the noble Lord, Lord Donaldson, were concerned, among other things, with codes of practice. Since this is my first reference to the noble Lord, Lord Donaldson, I should like to say how pleasant and impressive was his illustration of the way computers are proliferating, drawn from experience in successive generations succeeding his own in his own family. Indeed, I wonder whether there can have ever been so many chips off an old block.

If codes of practice had to be prepared to cover the vast variety of circumstances in which personal data are held, it would inevitably delay implementation of the scheme and, in the Government's view, impose an unacceptable burden on resources. Moreover, when we attempted to draft some experimental codes to give ourselves some idea of what they might contain, we found it quite remarkably difficult if they were to have legal effect and to be applicable to all users in each of a variety of sectors.

For, although two users may operate in the same sector, they may use quite different kinds of data in quite different circumstances. So we have preferred to use the general principles as a single overall code of practice. But that is not to say that voluntary codes of practice, drawn up by perhaps representative bodies, will not prove extremely useful as guides to data users in the future.

That, I suppose, brings me to the matter of advisory committees. Again, I have the names of the noble and learned Lord and the noble Lord, Lord Donaldson, attached thereto. I would only say at this stage that we have certainly not ruled out the possibility of setting up an advisory committee made up of representatives of a range of interest groups. That committee might advise not only the Government on data protection matters but also the registrar on particular issues or subject areas, although in any event of course the registrar will be free to seek advice from wherever he wishes.

However, in the interests of maximum flexibility, and given the possible desirability of a committee advising in, as it were, two directions, we tend to the view that it would be best established on an extra-statutory basis. This is, however, an issue to which we are bound to return, and we shall be interested to hear further views, and no doubt an elaboration of Lord Donaldson's own contribution.

The noble and learned Lord, Lord Elwyn-Jones, sought greater precision in the duties laid now, at his instigation and that of others, upon the data protection registrar. In the further discussion that is inevitable upon this, I think we will find that what we have drafted will catch up the duties that the noble and learned Lord would like us to specify; but that is for the future.

The noble and learned Lord spent a little of his time in banging his head against what he described as the brick wall of Clause 28, which he went on to say that I carry around with me. What I carry round with me is probably better described—and certainly more comfortably used by the noble Lord for that purpose—as a security blanket rather than a brick wall. But I ought to say something about the lack of protection afforded by the Bill for personal data acquired for various purposes listed in Clause 28. I know I have said it before, but I should be remiss if I did not repeat it now in view of the repetition of his anxiety and that of many other noble Lords, including Lord Avebury, Lord Richardson and, very forcefully, Lord Donaldson of Kingsbridge and Lord Hatch of Lusby. We shall be dealing with this at length later on and if the noble and learned Lord did not convince me of this, the noble Lord, Lord Avebury, did soon afterwards.

I should like to clear up one piece of misinformation. Your Lordships, and those following this debate outside, should be clear that Clause 28 does not create a single new police power. It gives not a single new right to tax inspectors. It gives not one new course of action to any official of the immigration department, and it poses no single new question to the administrators referred to by the noble Lord, Lord Hatch. Conversely, it does not abolish or diminish any shred of existing civil rights available to our citizens. All it does is to decline the opportunity afforded by the Bill to make it a new offence for people to reveal to those whose duty it is to enforce the law in this country—and now they can freely and should freely do so—the information that is properly in their possession. If such information is improperly in a person's possession—and the noble and learned Lord illustrated how this might be so in the case of a hospital worker transmitting information to the police from a doctor's casenotes—after the enactment of this measure his position would be precisely what it would be now.

Some of your Lordships may feel that I am attacking a target that you have not placed before me. But the transactions in the House are such as to call up that image in the minds of many people following your proceedings. It is proper that it should be removed therefrom.

Lord Hatch of Lusby

My Lords, will the noble Lord give way?

Lord Elton

My Lords, I think not. I do not wish to be discourteous, but there is another debate after this one and I am certain that the noble Lord will be returning to the charge in Committee. If I have him wrong he will put it right there, I am sure, with all the acclaim that is due to him, and the publicity which he believes necessary to keep the record straight.

On the subject of Clause 28 and the convention, the noble and learned Lord, Lord Elwyn-Jones, raised a question of the compatibility of Clause 28 with the provisions of the convention. The noble Lord, Lord Avebury, tried to anticipate my response. I fear that I have to stick to what I said on this in the past. So far as the crime and taxation sections of Clause 28(1) are concerned, it is the derogation provision in Article 9(2)(a) of the Convention on which we shall depend. This permits derogation in the interests of protecting state security, public safety, the monetary interests of the state or the suppression of criminal offences.

In regard to immigration control, it remains our belief that Article 9(2)(b), which permits derogation for protecting the data subject or the rights and freedoms of others, provides what we need. We believe that the maintenance of just immigration controls are in the true interests of all the inhabitants of this country, both collectively and individually. I do not accept the suggestion of the noble Lord, Lord Avebury, but the others in this context are individual others rather than collective others, if I may put it that way. An individual man or woman who is stood out of a job in favour of another who later proves to be an illegal immigrant will leave him in no doubt about this.

This is neither a matter of racism nor, as the noble Lord, Lord Hatch of Lusby, would have us believe, is it a matter simply of colour. The noble Lord, Lord Hatch, sought to persuade us that information about immigrants related—

Lord Avebury

My Lords—

Lord Elton

My Lords, I feel I should be discourteous to the noble Lord, Lord Hatch, if I were to give way to the noble Lord, Lord Avebury. The noble Lord, Lord Hatch, who will doubtless move to intervene again, sought to persuade us that information about immigrants related first, specifically and exclusively to coloured immigration. Even if the noble Lord is not aware of the large volume of cases related to non-coloured immigrants received by the Home Office, he must surely have some inkling at least of the pressures of concern in this field from our recent debate on the case of Mr. Papusoiu, which I believe he attended.

The people concerned are of all colours, all races, and eventually those of them who have a right to be so will be members equal with others in this community. The legislation is designed to see that only those so entitled do, in fact, so become.

The noble Lord, Lord Avebury, was also concerned about the length of the transitional period. It is true, as he has said, that for a transitional period of two years from the appointed day the registrar will be unable to insist upon the immediate observation of the principles. There has never been any secret of this fact which we regard as essential to enable data users to make the necessary adjustments in their systems to equate with the requirements of the new legislation.

We do not believe it would be right to allow the registrar, for example, to insist upon the immediate granting of subject access or to make immediate changes to security systems. But the registrar will not be idle during the transitional period. He will be able to serve notices on data users requiring compliance with the principles from the end of the transitional period before that period ends. This spreading out of his initial duties will we believe enable him to manage the tasks with the strength of the 20 assigned to him, as my noble friend Lord Mottistone correctly pointed out, in the Explanatory and Financial Memorandum.

The noble Lord, Lord Avebury, raised another point. As was made clear in the last Session, Government departments will register separately and the registrar will have adequate powers to ensure that register entries will give sufficient information about all the purposes for which the data held by the individual departments are used. We think that this is perhaps more important than giving information held on individual computer systems. He also asked how the new exemption for the non-disclosure provisions in Clause 33(5)(c) for disclosures to servants or agents would work in the public sector. This is very much a committee point and I am sure that he will give it and the other points that he raised proper attention. The intention of Clauses 33(5)(c) and 36(1) is to clarify the register and not to obscure the independent activities of bodies such as the Health and Safety Executive.

The noble Lord, Lord Richardson, raised the question of breach of the provisions of the Bill without damage being caused. We think it would not be appropriate to provide for compensation to be payable where no damage has been caused. But the registrar will be able to take action where there has been a contravention of any of the data protection principles in regard to such data, whether damage has been caused or not. I hope that if he reads that into the Bill he will find that his anxiety in that respect is allayed. Appeal, I can tell him in relation to Clause 14, is only open to data users in respect of whom the registrar has taken an unfavourable decision. He is in no such relationship with data subjects, who, as an alternative to seeking the help of the registrar, may seek redress through the courts.

The noble Lord, Lord McIntosh of Haringey, came to this subject refreshingly fresh, if I may so put it, and impressively knowledgeable. It was both prudent and, I think, virtuous of him to read the Second Reading debate in its entirety. I am not one hundred per cent. certain how far beyond the Second Reading debate his virtue and impetus carried him. There is a wealth of material in Hansard on the Committee amendments in which the whole question of definitions was exhaustively threshed out. If he reads it, I hope that he will find himself reassured that the jigsaw puzzle pieces really do fit together and that his fears are, to that extent, groundless. It is always an unpleasant experience to have one's fears rendered groundless in this sort of forum, if no other; but I hope that he will steel himself to that as he has so many other fears to contend with. As for his concern about access and the prevention of it, we shall probably hear more from him on that subject but I should attempt to reassure him by saying that the right of access can be exercised both through the offices of the registrar and through the courts by a precise but straightforward mechanism. The exceptions to that are strictly limited—Clause 28, of course, apart—and are generally designed in the interests of data subjects themselves.

If I may briefly say so, the noble Lord, Lord Swinfen, can, on the question of access, be assured that the right of access under the Bill is to the data held by a data user; that is, to the data under the user's control. Where he controls the contents and use of data process on someone else's computer, perhaps jointly with the owner of the computer, the user would have to give access to the data. Even where he did not, the registered particulars would make it clear that he obtained data from other users and this would allow the subject to pursue his right of access with them.

I do not doubt that I have left unanswered many important issues. Nor do I doubt that your Lordships will forgive me in the knowledge that you will be able to take me to task at the Committee stage. Some of the issues may be of some substance and I should not like it thought that, by omitting them from this stage in my reply, I regard them as any less important than others that I have included. But my now lengthening experience of your Lordships' affairs has led me to suppose that I ought in future to make a shorter speech than I have done in the past.

In conclusion, the noble Lord, Lord Mishcon, threatened your Lordships with secret records kept upon your Lordships by the police and used in ways unknown to your Lordships on occasions of which your Lordships were unaware. Before your Lordships' blood runs altogether cold at the prospect, may I say that it was ever so since the days of the great Queen Victoria? I do not believe that there has ever been a time when the police have not been as much aware of and concerned for persons of your Lordships' virtue and importance as for villains and spies. I doubt whether your Lordships have ever found this a threat. If you have done so, your Lordships' past is probably not what is recorded in the pages of Who's Who.

That aside, we are dealing with an issue of some seriousness which touches both the privacy and the reputation of every person in this realm. It is a question of balance. The noble Lord, Lord Mishcon, sought to persuade me that if we found an equality of disapproval from either direction that was not to suggest that we had got the balance right but that we had got it doubly wrong. That is ground over which your Lordships will go in detail during the Committee stage. I hope that we can avoid too much repetition of issues that have already been decided, but I will nevertheless not flinch from repeating arguments which your Lordships' attacks call forth from me, even if they have been heard before. I am sure that we can complete this arduous and now familiar task with as much pleasure and decorum as we did last time round the course. I thank your Lordships for bearing with me for one minute less than 20.

On Question, Bill read a second time, and committed to a Committee of the Whole House.