HL Deb 19 July 1983 vol 443 cc1044-104

3.6 p.m.

Lord Elton

My Lords, I beg to move that the House do now resolve itself into Committee on this Bill.

Moved, That the House do now resolve itself into Committee.—(Lord Elton).

On Question, Motion agreed to.

House in Committee accordingly.

(The EARL OF LISTOWEL in the Chair.)

Clause 1: [Definition of "data" and related expressions]

Lord Mishcon moved Amendment No. 1: Page 1, line 15, leave out from ("individual") to end on line 16.

The noble Lord said: On a pleasant summer afternoon I am opening the second innings on this Bill. I have to say with regret—I hope without a lack of graciousness—that it is such a pity that the Government have not used the interval between the first innings and the second innings to recognise some of the good bowling that was put up in the first innings, and to know how to deal with it. So I begin with Amendment No. 1, which refers to the definition of "personal data". May I direct your Lordships' attention to subsection (3) of Clause 1, where "personal data" is defined? It means: data consisting of information which relates to a living individual who can be identified from the information, including any expression of opinion about the individual". May I pause there for a moment? It is only personal data which will be dealt with by this Bill—the protection of it, the right of disclosure in regard to it, and the keeping of it.

So far, that definition is unexceptionable but the subsection then goes on to state—and these are the words which we want deleted: but not any indication of the intentions of the data user in respect of that individual". In other words, if you alter a sentence by making it an expression of an intention, you are outside the provisions of the Bill. That really cannot be right, because it does not even appeal to the ingenuity of a data user. It merely requires the common sense of a data user to get exemption from the provisions of the Bill by expressing in clear English an intention, and nothing else but an intention.

If one wants to reflect upon this for one moment and see whether it is a practical point, I ought to mention that there was a CBI conference which was referred to by the noble Lord, Lord Mottistone, in his Second Reading speech, which we all enjoyed—as we normally enjoy his speeches—on 5th July this year.

At that conference, I have reason to believe that actual advice was given, and it was that participants were advised to express matters of opinion as intention and then there would be no subject access. That, of course, is exactly the mischief that this amendment seeks to deal with. Indeed, I believe I am right in saying that they were specifically told in the course of an address that, instead of stating, "This man is managing director material", all you have to state in its place is, "I intend to promote this man to managing director".

That is very nice if it happens to be a complimentary entry such as the one that I have just mentioned; but, of course, if you want to say, "This man is a troublemaker", all you have to do to obtain complete exemption, as I see it, from the definition of personal data is to say, "I intend to dismiss this man as a troublemaker". That is an expression of an intention and is, therefore, outwith the Bill. So this amendment merely seeks to plug what is obviously a hole in this legislation and, in my respectful submission, if these words are left in, it makes a mockery of the whole Bill and certainly of the definition of personal data. I beg to move.

Lord Elton

In Committee on the earlier Bill we considered an amendment by the noble Lord, Lord Wigoder, which would have removed from the definition of personal data anything which was not a plain statement of fact. Expressions of opinion about the data subject would have been expressly excluded from the definition so that the data subject would have been deprived of access to what was thought about him. I argued that that would radically restrict the scope of protection offered by the Bill and I was glad to find that the Benches opposite agreed with me that expressions of opinion should continue to be covered. The present proposal is a rather different one. It is not to restrict the scope of the Bill but to extend it more widely by including in its coverage expressions of intention by the data user which Clause 1(3) now excludes.

Having resisted the restriction of the Bill suggested by the noble Lord, Lord Wigoder, I must also resist the extension of it proposed by the noble Lord, Lord Mishcon. I think now, as I thought then, that we have the balance about right. It includes facts and it includes opinions but it does not include statements of intention. What would it mean if intentions were included in the definition of personal data? It would mean that, if a data user held for staff planning purposes some contingency arrangements for moving people into particular vacancies should that prove necessary or should the vacancies occur, or if he put into his computer his intention to move Mr X into Mr Y's job in five years' time, or if he recorded his intention to increase the pay of all sales managers by 10 per cent. if sales reached a particular level, in all those situations, the amendment would bring the information within the meaning of personal data and, among other consequences, the data subject would be entitled to access to it.

Please understand that I am referring, as does the Bill, only to the intentions of the data user in this context. The definition refers in lines 15 and 16 to the intentions of the data user in respect of that individual. If he records the intention of others or others record his, they will, of course, continue to be accessible under the Bill as drafted. Our belief is that it would not be reasonable to bring the data user's intentions within the meaning of personal data and there is no case for doing so so far as the effect of data protection schemes is concerned.

It would present very great problems to many people if their intentions towards an individaul had to be revealed to that individual. Nor would it necessarily be of any benefit to that individual to learn of the intentions in respect of him, particularly as they would relate in many cases to purely hypothetical circumstances. Circumstances would change; plans would be amended, and the intention to put Mr X into a particular job would be replaced by some quite different scheme. If he had access, Mr. X would be left with wholly misleading information, and the data user would face a most difficult situation, having had to reveal an intention that no longer existed. To force management to reveal plans to meet purely hypothetical circumstances would make contingency planning a risky and and emotive occupation, and the quality of management would suffer as a result. I think I have probably said enough to make it clear that I do not like the amendment and I hope the committee will vote against it if it comes to that, which I hope it will not.

3.16 p.m.

Lord Mottistone

I should like very briefly to support my noble friend. Perhaps I should initially say that I was not present at the CBI meeting to which the noble Lord, Lord Mishcon, made reference and gave an account. I can only imagine that it took place in the afternoon while I was here sharing the privilege of the Second Reading of this Bill with your Lordships. From a practical point of view, experience both in industry and earlier in the Navy leaves me in absolutely no doubt that one would be put in great difficulty if this amendment were to be accepted by the Committee. The only thing you could do would be to record your intentions on pieces of paper; but intentions you will have to have. Intentions usually for the benefit of the data subject (if we can so describe him) not for his disadvantage are best kept to yourself until you are ready to tell him. This happens time and time again, and I would have thought that what my noble friend said was absolutely right. I do hope the Committee will not accept this amendment and indeed that the noble Lord, Lord Mishcon, will withdraw it.

Lord Avebury

The noble Lord, Lord Mishcon, referred to discussions taking place at a CBI conference and advice of a certain nature being given to the participants. The question is whether it would be possible to escape from the obligations that one would otherwise have under the Bill as easily as is now being suggested. I rather thought the Minister was agreeing with that when he went so far as to say that even contingent intentions would be excluded from the Bill because the example that he gave of the sales managers who would receive an increase in their salaries if a certain level of output was achieved does go rather further even than the phrasing in subsection (3).

I think it is important that we should understand where we are on this. If it is shown that evasion of the obligation under the Bill is as simple a matter as the noble Lord, Lord Mishcon, suggests, maybe we need some tightening up on the wording of this clause, although perhaps not in precisely the form that he has suggested. One can think of numerous examples of the ways in which opinions could be expressed in the way the noble Lord described, and I thought of one as the Minister was talking. If you think of the employer who wants to put down an opinion about a sales manager, for example, and to suggest that the sales manager probably drinks rather excessively, but who does not want to run the risk of showing this to be an opinion and therefore coming under the wording of subsection (3), he will merely say, "If it is shown that Mr. X drinks excessively, he will be transferred to some other job". So he has escaped very easily from the provisions of subsection (3) as the noble Lord, Lord Mishcon, described. I do not believe that was the intention of the draftsman. I cannot even believe it was in the minds of the Government, and I hope the noble Lord will on reflection look with more sympathy at this amendment, and if he does not accept it as it stands come up with some alternative that will do the same work.

Lord McIntosh of Haringey

The noble Lord, Lord Mottistone, spoke against the amendment, but his speech gave good arguments for the amendment. The Minister gave some genuine cases which would justify a distinction between a real intention and an expression of opinion, and I accept that when he did that he was doing so entirely fairly. But the noble Lord, Lord Mottistone, made it clear in his speech that whether the "expression of opinion" was genuinely an intention or not, it was very easy to get around it by leaving if off the data base and not automatically processing it, and thereby taking it beyond the scope of this Bill.

The reason for this amendment is not the case cited by the noble Lord the Minister; it is the fact that it will become so easy for expressions of opinion which are not really intentions to be expressed in the form of intentions. For the life of me, I cannot see why the Government, having opposed the amendment proposed last time by the noble Lord, Lord Wigoder, to exclude all expressions of opinion, should now make it so easy for expressions of opinion to be excluded from the Act by the simplest verbal change.

Lord Donaldson of Kingsbridge

I remain rather puzzled by this but I daresay the noble Lord the Minister can help me. Supposing the entry says, "This is a good man and he is suitable for promotion", or supposing it says, "This is not a very good man and he is not suitable for promotion", is that an intention, or is it not? It seems to be a very obscure definition and one that is not clear at all to me.

Lord Elton

A statement that a man is a good man is a matter of opinion; a statement that he deserves a reward or promotion for that is a statement of opinion. The only matter that the Bill catches in this way is the statement that, as a result, it is intended that he shall be promoted. Noble Lords opposite are suggesting that managers all over the country will start concocting an elaborate code whereby they will say one thing to the computer and mean another. I daresay that there are other ways, too, in which they could do this; they could fudge the issues all over the place. I do not believe that it would be practicable to do so, because if the organisation in question is one that actually does have intentions, then they will have to distinguish between genuine intentions and intentions which are no more than stalking horses for opinions. I do not see that that is a likely eventuality, which is why I did not return to that point when I first spoke. I cannot see the threat as being very real or very dangerous. I wonder whether the noble Lord is really suggesting that there will be this tide of evasions as a result of the drafting of the Bill.

As I see it, the genuine intention is something which ought not to be available to subject access. We have considered this point very carefully in the interval between the first and second innings; we were not idle, drinking lemonade or stronger stuff in the changing room, whatever the noble Lord, Lord Mishcon, thought as he was cleaning his pads. We were considering this question among many others and it seems to us that we have the balance right. The purpose of this Bill is to protect the individual but not make the management of personnel and the affairs of companies more difficult, because the companies' individuals would suffer therefrom.

If companies are forced to deploy in the open all kinds of contingency plans—all of which need to be ready to be called up quickly in certain eventualities, of which 95 per cent. will never arise—they will inevitably be subject to a whole bombardment of questions from the curious and those interested in trying to discover what those contingency plans are. A whole new facet of management will come into being and there will be whole new areas of secrecy; certain matters will be kept off the computer and only discussed over paper at particular meetings. It seems to me that the great importance of open management would be badly done-by as a result, and I ask the noble Lord to think again.

3.25 p.m.

Lord Mishcon

I did put on my pads but I am afraid that the noble Lord the Minister did not put on his helmet, and as a result he is extremely vulnerable. I am grateful to all who have spoken to this amendment—not least, the noble Lord, Lord Mottistone, who helped me tremendously by reminding the Committee that there is another way of getting over all the provisions of this Bill, namely, by making a manual record and not one on a computer. We have been through that point before and unfortunately we cannot go through it again.

We are legislating, and making it incumbent upon a data user to reveal that which is on his computer to a data subject in certain circumstances. One dare not leave legislation of this kind, which is invading to a very slight extent the whole area of the law on privacy (and possibly not doing it very tidily), in a confused state. When data subjects come to ask for their record to be produced by the data user, the people advising the data users and the data users themselves will look at this Bill and say, "It is all very well for another place to have been rather careless in the way in which it dealt with this legislation, but the House of Lords has a reputation for being extremely careful and for using language that is meant to say something". Are we to have arguments all over the place—in courts of law, before tribunals and so on—as to whether something was an intention and therefore ought to be excepted from the data subjects' rights?

Let me give a simple example: we will not go to the employer and the employee. We are told that in certain circumstances, medical records will be available. It is as simple as this: into the computer are fed the words, "I shall examine this patient in six months' time". No doubt, upon looking at the wording of this Bill, it is a statement of fact; that the author of that comment is going to take that action. Therefore, I should have said without any doubt at all that such a comment would be "discoverable", as it were, by the data subject under the Act. But say that, instead, there are written the words, "I intend to examine this patient in six months' time". If one looks at the wording of this Bill, presumably the data subject—the patient—has no right to discover that comment.

I am not inventing the CBI conference, and I do not wish to say anything that would even seem to be offensive to that conference, but the actual point was taken at the conference that, "This is what you had better do". The whole question becomes ridiculous. It is bad enough, I repeat, that manual records can escape the provisions of this Bill; and that hybrid records in the form of half-computer and half-manual records can escape the provisions of this Bill in regard to the manual section, even though it may be extremely difficult to disentangle the two. Are we to be such careless legislators that we allow in as an exception the expression of an intention? I am not saying that people would deliberately make use of that exception, but the mere fact that they use the words will mean, under this Bill, that there will be exemption—whereas precisely the same sentiment expressed not as an intention would be caught by the Bill.

In moving this amendment, I am endeavouring, together with my noble friend—and I cannot really obtain any political merit from doing this because it is purely a matter of legislation—to make a point concerning language, intention, tidiness and clarity. I ask the noble Lord the Minister to concede this amendment or at least say to me and to your Lordships, "There is weight in this argument. It is an argument which has been made from various parts of the House. We must not allow this point to slip through and therefore I am prepared to give serious consideration, not to the deletion of the words necessarily but to a modification so that the obvious nuisance is covered". If the noble Lord says that, then I will not proceed with obtaining the opinion of the Committee. But if the noble Lord is not prepared to do so, neither I nor my noble friends can allow the Committee to serve as a nonsensical channel for a provision of this kind in legislation, and must test the opinion of the Committee.

Lord Elton

Before the noble Lord does so, I should like to congratulate him on the way in which he urged us all to provide legislation which can never be the subject of litigation. I earnestly hope that we may do that, although the noble Lord and some of his friends may be the poorer as a result.

Lord Mishcon

We can take that, my Lords.

Lord Elton

There is little danger of its happening. May we just look a little more closely at what has been suggested by the noble Lord? It is an interesting idea, that one can take an opinion and bury it in an intention. An intention is presumably normally the result of opinion; it is either the result of a set of facts or it is the result of an opinion which you hold. The example was taken, "this man is clever and I intend to promote him", or "this man is drunken and I intend to sack him", or "he may prove to be drunken and if he does I intend to send him elsewhere, to other less bibulous places". What would appear on the tape would be one entry which contains two components; one is an intention, "I intend to promote this man", and the other is an opinion, "This man is clever". "I intend to promote this man because he is clever". The opinion is caught by the Bill and is the subject of access. It is only the intention, the conclusion you arrive at after considering the cleverness or drunkenness, it is only what you then decide that is to be concealed from him. It is not the intention of the Bill to conceal your opinion.

If you put on the tape, "This man must go", that, I presume, is an intention, but if you put on the tape something describing why you arrived at that conclusion and that is an opinion, that is not an intention and that is available to the data subject. So if the noble Lord will be patient until the next stage we can see whether my layman's analysis is borne out by heads wiser than mine, and we may find that the danger to which the noble Lord has addressed your Lordships possibly does not exist. It would be a pity to amend the Bill until we are sure of that.

Lord Mishcon

May I make two rapid points? The noble Lord the Minister must forgive me, but if he is putting to the Committee that there is an easy dichotomy between a statement and an opinion, may I give him a rather better example than he has given? Take the example, "My manager says that this man is able. I intend to have the manager's head examined". What is disclosable in those circumstances is the manager's report that this man is capable. What is not disclosable is the comment that is made of the intention to have the manager's head examined. But it is even worse than that. I know the noble Lord did not want in any way, shape or form to mislead the Committee, but in his earlier remarks he pointed to the fact that this is only the data user's intention and nobody else's; if it was the intention of anybody other than the data user this would not be covered in the Bill. We all know that what we shall usually be dealing with is a limited company which is the data user. A limited company cannot act by itself; it can only act through its agents. The managing director, the general manager and everybody else are the agents of the company and they are all the data user. So from the practical point of view we are dealing with a whole body of people whose intentions would come out of the provisions of this Bill.

I feel that because this is the second time round we must not have a vague expression—the Minister will forgive me for using the word—of preparedness to have a look; then we reach the Report stage and the consideration has not been completed and so on. If I may say so, I think the Minister has had adequate notice of this amendment, and he must come out and say either that he has no time for it at all, in which case I shall regret his reaction, or that he has time for it and will do something about it, in which case I will not press it. If he cannot come out with either of those two reactions but something wobbling in between, then I must test the opinion of the Committee.

Lord Elton

I always get a little worried when the noble Lord, Lord Mishcon, is either complimentary or when he exonerates me of an intention. He was fairly complimentary at the beginning of the afternoon, but not enough to worry me. But he then exonerated me of misleading the House deliberately. I understand the point that he makes: that the servants of the corporate body, the company, are themselves all the data user, and therefore he is right in saying that their intentions are the intentions of the data user; they are the intentions of the corporate body which is running the affair and they are the management.

As to the noble Lord's wanting a categorical statement, if he wants it now it must be a very unfriendly "No". But I have said that if in this novel line of argument there is revealed a real threat—which I, as a layman, and on preliminary advice do not believe exists, because I consider it is perfectly possible to separate the intention and the opinion—if there is an unexpected danger there, of course we shall want to look at that and get it right at the Report stage. But if the danger does not exist there is nothing to correct, and I could not commend this amendment to your Lordships, for the reason that it would strangulate management in the way that I have described.

Lord Mishcon

I am sorry that the noble Lord does not see his way clear to accept my invitation, which I hope was a frank and generous one. In the circumstances, I must help him by getting the Committee to express an opinion.

3.37 p.m.

On Question, Whether the said amendment (No. 1) shall be agreed to?

Their Lordships divided: Contents, 78: Not-Contents, 107.

DIVISION NO. 1
CONTENTS
Airedale, L. Jacques, L.
Amherst, E. Jeger, B.
Ardwick, L. Jenkins of Putney, L.
Avebury, L. Kennet, L.
Aylestone, L. Kilmarnock, L.
Bacon, B. Leatherland, L.
Balogh, L. Listowel, E.
Banks, L. Llewelyn-Davies of Hastoe, B.
Beaumont of Whitley, L. Lockwood, B.
Birk, B. McIntosh of Haringey, L.
Bishopston, L. Mayhew, L.
Blease, L. Milford, L.
Blyton, L. Mishcon, L.
Brockway, L. Molloy, L.
Brooks of Tremorfa, L. Nicol, B.
Burton of Coventry, B. Peart, L.
Byers, L. Phillips, B.
Cledwyn of Penrhos, L. Pitt of Hampstead, L.
Cooper of Stockton Heath, L. Ponsonby of Shulbrede, L. [Teller]
Crowther-Hunt, L.
Cudlipp, L. Prys-Davies, L.
David, B.[Teller. Rhodes, L.
Diamond, L. Ross of Marnock, L.
Donaldson of Kingsbridge, L. Sainsbury, L.
Donnet of Balgay, L. Sefton of Garston, L.
Elwyn-Jones, L. Shinwell, L.
Elystan-Morgan, L. Stewart of Alvechurch, B.
Ewart-Biggs, B. Stewart of Fulham, L.
Gaitskell, B. Stone, L.
Gallacher, L. Strabolgi, L.
Glenamara, L. Strauss, L.
Gormley, L. Taylor of Gryfe, L.
Grey, E. Taylor of Mansfield, L.
Gridley, L. Underhill, L.
Hale, L. Wallace of Coslany, L.
Hampton, L. Whaddon, L.
Hanworth, V. White, B.
Hughes, L. Winstanley, L.
Hunt, L. Wootton of Abinger, B.
Ilchester, E.
NOT-CONTENTS
Adeane, L. Cayzer, L.
Allerton, L. Chelmer, L.
Ampthill, L. Clifford of Chudleigh, L.
Avon, E. Clitheroe, L.
Bauer, L. Cockfield, L.
Beloff, L. Coleraine, L.
Belstead, L. Colwyn, L.
Bessborough, E. Cork and Orrery, E.
Boyd-Carpenter, L. Cox, B.
Buccleuch and Queensberry, D. Craigavon, V.
Caithness, E. Cullen of Ashbourne, L.
Campbell of Croy, L. Daventry, V.
Carnegy of Lour, B. Denham, L. [Teller.]
Digby, L. Mar, C.
Drumalbyn, L. Margadale, L.
Effingham, E. Marley, L.
Ellenborough, L. Milverton, L.
Elliot of Harwood, B. Molson, L.
Elton, L. Morris, L.
Fairhaven, L. Mottistone, L.
Ferrier, L. Mowbray and Stourton, L.
Fisher, L. Northchurch, B.
Fortescue, E. Nugent of Guildford, L.
Fraser of Kilmorack, L. Orr-Ewing, L.
Gainford, L. Rankeillour, L.
Garner, L. Rawlinson of Ewell, L.
Geoffrey-Lloyd, L. Reay, L.
Glenkinglas, L. Renton, L.
Gray of Contin, L. Richardson, L.
Hailsham of Saint Marylebone, L. Rochdale, V.
Romney, E.
Hankey, L. St. Aldwyn, E.
Harmar-Nicholls, L. Saint Brides, L.
Hayter, L. Sandford, L.
Henley, L. Savile, L.
Home of Hirsel, L. Selkirk, E.
Hornsby-Smith, B. Sempill, Ly.
Hylton-Foster, B. Sinclair, L.
Inglewood, L. Skelmersdale, L.
Kilmany, L. Somers, L.
Kinloss, Ly. Spens, L.
Lane-Fox, B. Stamp, L.
Lauderdale, E. Strathcarron, L.
Lawrence, L. Strathclyde, L.
Leathers, V. Sudeley, L.
Lloyd of Hampstead, L. Swinton, E. [Teller.]
Long, V. Tranmire, L.
Lothian, M. Trenchard, V.
Luke, L. Tryon, L.
Lyell, L. Ullswater, V.
McAlpine of Moffat, L. Vaux of Harrowden, L.
MacLehose of Beoch, L. Whitelaw, V.
Macleod of Borve, B. Wynford, L.
MacLeod of Fuinary, L. Young, B.

Resolved in the negative, and amendment disagreed to accordingly.

[Amendment No. 2 not moved.]

3.46 p.m.

Lord Mishcon moved Amendment No. 3: Page 2, line 18, after ("means") insert ("collecting,").

The noble Lord said: As the Bill now stands, collecting personal data is not covered. This clause has been amended since the Bill was previously before your Lordships, and, if I may say so with all deference, it has been amended very well—but not well enough. Obviously, collecting personal data should be covered. The convention principles specifically state that information should be fairly and lawfully collected. At the moment this is not covered by the Bill, and the purpose of the amendment is to see that it is. I beg to move.

Lord Elton

I hope that I can help the noble Lord. The definitions contained in Clause 1, as I recall saying frequently on previous occasions, have been constructed with the utmost care to ensure that when they are taken together we cover all those activities that we need to cover but do not bring in innocent and unsuitable operations. Put simply, the Bill's obligations bite on those who "hold" (defined in subsection (5)) "personal data" (defined in subsection (3)), which means "processing" those data (defined in subsection (7)) as mentioned in subsection (2)—that is to say, "by equipment operating automatically". I sympathise with the noble Lord's desire to see that no operations that should be subject to control escape the controls of the Bill, but I hope to be able to persuade him that his amendment would have some unexpected and undesirable results and that it is not required for the better protection of the data subject.

First, we must ask ourselves: what is the effect of adding "collecting" to the list of functions that constitute processing? The effect is to broaden the definition of "data user", but in a somewhat obscure fashion. Brought within that definition would be anybody collecting data by equipment that works automatically in response to instructions given to it for that purpose by that person if that person also controlled the contents and use of the data. The only data in question, of course, would still be personal data collected by reference to the data subject.

I must confess that I do not have a clear idea of who, if anyone, would fall within this new group. Who does collect personal data in that way? I have a suspicion that we might subsequently discover that we had not brought within the scope of the Bill any new persons or activities who should be covered, but that we might have applied the Bill to quite inappropriate people who ought to be left out. The noble Lord will know, of course, that they are left out by the convention, in honour of which we are largely labouring.

So let me try to reassure the noble Lord that he has no need to worry about the collectors of data pure and simple. What Clause 1(5) of the Bill does is to bring within the definition of "data user" a person who processes or intends to process (if I dare breathe that word again) data. If he collects data with the intention of "amending, augmenting, deleting or re-arranging" them, or extracting information from them, then he is already caught, as the noble Lord would wish him to be. If he has no such intention, I cannot see why he is doing it or that anybody will suffer. Incidentally, that reveals another oddity of the amendment. It would mean that a person who intended to collect data would be treated as a data user before he had any data in his possession at all.

It is not the case that the Bill pays no attention to the stage before data are actually processed. The first data protection principle includes the provision that: the information to be contained in personal data shall be obtained … fairly and lawfully". Once a person processes, or intends to process, the information he has collected, he becomes a data user and thus subject to the principles: so that he could be called to account by the registrar if there had been some unfairness or illegality in the way the information had been obtained. This fact means, I believe, that appropriate controls do exist in respect of the obtaining of information where processing subsequently takes place or is intended to take place. Provided that the processing as set out in Clause 1(7) is properly regulated, that is what matters for the protection of the subject. If the data are not subsequently processed, there is no need, in our view, for the Bill to apply. If they are processed, then the registrar will be able to look at the manner of their collection in deciding whether any of the principles have been contravened.

I hope that what I have said will satisfy the noble Lord that his concern is already met in the Bill as it stands and that no purpose other than confusion would be served by an amendment on the lines proposed.

Lord Prys-Davies

I have listened to the Minister and obviously I shall have to read very carefully in the official record what he said. Principle 1 speaks very clearly of personal data being obtained. I do not see anywhere in the provisions of the Bill a reference to the collection of data. Indeed, can we have any data before it has been collected?

Lord Elton

No, we cannot have data before it has been collected. When it has been collected, it is harmless unless there is an intention to process it. As soon as the intention exists, the Bill bites. That is really all I was trying to say. It appears that this is what the noble Lord, Lord Mishcon, wants to happen.

Lord Avebury

In that case, I do not agree with the Minister. There is one category of collection which might cause great difficulty if the amendment were to be accepted, and that is the case of a retail outlet which will ultimately be connected with the clearing banks. A person may buy petrol or groceries. Through the terminal in the petrol station or the supermarket, his account may be debited with the amount that he spent. I am talking about what may well occur in the future as the technology advances. As I see it, the person who conducts that transaction would be a collector of data; but he is not a data user within the meaning of the Bill because he does not intend to process it. The data goes down the line into the joint stock bank to which the customer belongs and there the amount of the purchase is debited to his account. The processing takes place on the premises of the bank and not in the premises of the supermarket or the petrol station. As I see it, if the amendment of the noble Lord, Lord Mishcon, were to be accepted, those retailers who are simply acting as collectors but who are not doing any processing would be caught by the Bill.

Lord Elton

I speak subject to correction on this. We shall doubtless return to it. We are straying a little from the amendment. Clause 1(5) defines a data user as: a person who holds data"; and he holds data if: the data form part of a collection of data processed or intended to be processed as mentioned in subsection (2) above". I take it that the person owning the equipment in the petrol station or the supermarket will in fact be collecting that information in order that it may be processed; so I think that the definitional problem that the noble Lord envisages may not actually arise, although I do not doubt that there are others at which we should look closely.

Lord Mishcon

I hope that the noble Lord the Minister will not think me patronising if I say that in my view his answer was so much more effective on this amendment than it was on the last one. It deserves a great deal of study. I owe him that courtesy. Therefore with the Committee's leave, I shall see what he said. I shall read it very carefully, and in the meantime ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

3.55 p.m.

Lord Mishcon moved Amendment No. 4: Page 2, line 21. leave out ("the data subject") and insert ("data subjects")

The noble Lord said: I ask for your Lordships' leave to speak to Amendment No. 6 as well as to Amendment No. 4. This was a matter that was raised in Committee, and I had the pleasure then of speaking to it, when the Bill came before your Lordships on a previous occasion. The point is a very short one. If you limit the personal data covered by this Bill to a particular data subject (and this is what the Bill does. even by the revised wording), you do not catch an operation which deals with categories of data subjects. I gave some examples last time. I should like to add (your Lordships may think somewhat pertinently) to the examples.

There could be a category of bad credit risks and a category of trouble-makers; and a new one that occurs to me is a categotry of Welsh Viscounts. This, too, is an easy category to imagine, certainly today. It is very simple to assemble that category, even on a word processor—which is now exempted from the Bill. Few word processors are produced now which merely knock out the words; there are side aids to the word processors so you can catch all the words, for example, beginning with the letter "V" that you have in any document which has been prepared by the word processor. If you did have that category, that would mean that you were outside this Bill.

I know that the Government on the last occasion accepted this point in principle and said that there was a good point that was raised here; one ought to have a look at the question of categories. I am paraphrasing what the Minister said on that occasion and possibly putting it more helpfully to myself than he intended, but I hope not. I was hoping that when the Bill came before your Lordships on this occasion in this Session some more attention would have been given to the wording so that categories were caught. As I see it, they are not caught; but if the Minister can convince me that I am wrong then of course I shall take a certain course. But if I may say so very humbly, I am pretty convinced at the moment that I am right. I beg to move.

Lord Elton

The definition of processing is of course crucial to the scope of the Bill. The Bill imposes obligations on data users who hold personal data and on computer bureaux who provide services in respect of personal data. An important element in the definition of holding data in Clause 1(5) and providing services in respect of data in Clause 1(6) is the concept of processing.

The definition of processing in Clause 1(7) now appears in a slightly different form from that in the last Session's Bill—further proof of our activities in the changing room! Previously the processing of personal data was defined as amending, augmenting, deleting or re-arranging the data or extracting the information constituting the data by reference to a particular data subject. This definition was criticised as being over-restrictive and. as I explained on Second Reading, the Government concluded on further consideration that the phrase carried something of an implication that the identity of the subject was known before the processing was undertaken. Obviously the Bill should apply to an operation which involves asking a computer to list, for instance, as the noble Lord said, the names of all had debtors just as much as to an operation which involves extracting the information about Mr. X's, presumably, bad debts. The current Bill therefore defines processing in relation to personal data as amending, augmenting, and so on, the data by reference to the data subject, and this removes the undesirable implication that I have referred to.

The amendment seeks to alter the definition further to amending, and so on, the data by reference to data subjects in the plural. I understand from what the noble Lord has said, that the intention is to ensure that the definition catches processing which involves the retrieving of information about a number of individuals with common characteristics, or, as in the example he gave, with rather uncommon characteristics: the holding of Welsh Viscountcies; or, to give another example, a list of bad debtors.

In fact, when we were revising Clause 1(7) before introduction we ourselves considered exactly the formulation now proposed by the noble Lord. We concluded, for two reasons, that the formula that is now in the Bill was preferable. First, where processing is carried out in relation to a number of individuals at once, the data concerning each of the subjects is still processed separately in relation to each subject. Thus, the definition in Clause 1(7) already embraces this activity. The second argument follows from the first and is a matter of drafting accuracy. When the Bill refers to amending, augmenting, and so on "personal data", it is referring to the data relating to a single subject; that is the meaning given to personal data by Clause 1(3). Thus the processing concerns the data about one subject, and it is as such that we should refer to it.

This is a technical drafting point where there would appear to be no difference between us on issues of policy. I hope the noble Lord will be able to accept that the current definition covers the situation to which he referred. For that reason I hope that he will agree that what we have is preferable to what he proposes.

Lord Mishcon

It looks as though the cricket metaphor is to be continued throughout the whole of the day, and it may enable your Lordships to smile once or twice in the midst of examining this rather difficult Bill. So, if I may be allowed to continue the metaphor, I would say that I feel quite complimented that, in view of the point that was raised last time, the Government should have seen fit to have chatted about this aspect in the changing room to see whether one ought to improve the clause. I fear that when they came out possibly bad light stopped play, because I do not think that they have seen very clearly what was involved here.

If the noble Lord the Minister is saying categorically—and it is on the record—that on the advice that he has received he is satisfied that in this context the words "the data subject" include the name of any data subject collected within a category such as I have mentioned, and that this point is caught, then obviously it is my duty to think again, to take that advice seriously, and not waste your Lordships' time by asking for an expression of opinion on this occasion. However, I should like—and I shall extend my speech by speaking very slowly—confirmation of the fact that the clear advice that the noble Lord has received is that my point is covered by the wording of the Bill as it now stands.

Lord Elton

I have studied the telegraph and the answer is, Yes.

Lord Mishcon

In those circumstances I would say that I have looked at the scoring board and have decided to ask your Lordships for leave to withdraw the amendment.

Amendment, by leave, withdrawn.

4.4 p.m.

Lord Mottistone moved Amendment No. 5: Page 2, line 24, leave out ("performed by equipment designed").

The noble Lord said: I am indeed grateful to the Government, and so is the CBI, which has advised me on this matter, for covering the point about word processors that we made the last time the Bill floated through your Lordships' House. We would suggest—and this is rather a technical kind of amendment—that perhaps the resulting clause is a little too narrow. As we see it, the operation of text preparation is the key factor that the Government are seeking to cover here—not the equipment upon which the operation is performed. The deletion of the four words that my amendment seeks to cut out would free the exemption from unnecessary restriction, since the operation may well be performed by equipment not specifically designed for that particular purpose. I should have thought that that makes it a fairly sensible kind of amendment. I beg to move.

Lord Donaldson of Kingsbridge

I should like to support the noble Lord because I think that he has made a valid point. The capability of the equipment is changing week by week, and I think it far better to deal with the operation rather than the equipment. I am happy to support the amendment.

Lord McIntosh of Haringey

We, too, should like to support the amendment for exactly the same reasons as those given by the noble Lord, Lord Donaldson of Kingsbridge. It is not just the equipment which is changing week by week; the capability of the equipment, and the divisions between different categories of equipment, are also changing week by week. I am reminded of the long drawn out battle between the United States Justice Department and AT and T. No doubt noble Lords will recall that AT and T was told by the Justice Department that in pursuit of laws against monopolies it could not take part in data processing activities. AT and T started by fighting that decision of the Justice Department, and eventually it realised that the only way it would get anywhere would be by seeking from the Justice Department a definition of what was data processing. That took several months to obtain from the Justice Department. When it was obtained, AT and T said, "Thank you very much, That's a marvellous definition. It applies exactly to our main business of telecommunications".

Definitions in this area no longer have the validity they had when the first attempt was made at defining the terms for data protection legislation. They will go on changing, and if we restrict them to the purposes for which particular equipment is designed. we shall have very short-lived legislation.

Lord Elton

It is refreshing to be on a new piece of turf, since this point was not in the Bill when we last saw it. As I mentioned on Second Reading, Clause 1(8) is an attempt to meet the concern which had been expressed to us that the definition of "processing" in subsection (7) could catch some straightforward word processing activities that were quite incapable of causing harm to anyone: and I am grateful to my noble friend for his recognition of the work that we have done in this direction. In the case of, for example, a word processor programmed to produce a standard letter to a firm's customers, the very fact of the equipment looking for the name of the original recipient and replacing it on each occasion with a new name could, under subsection (7), possibly be held to entail "processing by reference to the data subject". The Government accepted that it would be both burdensome and pointless to apply the registration and other requirements of the Bill to such activities, and we spent some time in deciding how best it could be made plain that they were not covered by the Bill.

What we could not have done was to exempt word processors as such, and the noble Lord, Lord McIntosh of Haringey, has given some good reasons why not. Word processors are a particular type of computer, most of which nowadays are in any case capable of performing many, if not all, of the tasks which the Bill is rightly concerned to regulate. Therefore the answer was not to describe the equipment but to describe the kind of activity for which exemption was appropriate. But we had to be careful—and this is a point to which I imagine noble Lords opposite will return on the following amendment—to avoid a definition which went substantially wider than intended. We eventually produced the two-stage definition that appears in subsection (8).

The first element is that the operation must be performed by equipment designed for preparing text—the subsection says nothing about what else it may do—and the second element is that the operation must be performed only for that purpose. We believe that both limits are necessary. The first, to which my noble friend objects, is designed to establish that the subsection is about equipment performing a specialised function. It may well be able to do many other things as well, but it must be designed to perform this function. Having established the equipment about which we are talking, the subsection then makes clear that the exemption applies only where the sole purpose of the operation is the preparation of documents.

I am afraid I cannot accept my noble friend's argument that the reference to equipment unduly narrows the benefits of the exemption. The subsection, as I have indicated, is not limited to equipment that can perform only those functions. To lose the reference to equipment would be to abandon the valuable initial pointer that the subsection contains to the fact that it is with word processing that we are here concerned. It would be to run the risk—since there are many potentially sensitive data users whose sole purpose could arguably be said to be the preparation of documents—of enabling a range of activities that have nothing to do with text preparation to claim the benefit of the exemption. I do not believe that the inclusion of the reference to equipment will narrow the benefits of the exemption as my noble friend fears, but I do believe that without these words an undesirable loophole could be created. I hope that my noble friend will agree to let the words stand.

Lord McIntosh of Haringey

I am sure that the Government's intentions are entirely admirable. I can see from the way the noble Lord the Minister argues that he wishes to move in the same direction as the noble Lord, Lord Mottistone, and other noble Lords. However, it will not work if done in this way. The word "equipment" is one of the few words in the clause that is not defined elsewhere. How do the Government see the word "equipment" being defined? Does it include, for example, both hardware and software? Unless it does, in this area we shall get nowhere at all.

I shall give an example from my personal experience. In my business we use a number of Apple microcomputers for a large number of purposes—for analytical purposes, for financial control purposes and, indeed, for interview purposes. We bought them for those purposes. When we came to the stage of wanting to turn over to word processing from more straightforward typing, we did not buy new word processors. We bought word processing software which we use on our Apple microcomputers. Does that make the Apple computers, with the additional software, equipment designed for that purpose, or does it not? I do not think that the purpose for which the equipment was originally intended gives us any benefit at all in control of the distinction that the Government wish to make.

I refer back to the point that I made on Second Reading that increasingly the distinction between the text processing and the processing of numerical data will break down. The analysis of text using alpha numeric characters is becoming an important adjunct to the analysis of numerical data. A distinction cannot be made between the two. Unless we have better definition of text and equipment, this subsection will not do the job that the Government require.

Lord Elton

I think I have to take hesitant issue with the noble Lord, Lord McIntosh of Haringey, who has revealed useful depths of experience in this field. I am advised that the term "equipment" comprises both hardware and software. In any case, what the Bill provides is that where a person is equipped to process text and produce text in the sense we mean it in common parlance—letters and documents, in other words—and where that is all he does, the two legs together make the definition, which is then clear. The distinction between hardware and software, which is not a distinction for the purposes of this definition, anyway, does not arise.

I do not know whether the noble Lord would like to test me further, because I have seen him shaking his head in a worried way. But the fact is that if a person has equipment that can let him produce text, whatever else it does, and if that is all he does, then it is right that it should be in the definition as we propose. There is one other area of definition that the noble Lord may have at the back of his mind and which we pursued last time. That is the point at which information becomes data. I am not using the word "text" to describe data. "Data" has a defined, precise meaning in the Bill. "Text" is used in the normal sense of the word.

Lord Mottistone

I am grateful to the noble Lord, Lord Donaldson, and to the noble Lord, Lord McIntosh of Haringey, for their support. I am also grateful to my noble friend the Minister for explaining the thinking behind the construction of this subsection, to which great care was obviously given in order to achieve the objects for which we fought on a earlier occasion. I accept the argument of my noble friend that he does not like my amendment exactly as it is because it would spoil the build-up of his subsection. On the other hand, I think that it probably narrows down this subsection too much even now, let alone in a way that might be unsuitable in the future.

If my noble friend will allow me, I shall withdraw the amendment at this stage. I shall invite my advisers to have another look at it, having read carefully what everyone, including my noble friend and the noble Lord, Lord McIntosh, have said, to see if they can come up with something else that gets our point across without offending against the principles of the clause as written, if that is possible. We shall have a try at that. Perhaps my noble friend's advisers can also talk to mine.

Lord Elton

It might shorten things later if I try to make more clear what I said previously. The noble Lord came to your Lordships' Committee with an anxiety that word processors in every office would be caught and that every office would be registered to no purpose when some were only sending out standard letters with different names on them. The reason we have not used word processors as the bench-mark is that given by the noble Lord, Lord McIntosh of Haringey. A word processor can be many other things and can do things for which the noble Lord does not want an exemption. What we have done is to say that any machine that can do what he and I mean by word processing satisfies half the definition. The other half of the definition is that you only use it for what he and I call word processing. If all he wants is to exempt word processing, on whatever machine it is done, I think that he should be content with what is in the Bill. If he wants more than that, I am not at all sure that I am prepared to give it to him.

Lord Donaldson of Kingsbridge

The noble Lord says that he only uses it for that purpose. I imagine that the noble Lord means on that occasion.

Lord Elton

Indeed, yes.

Lord Donaldson of Kingsbridge

That is a very important condition.

Lord Elton

I am much obliged. I mean for that operation, because it can also then be switched to do pay lists, leave rotas, or whatever.

Lord Mottistone

I take the point that my noble friend has made, but I shall still seek to try and clarify this later. We shall see if anything comes up. In the meantime, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Lord Mishcon moved Amendment No. 6: Page 2., line 26, at end insert ("and not by reference to data subjects.").

The noble Lord said: When I spoke to Amendment No. 4 I asked for the Committee's leave to speak also to Amendment No. 6. For that reason I do not intend to make another speech, but I am not at all sure that the noble Lord the Minister dealt with the point that I was trying to make in regard to Amendment No. 6; namely, that subsection (8) also needs the protection of these additional words. Possibly, if I sit down and leave him to deal with this amendment, which I now move, that may be the shortest way of handling the matter.

Lord Elton

I am much obliged to the noble Lord for introducing a very beneficial new procedure in which those moving an amendment do not make a speech but simply listen to the answer. It perhaps suggests rather too clearly that the Minister has decided what to say without having heard the speech, anyway. I assure the noble Lord that I always listen to what he says. On this occasion, the stratagem is justified. If ever we can reach a point at which he does not make a speech and I do not reply to it, we shall get on a great deal faster still.

I did think, when looking at the amendment of my noble friend Lord Mottistone as well as Amendment No. 4, that it might be well if we had a general explanation of why this provision now appears in the Bill, and how we see it applying not least because I thought that this would demonstrate to noble Lords opposite why the current amendment would undermine the purpose of the provision. The example I referred to earlier was of a standard letter being produced, freshly typed each time, for all the customers of a particular firm. In that instance, the processor might well be asked to search for the name of the original addressee in order to substitute a fresh name on each occasion. Subsection (8) in effect provides, when the other requirements of the subsection are satisfied, that this activity shall not be held to constitute the processing of data by reference to the data subject. The present amendment, by putting back a prohibition on processing by reference to data subjects, completely nullifies the purpose of subsection (8), and returns the Bill to its previous position.

I hope that what I have said in reply to the earlier amendment will be sufficient to satisfy your Lordships that there is nothing in subsection (8) to endanger data subjects—indeed, the definition was very carefully constructed to ensure that the exemption only applied in the specific circumstances for which it was designed. I hope that those remarks address themselves to the point which the noble Lord had in mind in moving Amendment No. 6.

Lord Mishcon

It is a most undesirable procedure if somebody in your Lordships' House says that he is not going to make a speech and then makes one. I promise not to fall into that error. The point—and I am restricting myself to one sentence—that I knew the noble Lord the Minister would take is that word processors, in dealing with words, can obviously include words which indentify data subjects and so on. The noble Lord has taken that to mean, for example, the addressee of the letter. I will study what the noble Lord has said in connection with Amendment No. 4 as well. In the meantime. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

4.23 p.m.

On Question, Whether Clause 1 shall stand part of the Bill?

Lord Avebury

I should like to raise a point of which I hope the noble Lord the Minister has had notice. It is a point which I had originally sought to raise by means of Amendment No. 2, which was not moved as it was thought more convenient if the matter could be dealt with on the Question, Whether Clause 1 shall stand part, and that is what I am now proposing to do.

I must go back to the definition of "data" yet again, and I apologise for repeating what has been said on this by the Minister on a previous occasion. The definition of "data" is: information recorded in a form in which it can he processed", but then, as the Minister has pointed out, the data are only held by the data user if they form: part of a collection of data processed or intended to be processed". That would exclude, for instance, a security company which keeps archival copies of a firm's records so that in the event of fire or burglary the records may not be lost, though the company has no intention of processing them; in fact it probably does not possess equipment which could process them if it wanted to do so. So the security company would not have to register under the Bill as a data user.

But then there is the user who does hold the data within the meaning of subsection (5), who has the technological capability of processing it, but who says that he does not intend to do so. The example that might be useful in this connection is the insurance company which has optical character recognition equipment. That equipment allows the computer to read a limited range of alpha-numeric information generally, as I understand it. from a particular line of a form. Thus, for example, the branch code and the insurance policy number can be read into the computer directly by the OCR equipment from a sheet of paper.

As I understand the Bill, that line in the form is included within the defiition of "data", because it is recorded in a form in which it can be processed automatically; it is personal data because it relates to a living individual who can be indentified from the information; and it is held within the meaning of Clause 1(5) because clearly it is intended to be processed. Therefore, it would be covered by the data protection principles in Schedule 1 and, for instance, under Principle 8 appropriate security measures would have to be taken by the insurance company against unauthorised access to the data. I appreciate that the Government are terrified of allowing manual records to creep into the Bill and have gone to considerable lengths to stifle any discussion of the possiblility in Committee. But, as I sought to explain on a previous occasion. the distinction between manual and computer records is not quite so hard and fast as the Minister seems to imagine.

Returning to the example of the insurance document which contains a line to be input via OCR equipment, if the user agrees that he intends to use the form in that manner, then the line of alpha-numeric characters is data: but if he says that he merely intends to store the form and not to process it on the computer, then it is not data. That seems to me clearly absurd. If it did come to an argument about whether the information constituted data or not, it would be most unsatisfactory to have to determine the matter by reference to the user's intentions rather than the objective fact of his technological capability. That was the point that I was seeking to ventilate with the Minister and which I hope he will be able to deal with now.

Lord Mishcon

I think it is appropriate in the debate on the Question, Whether the Clause shall stand part, to deal with a matter which is of great concern to many in your Lordships' Committee and certainly to various organisations outside it. It is a matter that has been dealt with in other European countries but we are failing to deal with it. I mention the matter during the debate on Clause stand part because obviously that is the clause that contains definitions and limits the scope of the Bill. I will not take your Lordships away from the consideration of other amendments for too long, but I must point out that this Bill and this clause and its definitions are tinkering with the law of privacy and doing so in a completely illogical manner. The definitions in the clause, which limit your Lordships' consideration to data which merely go through a computer and which leave completely uncovered all manual records and hybrid records which consist of both computer records and manual records, make this Bill something which is supposed to protect the subject but which really does not do so at all.

The noble Lord the Minister was good enough on a previous occasion to tell me when we were dealing with another amendment that one must not take it for granted that people are going out of their way to see to it that this Bill is avoided by some type of adroit move. It needs no adroit move at all to be completely outside this Bill by putting everything which concerns a data subject, or which may do so, on a manual record and keeping it off the computer. This is obviously a situation which we could not remedy by putting down amendments. I want the Committee to know this because we were, indeed, more than prepared to put down amendments but received advice, which I am sure was absolutely good advice, that since this was a Bill which was aiming only at computerised data, it was not open to us to put amendments down to try to include manual records or, as I said. the hybrids of manual and computerised records.

I thought I ought to draw your Lordships' attention to this omission during the debate on Clause stand part because, to a very large extent, we stand alone on this and, therefore, are providing in our legislation for something which is a mere fraction of data records and which may, of course, be a deliberately restricted fraction at that because of the passing of the Bill, if it becomes an Act.

The data commissioners in other Western European countries have dealt with this problem and are empowered to deal with it. I am given to understand that there was a recent meeting of the commissioners in London at which it became quite clear that, with the exception of Denmark, the data commissioners from nine Western European countries were all able—either because of specific legislation or because of policy that was laid down administratively—to regulate and deal with complaints about manual records. Many of the commissioners reported that the majority of complaints which they received were, indeed, in regard to non-computerised data. It is rather interesting to learn that the Austrian commissioner estimated that 80 per cent. of the complaints they received were precisely of that kind.

In the United States of America there is a United States of America Privacy Act and no distinction is drawn there between manual and computerised systems. So in confining this Bill to automatically processed data, we are literally flying in the face of international experience. There is no point in my labouring on; I do it with a good heart, but I do not improve my case by extending it and repeating myself and the speeches that were made by my noble and learned friend Lord Elwyn-Jones and by other noble friends when this Bill came before your Lordships in the previous Session of Parliament.

However, it ought to be recognised that it is an absolute shame that. when we had an opportunity of dealing with a vital matter of this kind and the protection of the law of privacy, with committees that have been set up and have reported to your Lordships' House and to another place, and consideration has been given to this matter by both Houses of Parliament, we come up with this half-hearted hiccup of legislation instead of trying—and here I mix my metaphors—to take it very properly in our stride. I notice that the noble Lord the Minister has immediately picked up his pencil and noted my mixed metaphor; no doubt we shall have a very responsible reply to it with a counter-mixed metaphor which will beat mine. But this is a real shame and, as my noble friends and I conceive it, most regretfully it is our duty to bring it to the Committee's attention because we are—to mix my metaphors on yet one more occasion—delivering half-baked legislation to our people.

Lord Mottistone

Perhaps I may just comment on that. I have great sympathy for what the noble Lord, Lord Mishcon, has said, but perhaps he is making rather more of it than in practice at this stage is justified. For one thing, he quoted various countries in Europe. They all have a certain number of limitations on what they do. Although I do not want to bother the Committee with the details, they do not have a comprehensive scheme in the way in which the noble Lord, Lord Mishcon, was rather suggesting.

There is one other point which I would suggest your Lordships need to consider. As regards industry, the economical way of doing things must be of paramount importance because, if possible, they have to save money wherever they can. I do not think you will find that they will build up a great number of manual records. The trend, which has been the trend for 15 years or more, of having data records of the kind with which the Bill deals, will continue. Except in very rare cases, I do not think that people will move backwards in order to avoid the Bill, because it would not be economic for them to do so.

I think it is quite a good idea to have a first step which tackles computers, which are much more frightening for us than the manual records. After all, we have had manual records for several centuries and people have been potentially subject to misrepresentation in these records, and there has been no protection at all. If we receive a good measure of protection as regards the kinds of records to which this Bill relates, particularly in view of the economics of the situation, I think that we shall go a very long way towards solving the problem.

However, even if that is not so, there is absolutely nothing to stop the Government of the day in, say, three or four years' time examining this situation and, if necessary, producing amending legislation to make it more perfect. All legislation is looked over in five or 10 years' time, depending on its type. I should have thought that this is a very good first step and, for that reason, I would commend it and this particular clause to your Lordships.

Lord Donaldson of Kingsbridge

I have to agree with the noble Lord, Lord Mishcon, that this Bill can well be described as half-baked; but my own view is that it would be even more half-baked if we tried to include written records, rather than limiting it to the new technology which is the new danger. It seems to me that it is impossible to do it right and that, as the noble Lord, Lord Mottistone, says, this is a first step. It is absolutely vital to get built into the Bill—which so far the Government have not properly done—means of altering the procedures as we go along. When we come to talk about the advisory committee and related matters, that will be the time to discuss it.

However, I would not entirely agree with the noble Lord, Lord Mishcon, that it could possibly be right to include the written records. Before we knew where we were we should find that we had Leporello's list of Don Giovanni's conquests, ending up with And in Spain 1,003". This is not material to which the data subject should have access on any basis.

Lord McIntosh of Haringey

If the noble Lord will allow me, may I point out that Leporello's list did not contain any names; it was sorted only by nationality.

Lord Donaldson of Kingsbridge

It is true that he did not give the names to Don Elvira, but he probably had an accurate list. That is a frivolous example, but it shows how difficult it would be to deal with the records and I am glad that we are not trying to do so. I think that we are failing to deal with the computerised records. However, at least I support the effort, provided it is made sufficiently flexible, but I am very much afraid that it may well not be.

Lord Swinfen

Before we leave this clause may I, with some temerity, return to a point I made on Second Reading? It is the question of computers being able to talk to other computers and where the data subject's rights lie with information obtained by one computer from another, possibly from another firm. My noble friend very kindly wrote to me at some length after the Second Reading debate, but it would probably be useful to the Committee if something could go into the Official Reportof our proceedings.

I should like to know what rights the data subject has to obtain information from the data user who has obtained it from a second data user who, with the modern complexity of computers, could in theory have obtained it through a third, fourth, fifth or sixth one from a seventh. The computations are immense and the systems of computers that can be set up today can be so complicated that it would be extremely difficult for the computer user, making use of that data on a particular data subject, to know precisely from where the data had come. I think it is very important that we should be given some advice as to the rights of the data subject in this case and as to who is required to tell whom what data they are holding.

4.40 p.m.

Lord Elton

I am grateful to noble Lords who have taken part in this unaccustomedly thorough debate that Clause 1 stand part of the Bill. I begin with the noble Lord. Lord Avebury, who opened—I scarcely dare call it the bowling any more—on this stage and start by thanking him for the notice he gave of his intentions to raise this matter now and for his co-operation in handling the matter in this way.

The noble Lord raised the question of whether certain information collected in the form designed to ease computerisation is covered by the Bill, even though the information is not actually put on to a computer. As I understand him, he is concerned about information gathered on forms, either with boxes to be ticked or written in specially recognisable characters which are designed either to be directly machine readable or to facilitate rapid key punching on to a system especially designed to receive the information—

Lord Avebury

Not the latter.

Lord Elton

Not the latter, so I absolve myself from going on too long, if I revert to that, because it is difficult to drop the right part of the speech if one starts dropping it after one has begun it.

The noble Lord suggests that information collected on such forms may fall into two categories: one made up of people with certain characteristics and whose information is recorded on the computer, and the second made up of people with different characteristics whose details are not computerised. He is concerned that both should be caught by the Bill.

The key provision in the Bill in this respect is Clause 1(5). That defines what holding data means, and data are held when they are processed or when there is an intention to process them automatically by the person controlling their contents and use. The first category that the noble Lord offers is caught by the Bill. When the user places certain personal details of subjects on the computer with the intention of processing them, within the meaning of Clause 1(7), he becomes a data user holding personal data. But as for the second category, where there is no intention to process automatically, that is not caught. That is right for it is simply a pile of sheets of paper, capable of being processed perhaps, but not going to be processed. It is no different therefore from most other manual information which, as the noble Lord himself reminded us last Session, is capable of being read by optical character recognition equipment.

If the only use of information is in manual form and it is only referred to by a person sorting through it to find the right sheet, transcribing the information there and all the rest of the process involved in the use of manual information, the possibility of any threat to the individual from the use is of an entirely different nature from that which exists when the information is held on computers. I shall return to that aspect when I come to what the noble Lord, Lord Mishcon, said. However, once it is on a computer it comes within the scope of the Bill because it is then that the capabilities of the computer to collate, manipulate, retrieve, transfer, and the rest, become relevant and the special degree of protection offered by the legislation is required.

In short. almost all information is capable of being automatically processed and it is immaterial whether it is in a form in which it would be simple or difficult to process. What matters is whether there is an intention to process. In the example that the noble Lord gave, if there was an intention to process the information to which he referred. then, yes, it is caught. But only if there is an intention. If the intention is only to store, it is no threat to the individual and it is not caught. If somehow it is processed without a prior intention—if there is an instantaneous decision to process—the fact of processing immediately brings it within the Bill. What matters is whether there is an intention to process. That is what dictates the degree of protection that is required and that is the dividing line that determines the scope of the Bill. We believe that is the dividing line that should determine it.

May I now turn to the remarks of my noble friend Lord Swinfen, and thank him for notice of what he intended to ask me. He returned to a point that he raised at Second Reading, which was his concern about subject access to data held not on the computer of the user from whom he is seeking access, but on another computer with which the user's computer is linked, perhaps indirectly by many stages. I hope that I can help my noble friend here. The key concept here is the control of the contents and use of data. That is the crucial element in the definition of data user because it is only the person who controls contents and use who can sensibly be expected to fulfil the responsibilities and obligations that the Bill places on data users.

If therefore the data user from whom the data subject requests access controls a single data base it will only be the subject's data contained there that he is obliged to provide. That is the case whether or not the user's system is interconnected with another, the contents and use of which he does not control. What will he required under the Bill is that the controller of the second data base will have to register the fact that data are disclosed to the first user on demand and the registrar will determine whether such disclosure is consistent with the principle. If however the first user does control the contents and use of the data on the interconnected system—that is to say, he is holding the data jointly with the other user as provided for in the user definition in Clause 1(5)(b)—data on both systems will he registered by him and accessible to the subject through request to him.

As with so many of these things all this sounds extremely complex; but by making "control" the heart of the data user definition, we believe that we have ensured that in practice the Bill will offer subjects what they need for their protection in this area, while at the same time taking account of how computers work, are used and inter-relate. In particular, we are well aware of the increased propensity for computers to "talk" to one another. The definitions and provisions regarding access and disclosure are we believe well equipped to cater for such direct interconnection as well as for the transfer of information between users in hard copy form or by the physical despatch of tapes or discs. I hope that sounds both familar and re-assuring to my noble friend.

I now turn to the noble Lord, Lord Mishcon, who said that we were tinkering illogically with privacy. He said that on the basis, to which I react as the noble Lord, Lord Donaldson of Kingsbridge, reacted, that the legislation leaves out written records per se. I am not quite clear (because the noble Lord has not told us) how the threat posed by written records has altered over recent years so that the noble Lord thinks that every individual upon whom he pens a line has a right to look over his shoulder as soon as he writes it; or maybe every individual who is recorded in the correspondence files of his office should be entitled to know what is recorded there. One wonders to what extent he values his own privacy, since it was privacy that he wished to have guarded, and in that case is he so anxious that our diaries and our correspondence and everything on paper should be available? I know he will rise to that bait. Perhaps I should not have jiggled it in quite such a lively fashion before him, but obviously the intention would be to have a limited right of access. No doubt he would hedge it about with special provisions.

What I feel is what the noble Lord, Lord Donaldson, clearly feels and what my noble friend Lord Mottistone emphasised: that is, that this is by way of being an anachronistic anxiety, is it not? There was a time when we wrote with quill pens. Then we had typewriters and carbon paper. Then we had the cyclostyle and now—God help us all!—we have photographic reproduction. But that was the age of that particular technological development and that encouraged a tide of paper; but we have now reached a technological era when the threat is receding in that respect and it is becoming manifested instead on tapes and floppy discs. We are dealing in this Bill with the future not the past. We may be tinkers, but we are neither illogical nor out of date.

Lord Mishcon

The Minister is quite right. He dangles a bait and I, like a poor fish, rise to it. But I must rise to it because I am not talking about private diaries. I make two points rapidly so that the noble Lord can deal with it if he so wishes. The first one is that in the past we have not had any legislation in regard to the law of privacy relating to records and the right of people to know what is being recorded about them. Now we have, and we have done it in a piecemeal fashion so that that which is holy is manual and one cannot touch it and that which is unholy and one can search into it, is computerised.

The second short point—and again I am not on the diary point—is that police records are largely made manually and, because they are manual and will continue to be so for many years, they, which are such important records, and some other records including immigration records, are going to be sacrosanct, though, once they get on to a computer, now that we are half legislating, they are caught by this legislation. I am merely saying that it is all terribly untidy.

Lord Avebury

I am sure that it is my fault that I had such difficulty in explaining myself to the noble Lord the Minister, but he entirely missed the point that I was seeking to make, if I may respectfully say so. The pile of sheets of paper that he spoke about which were intended to be processed and which he said were covered by the Bill because of that—these sheets containing (as we both agree) information which is machine-readable, using optical character recognition equipment owned by companies such as insurance firms—are data. They are personal data and they are held within the meaning of Clause 1(5) because the company intends to process them.

Then there were the other sheets of paper—and he somehow or other succeeded in introducing a distinction here between the two kinds, whereas I was talking about identical pieces of paper. I was talking about, for example, a proposal which an insured person submits to the company when he intends to take out, say, a life insurance policy.

As I was trying to explain—obviously, most inadequately—the insurance company has on the bottom of the form a line containing machine-readable data which consists of the branch code, the policy number of the insured and, I believe, some other information as well. But that is enough for the purposes of this illustration. The machine is capable of reading that information. Therefore, those are data which can be processed by equipment operated automatically for the purpose. They are personal data because they relate to an individual insured and they are held by the data user because he intends to process them.

But supposing that there was a form also on the premises of the insurance company which was in respect of a proposal which had been submitted by an insured and which was then the subject of a cancellation by telephone. My point is that the insurance company might not intend to process that information but would keep it on the premises. It is, therefore, not held within the meaning of Clause 1(5), but it ought to be covered by the data protection principles, and in particular by the precautions that I mentioned in Principle 8, which guard against unjust access to the information by a third party.

There is no difference in the nature of the pieces of paper between the one which was intended to be input into the computer and the one which (for the reasons that I hypothesised) the company was simply going to store in its original form on the premises. Both ought to be covered by the data protection principles. They would not be so covered unless some wording on the lines which I had intended to propose in the amendment which I did not move and which I am seeking to discuss on Clause stand part were put into the Bill. I think that we need words like "capable of being processed" so as to ensure that there is no argument about the intentions in the mind of the user when it comes to the degree of protection which information receives on his premises.

Lord Elton

I am sure that the fault lies on my side rather than on the noble Lord's as to the explanation. I hoped that I had made it clear that the distinction which we regard as essential is that of the intention or otherwise to process these identical forms—and, indeed, almost any printed sheet can be recognised by a computer. If there is in one pile a mixture of those which it is intended to process and those which it is not intended to process then the office, obviously, is in a great muddle. The noble Lord suggests that because one piece of paper is not destined to go on to the company's records but is destined to go into the wastepaper basket, while it remains in the office it should be available under the Bill. I will take careful thought about what the noble Lord has said.

I think that he is not on to a very great principle here because, if the intention was reversed—as I was trying to say earlier—supposing that somebody either advisedly or ill-advisedly put for process some or all of the pieces of paper that were not intended by management to be processed, as soon as they were processed they would be caught by the Bill. At the only moment when they are about in the office and not caught by the Bill, they are de factoposing no threat to the data subject except that they may be processed although there is no intention to do so. As I say, if that intention should manifest itself or, in fact, if they are put on to the computer, they instantly fall into the Bill. I do not see that the noble Lord has shown us a great hole in the Bill. I will read what he said with great care because he is very expert in these matters.

Clause 1 agreed to.

Clause 2 [The data protection principles]:

4.58 p.m.

Lord Elywn-Jones moved Amendment No. 7: Page 2. line 31, leave out from ("Act") to end of line 32.

The noble and learned Lord said: This amendment raises a question of some importance. It is part of a curious provision, as I venture to regard it, in the Bill. The Bill contains a general interpretation clause (Clause 39) but, additionally, by virtue of Clause 2(1), with which my amendment deals, there is an interpretation provision of an entirely separate character in Schedule 1 to the Bill. At page 31 of the Bill, there is a long interpretation provision running to seven paragraphs. The aim and purpose of this Bill, as the Government's White Paper has said, is this: In order to conform with international standards of privacy protection and to avoid possible barriers to trade, the Government has decided to introduce legislation which will apply throughout the United Kingdom and will enable the United Kingdon to ratify the convention". It is both explicit, I venture to suggest, and certainly implicit that there should be no departures from or reservations to the provisions of the convention. Article 25 of the convention expressly provides that no reservation may be made in respect of the provisions of the convention.

My submission in regard to the schedule at pages 31 and 32 is that it qualifies the right provided by the convention for the data subject to see his own personal records; and, although the convention provides for facilities to be given at reasonable intervals, the schedule purports to define and determine what "reasonable intervals" should be and what they should amount to. Paragraph 5(2) of Schedule 1 reads: In determining whether access to personal data is sought at reasonable intervals regard shall be had to the nature of the data, the purpose for which the data are held and the frequency with which the data are altered". My submission is that, surely, any interpretation or guidance of that kind should not be provided in this curious provision in the Bill but should be a matter for the advisory committee of the necessity for which we hope in due course to persuade the Committee. But we certainly have a registrar, who is to be in post and functioning and who, it is hoped, will either issue codes of practice or approve them, giving effect to points of interpretation which paragraph 5(2) seeks to give as part of this Bill. In our submission, the provisions of paragraph 5(2)—that is one example of what we complain of in this twofold interpretation procedure—qualify the right provided by the convention for the data subject to see his own personal records. For that reason we submit that it is certainly in breach of the convention.

There is associated with this amendment Amendments Nos. 8, 9 and 10, and it may be convenient for us to consider them together. Amendment No. 8 proposes to leave out Part II of the schedule altogether; Amendment No. 9 seeks to leave out sub-paragraph (1); and Amendment No. 10 seeks to leave out sub-paragraph (3). That is the substance of the amendment which I move. I submit that it amounts to a breach of the provisions of the convention, and as such breaches are a serious matter, bearing in mind that the whole purpose of this Bill is to give effect to the convention. I should like your Lordships and indeed the Minister to consider sympathetically and seriously the amendments which I propose. I beg to move.

Lord Elton

I hope I can sweep up all the ground the noble and learned Lord has put before us, but if I do not, doubtless he will bring me back to the Despatch Box to deal with the omissions. The eight principles set out in Part II of Schedule 1 to the Bill contain a number of difficult and imprecise concepts. For instance, there is no objective indication of what ought to be taken to constitute obtaining information unfairly under the first principle. Equally, under the second and third principles, it is not clear how the purposes for which data are held are to be specified: nor is it clear how the incompatibility of a use or disclosure with a purpose that has been specified should he judged. And the fifth principle contains no indication of how the concept of accuracy should be applied to opinions and data held in other forms, on which the test of accuracy can only be subjective.

The list of principles is fairly scattered with uncertainties, but I have said enough to suggest to your Lordships the difficulties that could arise in interpreting them. It was difficulties of this kind that persuaded the Government that it would be wrong to place data users under a direct statutory obligation to comply with the principles enforceable through the courts. Thus, the principles are to be enforceable through the registrar's powers, the exercise of which is to be subject to a right of appeal to a specially constituted tribunal. Yet setting up the registrar and the tribunal to interpret the principles rests a very considerable responsibility and discretion there; and it therefore seems appropriate for Parliament to provide some indication of how it intends the principles to be interpreted. This added guidance has been introduced by way of separate interpretation rather than by amendments to the principles, for two reasons. First, we have sought to follow the convention so far as possible in formulating the principles; and, secondly, the form of some of the interpretation—such as the factors to be taken into account under the first principle, for example—suggests that this is the best approach.

Formally, this interpretation will come into play wherever an issue arises as to whether a given activity is in contravention of one or more of the principles. When considering refusing an application for registration or the service of a notice, the registrar will have to be satisfied, broadly speaking, that a principle or principles (as interpreted in Part II of Schedule 1) has been contravened. Similarly, the tribunal will be guided by the interpretation when considering appeals. Yet the usefulness of the interpretation will go beyond those formal situations. Although data users are not to be under a statutory obligation to comply with the principles, the vast majority will clearly take steps to ensure that they do comply, thus conforming with standards laid down by Parliament and avoiding any question of the registrar's deciding to take action against them.

Obviously it will be of considerable help to data users if the Bill provides additional guidance on what is to be expected of them. I am a little surprised that it is noble Lords opposite who are now suggesting that we delete the interpretation offered on the principles. Perhaps I am wrong, but was it not the noble and learned Lord, Lord Elwyn-Jones, who, in Committee on the previous Bill, painted a heart-rending picture of the fourth principle which he described as a "little ewe lamb" that was bereft of interpretation? It gives me great pleasure once in a while to quote against noble Lords things that they have said in the past, because they are so fond of doing it against me. Was it not the noble and learned Lord who argued then that that gap should be filled and that all the principles should be accompanied by interpretation? Now it is suggested that there should be none.

The interpretation of Part II of the first Schedule cannot, of course, deal with every situation: this is one of the objections of the concept of legally enforceable codes of practice. But it can put flesh upon the bones of the principles and thus provide some guidance. Returning to the question I raised earlier on the meaning of the principles, paragraph 1(1) of Part II of the Schedule provides factors for consideration in determining whether information has been obtained fairly. Paragraphs 2 and 3 provide that the purposes for which data are held and used must be specified in the register and that the persons to whom data are to he disclosed must also be so registered.

Paragraph 4 provides that the term "accuracy" in the fifth principle is to have the same meaning as it is given for the purposes of Clause 22, thus ensuring, among other things, that the registrar is not faced with the impossible task of determining whether the substance of an opinion is accurate—a test which cannot be meaningfully applied to something other than a matter of fact. We shall, I do not doubt, be paying some attention to Clause 22 at a later stage in our deliberations; but so long as "accuracy" is defined as it is in Clause 22, the same definition must surely guide the registrar in the application of the fifth principle, whatever it then is.

I must finally stress one thing: that the overall effect of the interpretation of Part II of Schedule 1 is neutral. It is biased neither towards the data user nor towards the data subject. The interpretation simply represents an attempt to give sensible statutory effect to the principles. Paragraph 5(2) of the Schedule only provides that "regard shall he had" to certain considerations in determining what is meant by "reasonable" in the principle. It must be for national legislation to offer whatever interpretation the member state wishes to give as to what "reasonable" means. Therefore I cannot accept the noble and learned Lord's contention that this represents a breach of the convention, which would indeed be a serious matter.

I have not spoken directly to the other amendments, Nos. 8, 9 and 10, to which the noble and learned Lord referred. He did not actually elaborate the specific aspects in his speech and I suspect that it is in the main principle that he is chiefly interested at the moment. That, I hope, I have covered adequately.

Lord Prys-Davies

I should like to ask two questions of the noble Lord the Minister. He speaks of the national interpretation of the principles. First, does the convention itself include an interpretation section? Secondly, when national parliaments have adopted the principles, have they also included in the legislation an interpretation clause?

5.10 p.m.

Lord McIntosh of Haringey

The noble Lord the Minister, in defending the clause, said that the interpretation here was neutral. If we could all agree on that, the purpose of the blanket amendment which my noble and learned friend has just moved would be, to some extent, diminished. But I want to argue that in at least two cases the interpretation that we have very clearly diminishes the rights of data subjects and cannot possibly be said to be neutral.

The first example that I want to give is from principle No. 2: Personal data shall be held only for one or more specified and lawful purposes". As I understand that principle, the intention is that when data are collected they should not then be made available to other people for other purposes, or indeed used for purposes other than that for which they were originally collected. Clearly, this applies particularly to personal data. To take the most harmless example, membership records should not be made available to mail order houses unless the member agrees that they should be so made available. Of course, in recognition of that risk the mail order organisations have already adopted a voluntary code to try to give people who are on membership lists the right to be excluded from this onward transmission of their records to other organisations for other purposes. So, clearly, principle No. 2 is intended to defend the data subject.

Yet the interpretation of the second principle does the opposite. It states that it, shall not be treated as held for a specified purpose"— in other words, the protection will not exist— unless that purpose is described in particulars registered under this Act in relation to the data". I may be totally misreading this. I am not a lawyer and I shall be delighted to be corrected. But, as I understand it, unless the originator of the data, the original holder of the data, declares it when he registers the data, then the further use which has not been so declared and so registered no longer falls under the scope of the Bill, and therefore the protections intended in the second principle in the Schedule are no longer available. I hope that I am wrong, but I do not see it at the moment.

The second example that I should like to give is principle No. 7(b), where an individual has a right—unqualified as it stands in the principles— where appropriate, to have such data corrected or erased". We could argue about having data erased. We could argue that data subjects do not, in all circumstances, have the right to have records about themselves erased. I do not see how we could argue about the right to have records corrected. If there is something that is wrong, the person who is affected by it, the data subject, has the right to have it put right. However, the interpretation introduces a totally new qualification which is in no way, in my view, an interpretation but is, in fact, a limitation. It states: The correction or erasure of personal data is appropriate only where necessary for ensuring compliance with the other data protection principles". Surely, the right to have data about yourself corrected when they are wrong is, or ought to be, an unqualified right and ought not to be dependent upon any other data protection principles. In those two aspects—and there may well be more—I submit that the interpretations that we have in Schedule 2 are not neutral. They are biased against the data subjects and ought not to be defended in the blanket way which the noble Lord the Minister did.

Lord Elton

Is the noble and learned Lord leaping up? I am very happy to have further time to cogitate.

Lord Elwyn-Jones

As it falls to me to reply, I am anxiously happy—if anxiety and happiness are coincidents—to hear the noble Lord answer the questions.

Lord Elton

On a number of specific points I want to say, first, that the convention has a commentary but it has no interpretation section as part of it. Equivalent legislation in Europe has interpretation sections, and this is proper because, with all the difficulties of language, it is right that individual countries should apply the definitions which are appropriate to their own language, and indeed to their own constitutional and litigious experience. The convention uses general terms such as "reasonable" in the full knowledge that differing interpretations will be appropriate in different states.

The noble Lord, Lord McIntosh, referred to an apparent discrepancy in the intentions of the Bill and its effects, and sought to illustrate this by looking at the second principle and the interpretation thereof. As I recall, what he was saying was that, if data were held but were not registered, and were used for purposes which were not "one or more specified and lawful purposes", then they were not caught by the Bill. But, if he looks at Clause 5(1), he will see that that, in itself, constitutes an offence and that the Bill operates in the way that we intend. The second principle is breached if the data are used for a different purpose from that which has been declared. I am not sure whether I have covered the other points that were raised by noble Lords—if I am speaking hesitantly I apologise—but I am sure that I shall be corrected if I have left them out.

Lord McIntosh of Haringey

Very briefly, is there an answer to my queries about the provisions for correction of incorrect data?

Lord Elton

The provisions about correction and erasure occur in the body of the Bill. I did not follow the noble Lord when he was saying that what he did not like about the provisions was implicit in the part of Schedule 1 which his noble and learned friend wishes to remove. It may have been a momentary lack of attention on my part, and if he would be kind enough to direct me to what he referred to. I shall try to deal with it.

Lord Avebury

I have listened to the noble Lord, Lord McIntosh. and I think that I can answer his question. What he said was that he disagreed with the provision in paragraph 5(3) in Part II of the Schedule, which states that: The correction or erasure of personal data is appropriate only where necessary for ensuring compliance with the other data protection principles". He said that that limitation was in contravention of the convention, which declared that the data protection principles were of absolute enforcement. But, if he looks at Principle No. 5 of the data protection principles, that states that: Personal data shall be accurate and, where necessary, kept up to date". So what the intepretation in paragraph 5(3) is stating is that, whenever the information is shown to be wrong, it has to be put right. One might ask why it is necessary to have Principle No. 5(3) at all, because it does not seem to impose any limitation on the right of a person to have inaccurate data corrected.

Lord Elton

I am happy to state that the noble Lord, Lord Avebury, having spotted the linkage that I did not see, has also produced the reply which I did not produce.

Lord Elwyn-Jones

I venture to submit that this exercise—if that is the right way of describing it—of seeking to set out an interpretation of all the principles as part of the Bill itself is liable, to put it at its lowest, to amount to a reduction in the rights of data subjects and a qualification to the entitlement of data subjects to have access to their own records and to have that data corrected or erased where appropriate. My submission in regard to paragraph 5(2), for example, which is dealt with in my Amendment No. 9, and to some extent in Amendment No. 10, is that the better course would have been to have provided for a code of practice and to have provided for other machinery—the existence of the advisory committee, which we are going to propose—to work out, on the ground and in the light of experience, what the interpretation provisions ought reasonably to be.

In the last resort, of course, it is the function of the court itself to interpret the Act of Parliament as it will ultimately emerge; and, of course, interpretations by the courts in themselves establish, in certain categories in due course, at any rate a pattern, if not a code of practice. I have raised the matter, and I think it calls for further thought. I am not proposing to invite the Committee to divide on the matter at this stage, but I venture greatly to doubt the value of this exercise. It has the risk of diminishing the all-important right which the whole of this scheme ought to provide; namely, the right of the data subject to be entitled to act as to his own records, so that he can have them corrected or erased where appropriate. At this stage, therefore, I do not propose to move the amendment.

The Deputy Chairman of Committees (Lord Jacques)

It has been moved already. The noble and learned Lord should withdraw it.

Lord Elwyn-Jones

I beg your Lordships' pardon. It is a long time since I engaged in any exercise like this. I withdraw the amendment surviving.

Amendment, by leave, withdrawn.

Clause 2 agreed to.

5.22 p.m.

Schedule 1 [The data protection principles]:

The Deputy Chairman of Committees

I should tell your Lordships that if Amendment No. 8 is agreed to I shall not be able to call Amendments Nos. 9, 10 or 11.

[Amendments Nos. 8, 9 and 10 not moved.]

Lord Winstanley moved Amendment No. 11:

Page 33, line 10, at end insert— ("(2) These provisions shall apply to data collected from published sources and held in connection with the purpose of publishing by organisations whose primary function is publishing.").

The noble Lord said: This amendment, like certain others standing in my name on the Marshalled List, has been inspired (if that is the appropriate word) by some discussions I have had with people working at a very senior level in the BBC. It is not necessary for me to remind the Committee that the BBC is an organisation which nowadays makes increasingly wide use of computers, and the BBC readily acknowledges that some of these applications properly come within the scope of this legislation. At the same time there are people in the BBC who believe that there are some aspects of this Bill which, perhaps, from their point of view, have not yet received an adequate scrutiny; and, indeed, this is perhaps one of them.

This amendment is fairly simple. It merely seeks to amend Part II, paragraph 7, of Schedule 1 by adding the words as printed. It begins with the figure (2), which presupposes that if this sentence is added this would become (2) whereas the earlier part of that paragraph would become (1). It says: These provisions shall apply to data collected from published sources and held in connection with the purpose of publishing by organisations whose primary function is publishing". The words "These provisions" relate to heads (a) and (b) in that paragraph, (a) being, the information contained in the data shall not be regarded for the purposes of the first principle as obtained unfairly", et cetera; and (b)being, the data may, notwithstanding the sixth principle, be kept indefinitely". The sixth principle, as your Lordships know, is that which requires that data may not be kept longer than is necessary for the purpose for which it was collected. It is obvious that an organisation like the BBC must, on a continuing basis, maintain a data base of newspaper cuttings and other published material, and to the best of my knowledge published material of that kind is not at the moment exempted by the Bill.

The points made to me about the working of this part of their activities by organisations like the BBC—and no doubt by other television companies, too—are that they collect and have on a data base press cuttings and information of that kind on a continuing basis—and who is to say the purpose for which it is collected? It is collected for the purpose of collecting it: in case it is needed later for some purpose. For example, it might be necessary to collect published information about the noble Lord lest presently he should be appointed to some high office and they might wish to refer to his earlier records and things that have been said about him. That is one purpose. It is possible, of course, that the noble Lord might later become ill. It is even possible, though it would be desperately regrettable, that he may even die, and then they might need that information for the purpose of an obituary.

It is quite impossible for such an organisation, whose activities are now computerised in that way (where they have an electrical newsroom and a data base of published material), to state in advance the purpose for which they are collecting it. As the amendment says, we are dealing here with data collected from published sources. Were it to be inaccurate or, perhaps, defamatory, the individual so defamed might have had a remedy at the time it was originally published. There may later be a further defamation if it is further published in that particular form without amendment. I think the BBC are concerned that in no way should that essential, technological part of their operations, and the way in which they work at the moment by compiling a data base of this kind. be caught under this Bill in an undesirable way. So if these words are added it will make quite sure that matters of that kind are virtually exempt. I beg to move.

Lord Elton

I am grateful to the noble Lord for the able explanation of his amendment, and for revealing the source of his inspiration (if, as he says, that is the right word). I admired almost everything about his speech, although I am not sure that I admired the conduct of the rest of the Committee. The sort of delighted levity which spread across the Benches opposite when the prospect of my eventual demise was mentioned was something which I found rather disheartening!

Lord Elwyn-Jones

Only feelings of total sorrow occupied our breasts!

Lord Elton

The noble Lord is familiar with Rudyard Kipling's story of the snake which bit the footprint of an unfortunate person, many miles away, who died, and of the celebration at the funeral being so merry that the snake decided that the bite was powerless and sicked up its venom upon every other snake in the kingdom, thus reducing its own lethal capacity. Possibly this is the effect of the analogy which I have drawn, but I am not at all sure because I have gone rather far from the starting point.

Can we now revert to the Bill? This is the first amendment of what I take to be a series in which special treatment for those engaged in publishing is sought, but I will not address the wider question as to why there may or may not be valid reasons for publishing to be singled out for special treatment since our substantive consideration will come on later amendments. For the moment, I will restrict myself to the suggestion that publishers already gain some special benefit under paragraph 7 of Schedule 1. Paragraph 7 is there to guarantee that data held for historical, statistical and research purposes will not be deemed to be in breach of the first principle if the people from whom the data were originally collected were not told that the data would be used for those purposes. It also guarantees that the sixth principle, which requires data not to be held longer than necessary—which caused the noble Lord some concern—will be interpreted as allowing this particular category of data to be held indefinitely. Both provisions seem reasonable to ensure that there is no impediment to the use of data for bona fide historical, statistical or research purposes.

The first point I must make is that publishers, as well as anyone else, can benefit from the provisions of paragraph 7 if they hold data for the specified purposes. I understand that the noble Lord seeks to go further than that and wants data held by publishers which is collected from published sources to benefit from the special interpretation in Paragraph 7. But I see neither the need nor the justification for that. There is no danger from the application of the first principle to the particular data about which the noble Lord is concerned. If information is collected from published sources, the disclosure of the purpose for which it is to be used does not arise. I scarcely imagine that the registrar could ever argue that a publisher was obtaining information unfairly if he took it from published sources.

As for the sixth principle, to which paragraph 7(b) is addressed, the position is somewhat different. The noble Lord wants to permit publishers to keep data indefinitely, and it was this aspect of the amendment upon which he enlarged. But why allow this? I am not sure I can see why publishers should not be subject to the sixth principle like everyone else. Why should they be permitted to hold data for longer than is necessary for their purposes? They may say, "We need to hold the data for a long time", and so may anybody else. If the registrar comes along, it will be for the publisher or any other user, similarly, to persuade him that the data do need to be kept for the length of time that the user has in mind, however long that may be. If the users have a good case, then the registrar will accept it. If not, he will reject it.

I believe that is as it should be, and it seems to me that the provision of a valuable news service is a useful and valid purpose for which the material should be kept; and I believe it was that aspect which the noble Lord had in mind. We have to be careful about making special cases in this field. I hope the noble Lord will accept that publishers do not need the special treatment he has sought with this amendment, and that there is no difficulty for the BBC in describing the purpose for which they hold data which is the preparation of material for broadcasting radio and TV programmes—and particularly news programmes—or some such purpose, if that is what the noble Lord has in mind.

Lord Winstanley

I am most grateful to the noble Lord the Minister for those words, which I am still trying to recollect and understand. It appeared that the noble Lord both agreed and disagreed with me. It seemed that in quoting from the Bill to start with, the noble Lord was quoting the heading to this particular paragraph, which reads: "Use for historical, statistical or research purposes". He seemed to be saying that that phrase would apply to the activities of an organisation such as the BBC. In other words, that this phrase was equal to, the purposes of publishing by organisations whose primary function is publishing". Initially, the noble Lord seemed to be suggesting that my amendment is not necessary in order to protect the BBC's right to continue doing that which it is now doing and which it believes is necessary for it to do in order to continue its operations. But in the latter part of his reply the noble Lord the Minister appeared to deviate from that suggestion and to argue that this amendment would in some way be making a special case of an organisation such as the BBC or any broadcasting organisation, which must of necessity collect information and preserve that information electronically on a data base without necessarily knowing why it is collecting that information or for what purpose it may eventually need it.

If I may say so, precisely the same kind of activity is under way along the corridor, in your Lordships' Library, where the librarians are collecting electronically vast amounts of information. The librarians do not know the purpose for which that information will eventually be used, but they believe that they have a duty to collect it. The same applies, in a sense, to the BBC; the BBC feel that it is necessary to maintain a proper bank of electronic press cuttings in case it should be necessary to consult them in connection with later eventualities which are not yet envisaged.

To begin with, the noble Lord appeared to suggest that the BBC was not in any jeopardy and need have no fears. Then he suggested that if this amendment were made we would be giving the BBC some special privilege that is not enjoyed by others. All I have to say at this stage is that I shall think further on that which has been said by the noble Lord and perhaps consult with those who are advising me. I will not withdraw the amendment, lest other noble Lords may have something to say first.

Lord Mishcon

I would not attempt to stop the noble Lord, Lord Winstanley, from taking any action he deemed expedient, but only because of the morbid note he introduced into this debate in referring to what might happen to the noble Lord the Minister—

The Lord Chancellor (Lord Hailsham of Saint Marylebone)

Will happen.

Lord Mishcon

But we all hope that it will not happen for a very long time. What occurs to me is, what would happen in the case of computerised details prepared by a publishing house for the purpose of producing obituary notices? Would the data subject be entitled to inquire of The Times, for example, what that paper is likely to print about him when his obituary notice appears? Even more sorrowful, would the inquirer be able to find out that The Times intends to publish nothing in regard to his obituary notice when he disappears from this earth? The noble Lord, Lord Winstanley, has raised rather an interesting point—not intentionally, I believe, but only by his reference to the morbid occasion he mentioned.

Lord Winstanley

The noble Lord, Lord Mishcon, appears to be suggesting that I somehow singled out the noble Lord, Lord Elton, for special treatment.

Lord Mishcon

I would only say to the noble Lord, Lord Winstanley, that by virtue of his profession he must have forecast the deaths of many people, quite apart from the noble Lord the Minister.

Lord Winstanley

By virtue of my profession, I am very well aware that what I suggested might happen some time to the noble Lord, Lord Elton, I am absolutely certain will happen sooner or later to all Members of your Lordships' House.

Lord Elton

I suppose that we are, all of us, interested in our obituaries. I would interrogate the relevant computers only with the greatest hesitation—not from fear of not being mentioned, which I should not find all that disagreeable, but from fear of finding an unfavourable mention. I believe that luck is distributed between families on a fairly even basis. My grandfather actually did come back from a holiday north of the Arctic Circle to read his obituary. It was favourable, and I cannot believe that that is likely to happen twice in the same family. Therefore I am not going to chance my luck. If what is in question is data, and if there is an intention to process them—or if they are processed—then they are subject to the Bill. The noble Lord has suggested rather a dangerous pursuit for some of us.

Lord Winstanley

May I finally ask the noble Lord one more question, because I was not utterly clear about this aspect from the answer he gave? Am I to understand from him that the activities which I described and to which my amendment refers, carried out at the moment on a regular basis by the BBC, would be regarded as, "Use for historical, statistical or research purposes", as explained in the paragraph—in which case, my amendment would not be necessary?

Lord Elton

If the data were used for historical, statistical or research purposes, then plainly they would fall within that paragraph and the noble Lord would have no worries. If they did not fall within it—because I imagine that there is a vast range of information and some data are used for one purpose and some for another—and the data were used for some other purpose, such as presenting a news programme, then I suppose it could be argued that it was an application concerning very recent history. If it were not, it would still be a very legitimate purpose for holding the data and I should have thought there would be no great need for justifying this to the registrar and making him understand that what was on the data bank was necessary for the function performed by the BBC, just as what is being built on the data bank in the Library of your Lordships' House is necessary for what goes on in this Chamber.

Lord Avebury

I think the noble Lord said in his first speech that the information could not be regarded as having been obtained unfairly if it came only from published sources, and if the purposes of the BBC or any other publishing organisation were served by the collection of information from newspapers and journals then the protection which would have been given to them by paragraph 7(a) if my noble friend's amendment had been incorporated in the Bill would be unnecessary. Any person who uses press cuttings in the course of his work does not need to define precisely what the purposes are, because the noble Lord said that in the case of an organisation such as the BBC it would not be as specific as obituaries or news articles or features and it would be enough for the BBC to say that the information was collected in pursuit of their general publishing activities.

The point I was going to make was this. If the information in these press cuttings is open to question in any way, would the BBC or any other publishing organisation be liable to action for breach of the principles, or would it be sufficient defence for them to say that these cuttings were obtained in good faith from newspapers and they had no reason to doubt the accuracy of the statements therein? Or would the data subject who is recorded at secondhand in the archives of the BBC have a right of correction of a record which itself was false? It seems to me absurd if every person who owns a press cutting library is going to have to make corrections in the electronic version of the cutting so that what he will have in the library is not a verbatim record of what was originally in the newspaper but a bowdlerised version amended to satisfy the data protection principle.

They would not in the event be able to quote from The Timesor the Telegraphbut only be able to produce an amended version of the original article in the newspaper which had the reference to the individual put right after he had discovered that it contained some fault. It seems to me a rather curious consequence that perhaps we had not envisaged and that it will be an enormous burden for publishing organisations if my interpretation is correct.

Lord Donaldson of Kingsbridge

May I make a quick comment? There seems to be some confusion in the mind of the Minister about archives. Archives are always as complete as they can be. That is what the word in its modern sense means, They are cross-indexed through computers in a way they never could have been in the old days. For example, the British Institute of Recorded Sound has a copy of every record that has ever been produced, bar one or two they have not been able to get hold of, and of every broadcast made. These are, or eventually will be, fully cross-indexed. This seems to me an abosulutely legitimate part of the collection of information for posterity. The fact that the BBC is going to use it for news is quite irrelevant. They are wholly entitled to do this in any case.

Lord Elton

I am obliged to the noble Lord, Lord Donaldson, for directing my mind to that part of the BBC's assembly of information which is known as the archives and is internationally famous. I had understood from the noble Lord, Lord Winstanley, that he was referring to a bank of information for current affairs programmes and it was to that that I addressed myself. The noble Lord nods. The noble Lord, Lord Winstanley, addressed our minds first of all to publishers as such and asked whether they could not be exempt from the provision of the Bill for activities other than those described in paragraph 7 of Part II of Schedule 1 as bestowing particular benefits or exemptions on those pursuing them; that is to say, historical, statistical and research purposes. We went over those in some detail last time round.

What I am saying is that where the information is to be used for historical, statistical or research purposes, whether by the BBC or any other publisher, it will be subject to paragraph 7. Where it is use for other purposes it will be required to satisfy the definition of inaccuracy in Clause 22, which I think we are going to discuss later. That clause will apply to the BBC. If the information is received from third parties then the special conditions refer, and they are set out in subsection (4) of Clause 22. I think that is sufficient exemption. It answers the anxiety of the noble Lord, which has shifted from how long information may be kept to how accurate it must be. The broad answer is that it must be as accurate as the purposes for which it is held make appropriate.

Lord Winstanley

I am most grateful to all noble Lords, and particularly to the noble Lord, Lord Elton, for their help on this rather difficult matter. In view of what was said earlier, may I express the hope that all noble Lords will still be with us by the time we return to the matter. In the meantime, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Schedule I agreed to.

Clause 3 agreed to.

5.48 p.m.

Lord Elwyn-Jones moved Amendment No. 12: After Clause 3, insert the following new clause:

("Data Protection Advisory Commitee.

.—(1) For the purposes of this Act there shall be a Data Protection Advisory Committee (in this Act referred to as "the Advisory Committee").

(2) The Advisory Committee shall consist of not less than five and not more than nine members appointed by the Secretary of State after consultation with the Registrar.

(3) The members of the Advisory Committee shall include persons appearing to the Secretary of State and the Registrar to have professional knowledge or experience of health care, research, statistics, the prevention and detection of crime, employment, public administration, the law, and the design, manufacture or use of data equipment together with one or more persons to represent the interests of data subjects.").

The noble and learned Lord said: Here we return to familiar ground: namely the requirement, as we submit it is. the necessity indeed, of a data protection advisory committee. The Government White Paper has struck a curiously ineffective approach, if I may say so, to this matter. It provides that once the legislation is in force it might be appropriate to appoint an advisory committee to advise the Government on the preparation of regulations relating to particular categories of data, and, if the need arose, on possible changes to the legislation itself. We submit that that is a wholly ineffective approach to a situation in which the registrar on appointment will find himself facing a multitude of difficult questions, difficult issues in a wide range of subject matter. We propose that to assist him and the Secretary of State a data protection advisory committee should be set up. It is to consist of not less than five and not more than nine members appointed by the Secretary of State after consultation with the registrar. So he will be very much in the picture from the beginning.

We propose that the membership of the advisory committee shall include persons appearing to the Secretary of State—and again to the registrar, because obviously one wants a body which has the full confidence of the registrar—to he experienced in, and then set out the kinds of subject matter in respect of which the expertise of an appropriate advisory committee would obviously be of value and assistance: professional knowledge or experience of health care, research, statistics, the prevention and detection of crime, employment, public administration, the law, and the design, manufacture or use of data equipment. They are the kind of matters which we submit are likely to arise when the machinery of this Bill is brought into being. Then we have added together with one or more persons to represent the interests of data subjects", whose privacy, of course, is above all the concern of the Bill.

We submit that this is the proper stage to create an advisory committee. Our concern in introducing Amendment No. 12 is to have it firmly established at this point that the status of a statutory body should be given to the advisory committee from the moment the Bill become an Act, so that from the beginning the registrar is able to advise and proceed on the right lines in this very difficult field of expertise. Experts will then be immediately available to him. There is no reason why, if it proved necessary, we could not then enlarge that list of membership. Subsection (3) of the new clause provides that the membership should include such persons and the range of expertise can obviously be added to.

We believe this to be a proposal of great importance which would give greater confidence in the functioning of the machinery of the Bill. As the Bill stands the lone figure of the registrar in, if I may say so, an area of potential controversy will not be protected by the advice that an advisory committee could give him. It is also right that Parliament and the public should know from whom he is seeking advice. It is not an area where the Secretary of State is, so to speak, on hand. In any event the registrar is an independent person with, one would hope, the kind of status of an ombudsman. Therefore we feel very strongly on the importance of a data protection advisory committee's being established now as a statutory necessity and a statutory institution and that it should be provided for in the Bill. I beg to move.

Lord Donaldson of Kingsbridge

Would it not be helpful to have the next amendment discussed at the same time?

Lord Digby

I intend to say a few words here, but I shall not move Amendment No. 13 until I have heard what the Government say on Amendment No. 12. As the Bill stands there is a lack of opportunity for the discussion of data protection by interested users as the implementation of this Bill develops. Local authorities in particular are concerned at this gap. They administer a wide variety of services requiring the storage of data. As the Government have decided to appoint a registrar rather than set up an authority, as previously suggested, there should be, in my opinion, a committee of this type to provide a forum for energetic consideration of data protection as it develops and to advise the registrar on the practical implications of any step which he chooses to make. In my amendment this committee would include representatives of local authorities and certainly under this amendment could do so. They have tremendous practical experience, or will have, of these problems.

I am aware that my noble friend Lord Elton has suggested that the committee would be inhibited by its statutory basis. I cannot quite understand that. I should have thought that the statutory basis would be a help as the committee would have a firm and recognised base from which to give advice. As I said, I shall wait to hear what the Government have to say in response to this amendment before deciding whether to move my Amendment No. 13.

Lord Mottistone

May I make a few remarks about both Amendment No. 12 and Amendment No. 13? It seems to me that Amendment No. 12 tells us what the committee should consist of and what sort of people should be on it, but it says nothing about what the committee should do or whom it should advise. I should have thought that Amendment No. 12 was at fault in that respect. In any Act of Parliament, if one sets up a body one must say what it has to do, or it might do anything. That is one disadvantage of the amendment.

I am not terribly happy about my noble friend's Amendment No. 13 because it goes out of its way to say that the committee should include persons nominated by the associations of local authorities". Why pick out local authorities? Why not, for example, include people nominated by the CBI the retail consortium or all sorts of other bodies? What one might call the business and manufacturing element of Amendment No. 12 is rather limited because it only allows manufacturers and users of data equipment; it does not allow other manufacturers. Therefore, although I can see what the noble Lords are getting at, and I, too, shall be interested to hear what my noble friend the Minister has to say, I think that both these amendments should not be pursued because they are, in the case of Amendment No. 12, incomplete or partial in the case of Amendment No. 13.

5.58 p.m.

Lord Mishcon

I think we shall be fated to get nowhere on this very important amendment if we try to spell out at this stage what ought to go in by way of terms of reference for the advisory committee and what ought not to go in. If I may respectfully say so, I believe the Committee would be well advised to concentrate on the principle, otherwise we shall lose the tree, which is a very valuable tree, because people are quarreling about the branches. We can obviously deal with the branches on Report, or elsewhere. The essential thing to get over is the necessity to have an advisory committee, otherwise the noble Lord's reply will be a very obvious one.

May I start off on the basis that all of us want to see the progress of this Bill meeting the progress of the times. There is not the slightest doubt that many of us in this Chamber, if asked to forecast where computers will get to in even five years' time, may prove to be very inaccurate. There is, therefore, a necessity for the registrar to have the benefit of a competent advisory committee. The question of membership can be argued about on Report, Third Reading, or whenever. An advisory committee is needed which can consider, with the registrar, what is happening from year to year which makes it necessary to keep up to date—it may be codes of practice, or whatever—in order that the Bill, if it is enacted, does not become a dead letter in no time at all.

If we leave this Bill without an advisory committee I respectfully suggest that as soon as it is passed and the registrar appointed he is made the first guest thereafter on "Desert Island Discs" because he is left in very lonely isolation to deal with the whole of these problems and it is as though he is placed upon a desert island. I think he might choose as one of his tunes, "Why have I been left so alone?" Under this Bill he is left in absolute isolation to do the registering, reporting, supervision, administration, creative thinking and keeping up to date.

The noble Lord the Minister, who has used, if I may be allowed to say this, a receptive mind upon this issue, has limited himself to the fact that he will agree that it may be a very good idea to have an advisory committee but he does not like to have it in the Bill. The reason, as I understand it—and he will correct me if I am wrong—is this. He says that if you put the advisory committee in the Bill, first of all, you are taking it for granted that it will always he wanted, because once you create something in a Bill it is very difficult to destroy; and, secondly, you are possibly limiting the powers of that advisory committee by trying to look ahead, because you have to give powers in the Bill. There, of course, the noble Lord, Lord Mottistone, has a good point—but not at Committee stage; it may be in the ultimate that he has a good point.

If you give the advisory committee general powers to advise, it cannot be harmful. They do not have the right to legislate but only to advise, and you are doing two things. First, they will always have the duty of advising and will always be wanted for that purpose. Secondly, if you are careful not to prescribe within too limited boundaries what their duties are, then you are going to answer the point of the noble Lord the Minister about the fact that you may be frustrating them in endeavouring to legislate their powers now and you may be narrowing them down and, from that point of view, you may be bad legislators.

We must not be caught between these two evils: the one of doing nothing about it at all and the other of doing something which will defeat the very object that we are out to achieve. We have to find a formula. To leave this to the whim of fortune after this Bill becomes an Act, and not to have it in the legislation, is not only to defeat our own wisdom—which I think ought to be on the side of setting up the advisory committee—but is to ignore the advice of the Lindop Committee, which was very specific upon the point that an advisory committee was necessary.

All we on our side, together with any of our friends who wish to have the advisory committee, are saying is this: do not let this amendment be defeated on the ground that there is no proper provision here for all the powers and duties. As I see it, a vote on this occasion would purely mean that an advisory committee of some sort was going to be set up with this expertise to which my noble and learned friend referred and which he described as it is indeed laid down in this amendment. We should be very wise at this stage not to get enmeshed in an argument about whether they should have further or smaller powers, but let the committee as a concept be set up and let us fill in afterwards (at Report stage. I hope) what indeed ought to be the powers of the Committee. But, if may say so, I would personally hope that its powers would be general advisory powers to the registrar and to the Secretary of State. Upon that basis, I do hope that this amendment will be successful and that the noble lord the Minister will see fit to accept it instead of putting us to the arduous task of having to implant upon him an advisory committee as a result of a vote of your Lordships' Committee.

Lord Donaldson of Kingsbridge

This is on the whole the most important amendment we have come to yet today, in my opinion. I said on Second Reading that whenever the Bill differed from the Lindop Report it seemed to me to be wrong. This is a very major omission. As the noble Lord, Lord Mishcon, said, the Lindop Report set great store not by exactly what the noble and learned Lord has moved in his amendment but by something even stronger. We are prepared to accept the amendment of the noble and learned Lord as being the most we are likely to get, but it is most awfully important that the performance of this lonely registrar, with his half dozen helpers, dealing with a very large number of things in an entirely new way, should have proper advice, and advice which has the backing of a statutory position.

When we come to talk about codes of practice, we shall be able to see that it would be extremely difficult for the registrar to deal with 150 different codes of practice at once, and he would have to do that sort of thing and work them out with people. But if he had a reasonable body of, I should have thought, rather more people than the noble and learned Lord said (I should like to see 15 to 20, representing different angles), each of the advisers could do some of the work, and the whole thing would be quite different.

As I said before in other amendments, the absolutely essential thing is that we should maintain flexibility in this Bill. There is no way the Bill can be anything but somewhat half-baked, because nobody knows how things will work out. It is absolutely fundamental not to fix anything which cannot be unfixed—and very quickly if it is seen to be going wrong. This is what the registrar will find very difficult to do by himself, particularly if he has a Secretary of State who is advised very largely by the people who drew up the Bill and who will naturally tend to get advice not to make changes too quickly. If it is the Home Office, it will certainly not be too quickly. I regard this as the most important item we have come to today. There is another equally important matter we are coming to on Thursday.

I hope very much that we shall pass this amendment, or, better still, get a promise from the noble Lord to introduce an equivalent amendment, which I should like to see include at least subsection (4) of the amendment of the noble Lord, Lord Digby. There is no harm in saying that: The Committee shall keep under review and advise the Secretary of State and the Registrar"— noble Lords will remember that, in the White Paper, the registrar was not to be advised at all; it was all to go to the Secretary of State, which was clearly wrong— and may report to the Secretary of State from time to time with proposals for any further or amended legislation". and so on.

I feel very strongly about this. If we could get an agreement that at the next stage the Minister will bring in something along these lines, possibly more or possibly less detailed, we should be very happy. If we cannot get an absolutely full assurance, I think we should divide the Committee and make our point of view clear.

6.8 p.m.

Lord Elton

We have had a most interesting and well-informed debate, and there has been some cogent argument from the other side of the Committee, and indeed from this. It has convinced me of one thing—the value which attaches to independent advice in this field. On this we are on common ground. But I have not heard anything as yet which has persuaded me that the advantages of placing an advisory committee on a statutory basis sufficiently outweigh the disadvantage of doing so. The objections are, I suppose, familiar. but then so are the arguments that have already been advanced. I think I must repeat them.

I first reaffirm that the Government readily accept that there might be a need for the Secretary of State and the registrar to have the benefit of expert advice on matters connected with data protection in the future. We have consistently said this, and there can be no doubt that in this complex area the Government will want to undertake appropriate consultations before any significant decisions are taken—whether through the establishment of a formal committee or otherwise.

Lord Donaldson of Kingsbridge

I only want to ask whether I heard the noble Lord aright. He said that there might be a need. If that is what he thinks, we are miles apart.

Lord Elton

I see. I take note of which end of the telescope the noble Lord looks through. Equally, the registrar will no doubt make full use of all types of expertise in carrying out his functions. Inevitably, however, providing for such a committee in statute would lead to an element of rigidity. One of the reasons why one might want to appoint a committee would be the rapidity with which technological change had taken place in this area—precisely the circumstances in which it would have been better not to have prescribed in advance the functions and role of such a committee. However widely the terms of reference were to be cast, there would always be the possibility that some new aspect of data protection could arise on which the committee's advice would be most welcome, but which would not be covered by its terms of reference.

Nor do I think it is any answer to establish a committee and then to leave it entirely free to range at will over whatever issues it choses, regardless of how relevant or useful might be its advice on such topics, or its compostion and experience. It is true that my noble friend's amendment proposed some general functions for the committee, but the amendment of the noble Lord opposite left the committee with no functions, no duties, and no powers. The noble Lord says that it has been explained. But it is a motor car without an engine. After all that has been said from the Benches opposite about the registrar's inability to do anything that the statute does not specifically require him to do, it is odd that noble Lords do not propose anything specific that the committee should do. What is sauce for the goose must be sauce for the gander.

There are also considerable difficulties about prescribing in statute the membership of an advisory committee. Once again, in an area susceptible to such rapid change, we are faced with the problem of anticipating at the legislative stage just which are the areas of expertise that will need to be represented on an effective advisory committee, five, 10, or 15 years hence. Indeed, my noble friends Lord Dighy and Lord Mottistone have pointed out that there may be significant omissions right now. I wonder what bankers, insurance companies and manufacturers are thinking of their exclusion from the list which has been proposed as appropriate for the contemporary scene. If we fossilise the composition of the committee by statute and put it into a rapidly changing context we are doing something unwise. It may at present be an up-to-the-minute solution but I would remind the noble Lord opposite that while the brontosaurus was the last-minute solution to the environmental problems of its days, the context in which it was placed changed rapidly and it could not change, as a statutory committee composed as he proposed could not change. I think that such a committee is bound to become rapidly out of date.

The amendment of the noble Lord opposite contained an impressive list of interest groups, but not I think a complete list. My noble friend's amendment—and he will forgive me if I refer to it by way of contrast, as he did—left considerable flexibility as to membership, but I note that he, too, found it necessary to inject a note of precision, which my noble friend Lord Mottistone immediately picked up and proceeded to ask, "Why them? Why not somebody else?" Finally, there is the problem, which I have also previously stressed, of being stuck with a statutory body which has outlived its usefulness—and the noble Lord anticipated this point, though he did not dispose of it—but which for some reason cannot be laid quietly to rest. It seems to me that the fundamental problem is that one has a choice: one can either spell out on the face of the Bill the details of such a committee, with all the risk of rigidity that that implies, or leave it open for subsequent resolution, perhaps by the exercise of order-making powers. As I have previously argued, the latter approach could be seen to undermine much of the theoretical independence of the committee which I had supposed to underlie the desire to see it placed on a statutory basis at all.

For those reasons, therefore, I remain for the moment unconvinced. But I repeat what I have said before: that we do not have closed minds on the issue of expert advice; nor I suspect are the minds of some of the advocates of a statutory committee entirely closed, either. When the issue was debated in Committee in another place, it appeared that the notion of a non-statutory committee would not be wholly unacceptable, provided assurances could be given that powers existed in the Bill to set up such a body. My honourable friend the Minister of State was able to confirm that the Secretary of State was empowered, if he so chose, to appoint such a committee, to pay its expenses, and to provide it with appropriate secretarial support. It is perfectly possible, too, under the Bill for the registrar to establish for himself a source of external advice, subject only to the Secretary of State's consent to payment of the sums involved.

I hope that with those considerations in mind noble Lords will not feel disposed to press an amendment which, as I have said, has no engine in it, which has no provision for pay and rations—which I should have thought would not endear it to anyone whom they wished to serve on it—and which has, I note, a maximum number of nine members, yet which already bespeaks those nine voices for nine sectors that need representation, and leaves no room whatsoever for other voices to be raised at all.

Lord Avebury

I am absolutely mystified by that reply from the Minister because he spent three-quarters of his speech saying why the committee was not necessary, and in the final quarter he suddenly said, "By the way, you can have a committee anyway". The Minister—

Lord Elton

I am getting through to the noble Lord, Lord Avebury, with less and less clarity as this debate goes on. I spent the first three-quarters of my speech—if that is the right proportion—in explaining that we absolutely agreed that external advice might be highly appropriate and desirable, but that we thought on balance that it was inappropriate and undesirable to make it statutory in form.

Lord Avebury

The noble Lord said that external advice was desirable, and that was certainly a repetition of something that he had said on a previous occasion. But then he said that the methods proposed by the noble and learned Lord, Lord Elwyn-Jones, or his noble friend opposite, did not form the right way to go about it. He said that a committee of this kind would be inflexible. But a non-statutory committee would equally be inflexible. We are talking about whether there should be in the Bill itself some formal requirement for advice-giving machinery, whether in the form as has been suggested in amendment or in some other way. I think that the noble Lord was less than fair in criticising the exact wording of the amendment on the grounds that it did not spell out everything in detail. I should have thought that that was a merit of the amendment, and that what we could have discussed this afternoon was the general principle of the matter. It remains to be seen whether there is any general agreement, since I suspect that perhaps the noble Lord, Lord Elton, does not carry with him the whole of the party opposite in the remarks that he has just made. I say that because, as I know, a great many of them have been influenced by the arguments not just in this Chamber. Let us be clear about that. We are not talking about solely what the Opposition parties think regarding an advisory committee, or even what the former members of the Lindop Committee think about the necessity of having such a provision written into the Bill. We are talking about the views of a very substantial body of expert opinion.

I thought that on the last occasion the noble Lord said that he was going to take further advice outside the House on what had been said, and that before we returned to the subject he was going to see whether there was any support for the concept of a statutory advisory committee. It would be interesting to know what advice he has received on that matter, and whether he has consulted, for instance, the British Computer Society, or the CBI, or the Trades Union Congress, in order to find out whether industry and the computer professionals themselves think that this would be a meritorious provision to have in the Bill.

As regards the areas of expertise, the pay and rations, and the other criticisms that the noble Lord made, we have not returned to a point that arose in a speech of the noble Lord, Lord Mishcon, on a previous occasion. It is the idea of an order-making power which, I should have thought, was a complete reply to all the criticisms that the noble Lord, Lord Elton, made of the wording of the amendment. Perhaps we have got wrong the number of members of the committee, or perhaps we have not defined precisely the areas of expertise that are to be required with changing technology; I entirely agree with the noble Lord that this may be so. Perhaps the brontosaurus perished because it could not be amended by statutory instrument. If that kind of machinery had been available in the pleistocene era, it might still be with US.

On the previous occasion the noble Lord said that even an order-making power did not go far enough because if at an early stage the Secretary of State exercised all the powers that were available to him under the Bill, and sought the advice of the committee for that purpose, and then there was a long interval during which the members were not required to proffer any opinions, it would be unsatisfactory to have to reconvene an advisory committee much later for some minor point. But that would apply equally to the non-statutory committee he talked about. I do not believe that the registrar and the Secretary of State are going to find that there are long intervals in which they are not required to obtain expert opinion. That is directly contrary to the point made a minute earlier by the noble Lord the Minister, that we are facing a rapidly changing technology on which advice is constantly required. The reply that we have heard is profoundly unsatisfactory. I think that we should now test the feeling of the Committee.

Lord Elwyn-Jones

Before we do so—I agree entirely with the noble Lord, Lord Avebury—I should like to canvass one or two matters of importance which perhaps have not emerged clearly. The Committee will remember that the Lindop Committee, conscious of the fact that a registrar—unsupported, of course, by a department—was a lonely eminence, went so far as to recommend the appointment of a data protection authority. That was at an early stage of the consideration of the subject by the Government, and it was rejected. The suggestion now of an advisory committee is, we submit, the minimum that should be provided by way of statutory provision for the registrar.

There is a precedent for such an apointment, in my submission, in the Misuse of Drugs Act, where an advisory council was set up and provision was made for it. Its membership was to be appointed by the Secretary of State. There were to be not less than 20 members of that particular advisory council, and they were to be selected from persons appearing to the Secretary of State to have wide and recent experience of social problems connected with the misuse of drugs. There was a list of the types of expertise that should be called for. From my experience of the functioning of that Act, the advisory council has proved of great value.

The rigidity that has appeared in the course of this debate is not in the provisions of Amendment No. 12 but in the attitude of the noble Lord the Minister. Subsection (3) provides that the membership of the advisory committee shall include the persons suggested. It does not exclude addition or co-option. There is no limitation and no finality. It is not a once-and-for-all affair. I hope, in view of the strength of argument that has been put forward, that we shall have less rigidity and more willingness to face up to the need to give reality to the set-up, which is supposed to be of great protection to the privacy of the subject. The thing becomes more of a shallow compliance with the convention rather than a serious attempt to give effect to it. In those circumstances, I invite the Committee to express—

Lord Elton

I think I have been invited to make one or two comments. The principal issue, in my mind, is this. The amendment was introduced as a specific amendment: a fairly closely drafted example of what noble Lords opposite wanted. They wanted a statutory committee of stated proportions which they might take leave to alter at a later stage but which was written on the face of the Bill as to its composition, and without specific powers. That seemed to me a fairly straightforward proposition. The noble Lord, Lord Avebury, whose name also appears on the amendment, suggested that we were addressing ourselves to the very much wider question of whether it was desirable that the Secretary of State and/or the registrar should take outside advice at all, and, if so, whether there should be a statutory requirement for him so to do.

The issue before your Lordships, as I see it, is not: should the Bill say that the Secretary of State and/or the registrar shall be required to take advice by certain means that they may later decide, or, indeed, that they should take up advice on the basis or from sources that the Secretary of State has published by statutory instrument? That is not the proposal before your Lordships. The proposal is an amendment which says that the Bill shall require there to be set up a specific committee of specific composition but without specific powers. I shall not spend longer trying to dissuade your Lordships from that proposition. I believe that the proper way to proceed is in a more flexible manner, and I believe that this is open to the Secretary of State under the Bill. I know that he has the power to set up such a body. I know that he has the power to see that money is available for such a body. All the potential is there. The only thing that is missing is the element of compulsion. The element of compulsion, as now put to your Lordships, is restrictive and not permissive. I think that your Lordships should reject it.

Lord Donaldson of Kingsbridge

I must make one point. The noble Lord has been here all this afternoon and has not seen the tape. On the tape he will see that a new brontosaurus has been discovered in Sussex with an absolutely different kind of claw from any previous brontosaurus, and therefore showing its power to evolve.

Lord Elton

It is the claws they are discovering. There are various things that one cannot do if one cannot leave the Chamber, and I rather welcome the prospect of a Division.

Lord Elwyn-Jones

Delighted as I am to leave the cricket field, where we began, for the ancient fields of the brontosaurus, I still believe that the Committee should express a view on this matter.

6.27 p.m.

On Question, Whether the said amendment (No. 12) shall be agreed to?

Their Lordships divided: Contents, 77; Not-Contents, 96.

DIVISION NO. 2
CONTENTS
Airedale, L. Kagan, L.
Ardwick, L. Kilmarnock, L.
Avebury, L. Kirkhill, L.
Aylestone, L. Llewelyn-Davies of Hastoe, B.
Bacon, B. Lloyd of Kilgerran, L.
Bernstein, L. Lockwood, B.
Birk, B. Lovell-Davis, L.
Bishopston, L. McIntosh of Haringey, L.
Blease, L. McNair, L.
Boston of Faversham, L. Mais, L.
Briginshaw, L. Masham of Ilton, B.
Brooks of Tremorfa, L. Milner of Leeds, L.
Bruce of Donington, L. Mishcon, L.
Cledwyn of Penrhos, L. Molloy, L.
Collison, L. Nathan, L.
Cudlipp, L. Nicol, B.
David, B. Oram, L.
Diamond, L. Peart, L.
Digby, L. Pitt of Hampstead, L.
Donaldson of Kingsbridge, L. Ponsonby of Shulbrede, L. [Teller.]
Donnet of Balgay, L.
Elwyn-Jones, L. Prys-Davies, L.
Elystan-Morgan, L. Rhodes, L.
Ewart-Biggs, B. Ross of Marnock, L.
Fisher of Rednal, B. [Teller] Seear, B.
Gallacher, L. Shackleton, L.
Galpern, L. Stamp, L.
George-Brown, L. Stewart of Alvechurch, B.
Glenamara, L. Stewart of Fulham, L.
Gormley, L. Strabolgi, L.
Hale, L. Taylor of Mansfield, L.
Hampton, L. Underhill, L.
Houghton of Sowerby, L. Wallace of Coslany, L.
Hughes, L. Whaddon, L.
Irving of Dartford, L. White, B.
Jacques, L. Wigoder, L.
Jeger, B. Winstanley, L.
Jenkins of Putney, L. Winterbottom, L.
John-Mackie, L. Wootton of Abinger, B.
NOT-CONTENTS
Ailsa, M. Cox, B.
Alexander of Tunis, E. Craigavon, V.
Allerton, L. Crathorne, L.
Auckland, L. Croft, L.
Avon, E. Daventry, V.
Bauer, L. Davidson, V.
Belstead, L. De La Warr, E.
Bessborough, E. Denham, L. [Teller.]
Birdwood, L. Eccles, V.
Bolton, L. Elton, L.
Brabazon of Tara, L. Faithfull, B.
Brougham and Vaux, L. Fortescue, E.
Caithness, E. Gainford, L.
Carnegy of Lour, B. Geoffrey-Lloyd, L.
Clifford of Chudleigh, L. Glanusk, L.
Cockfield, L. Glenarthur, L.
Colwyn, L. Gray of Contin, L.
Cork and Orrery, E. Gridley, L.
Grimston of Westbury, L. Pender, L.
Hailsham of Saint Marylebone, L. Quinton, L.
Rankeillour, L.
Henley, L. Rawlinson of Ewell, L.
Hornsby-Smith, B. Reay, L.
Hylton-Foster, B. Renton, L.
Ingrow, L. Renwick, L.
Kilmany, L. Rochdale, V.
Kimberley, E. Romney, E.
Kinloss, Ly. St. Davids, V.
Kinnoull, E. Savile, L.
Lane-Fox, B. Sharples, B.
Lauderdale, E. Skelmersdale, L.
Lindsey and Abingdon, E. Somers, L.
Long, V. Strathclyde, L.
Lucas of Chilworth, L. Sudeley, L.
Lyell, L. Swinfen, L.
Macleod of Borve, B. Swinton, E. [Teller.]
Mancroft, L. Teviot, L.
Mar, C. Tranmire, L.
Marley, L. Trefgarne, L.
Marshall of Leeds, L. Trenchard, V.
Merrivale, L. Trumpington, B.
Milverton, L. Ullswater, V.
Molson, L. Vaux of Harrowden, L.
Morris, L. Whitelaw, V.
Mottistone, L. Windlesham, L.
Mowbray and Stourton, L. Wise, L.
Napier and Ettrick, L. Wynford, L.
Newall, L. Young, B.
Nugent of Guildford, L.

Resolved in the negative, and amendment disagreed to accordingly.

[Amendment No. 13 not moved.]

6.36 p.m.

Lord Digby moved Amendment No. 14: After Clause 3, insert the following new clause:

("Codes of practice

—(1) The data protection principles shall be further modified or supplemented by Codes of Practice for data users (in this Act referred to as "Codes") for the purpose of regulating the detailed practices and procedures of data users.

(2) Any data user or person or body, representative of a class or classes of data user may make representations to the Committee that a Code or Codes should be made.

(3) The Committee shall consider any representation made under section 2 above and, after consultation with any persons or bodies who appear to them to be representative of the class or classes of data users concerned and with the Registrar, may make a draft Code or Codes regulating the detailed practices and procedures of the class or classes of data user specified therein.

(4) The Committee shall give public notice of any draft Code made by them inviting objections and representations thereto.

(5) The Committee shall consider any objections and representations made under section 4 above and shall report thereon to the Secretary of State with proposals for such modifications to the draft Code as they see fit.

(6) The Secretary of State shall if he sees fit, by order with or without modifications, make the Code; and references in this Act to the data protection principles shall where the context so admits include references to the Code in relation to the class or classes of data user specified therein.

(7) Proof that a data user has complied with a Code for the time being in force under this section in relation to the class of data user to which he belongs shall be conclusive proof for all purposes of this Act that he has complied with the data protection principles.").

The noble Lord said: Although this amendment is now defective because it refers to the "Data Protection Advisory Committee" which your Lordships have rejected, I move it as a probing amendment to obtain the Government's view so that I can consider what we should do at the Report stage.

The Government have accepted the value of voluntary codes of practice drawn up as general guides to users in particular areas. However, they do not support statutory approach as in the last amendment. The Lindop Report, on the other hand, proposed that codes should be statutory instruments with the force of law. In the last Session my noble friend Lord Elton argued that to give a code of practice any statutory application would be time-consuming and over-bureaucratic. I am not convinced of that, and the new clause was an attempt to try to overcome this problem. However, now that there is to be no committee I shall have to think of some other way in which to do it.

Subsection (7) of my clause is an excellent provision to help minimise bureaucratic procedure. It will be extremely helpful to the individual data user to have a practical method of ascertaining whether he has complied with the data protection principle. The whole point of codes of practice is that small users who come into a large group should have a code of practice to follow. The mechanism for drawing up the codes will ensure that there is a limit to the number of codes in operation and that those codes drawn up will have some force of legitimacy to back them and improve their efficiency. As I have said, this is a probing amendment but I should like to hear what the Government propose in this connection. I beg to move.

Lord Mishcon

The noble Lord, Lord Digby, has reached with this amendment a very important part of the Bill and it deserves some concentration before we adjourn for other purposes. When a committee is set up consisting of renowned people who concentrate their attention upon the problems of data protection for a very long period of time, it would be disappointing for them to find that some of their major, important recommendations were not accepted when legislation was brought forward upon the matter upon which they sat and upon which they were to guide. Of course nobody pretends that when a Government committee is set up, the Government have to accept all the committee's recommendations, but I think that the onus is upon the Government—and very much so—to say why it is that the recommendations have not been accepted. There cannot be the slightest doubt but that the Lindop Committee made a very strong and reasoned recommendation that codes of practice should be encouraged, should be created and should have statutory force.

I know that the noble Lord, Lord Digby, will forgive me, if, in speaking to his amendment, I say why it is that I prefer the amendment which is later to be considered by your Lordships' Committee, Amendment No. 28. It in no way derogates from my gratitude to him for having raised this subject in his own amendment and having done so in his own inimitable style. However, I think that one has to be careful about allying, as he did, the codes of practice to the setting up of an advisory committee because, as we have seen, if the advisory committee falls, then of course an amendment which deals with codes of practice as recommended by an advisory committee also falls.

I shall now speak to Amendment No. 28 in order to save a great deal of time later. Amendment No. 28 does not fall into that trap because in Amendment No. 28 it is the registrar to whom the codes of practice have to be submitted, and it will be for the registrar to decide whether or not they conform to the principles of the convention and whether, indeed, it is good thing for the specific type of date users so organized in their categories. Who have put up this code of practice for specific category. That is the first point.

The second matter about which one must be very careful over codes of practice is as follows. One must be very careful that one does not breach the convention. As the noble Lord the Minister so rightly said before—although he said it in an argument where we disagreed with him—it is all very well to have interpretations nationally, but what you cannot do is to have the power to derogate, as it seems to me, from the principles when you come to create a code of practice. The noble Lord, Lord Digby, will, I hope, forgive me if I look at subsection (1) of his Amendment No. 14, which states: The data protection principles shall be further modified or supplemented by Codes of Practice for data users". As I understand it, the word "modified" in fact means that you can alter one of the principles of the convention by a modification in your codes of practice. Again, if I may say so with great respect, that seems to be a reason for saying that possibly Amendment No. 14 is not the one that ought to be favoured by the Committee when it deals with codes of practice.

As an extension of that point, I turn to subsection (7) of the amendment. One finds that, even with such a modification: Proof that a data user has complied with a Code for the time being in force under this section in relation to the class of data user to which he belongs shall be conclusive proof for all purposes of this Act that he has complied with the data protection principles". Again, this means that, if you modify one of the principles by a code of practice, it will still be a complete answer by anyone who adheres to that code of practice; you cannot throw the principles at him if he has, in a modified way, dealt with the code of practice and complied with it.

Therefore, although the principle of setting up the code of practice is so right, one feels that there are some defects in the amendment which, in my respectful submission, ought to make the Committee look with rather more favour on Amendment No. 28. But the noble Lord was very frank with the Committee, as one would expect him to be. He said that this was really a probing amendment because he realised, for other reasons, that the amendment would have to be varied as it relies upon the advisory committee. So, in its great kindness and tolerance, I should like to ask the Committee to look now at Amendment No. 28. If noble Lords do so, it will save them having inflicted on them another speech from me.

The noble Lord, Lord Mottistone, is very courteously listening to me or endeavouring to intervene.

Lord Mottistone

Is the noble Lord going straight on to deal with Amendment No. 28?—because I thought that we were to deal with this amendment first before we eat. Are we to deal with Amendment No. 28 before we eat?

Lord Mishcon

As I understand the proper procedure, in order to give your Lordships a better appetite at seven o'clock, I shall make my speech on Amendment No. 28 and, after dinner, when we reach Amendment No. 28, I shall ask noble Lords to remember the speech I made. I propose then merely to rise very briefly and either ask the Minister whether he agrees with my speech or, if he does not agree with it, say that we shall test the opinion of the Committee.

Lord Mottistone

Does that mean that I shall be able to say a little about Amendment No. 14 before I eat, in order to get it out of the way?

Lord Mishcon

That seems to be an invitation to me to curtail my speech.

Lord Elton

If the noble Lord will forgive me, there is I think a fairly considerable difficulty here. The issues in the two codes of practice are different. I want to say a good deal about this code of practice and there is a good deal that I want to say about the other. I would not want all that to be divorced from the rest of the argument by a dinner break which, if we deal with both amendments now, is bound to start before we finish discussing both amendments. Therefore, I am just wondering whether we are wise to take the amendments together, and whether we could not treat this as a probing amendment, to which I could give a fairly swift reply. Then we could return to Amendment No. 28 at the appropriate time. It is up to the Committee and the noble Lord.

Lord Mishcon

I think that the interventions of the noble Lord, Lord Mottistone, and the Minister have been very useful and have been a guide to me. In those circumstances I think I am wrong to try to take all the speeches now in regard to Amendment No. 28 and this amendment. Therefore, having made the comments that I have on Amendment No. 14, I propose to sit down—I hope with some grace—but I would hate the noble Lord to think that I was not supporting the main principle of codes of practice and that they should be statutory. I shall return to the fray when Amendment No. 28 is reached.

Lord Digby

Before the noble Lord sits down, I should like to take up his point about subsection (7). I have no doubt that from a legal point of view he is probably right. I should like to make it quite clear that my object is that, when a code of practice is brought in, users will be able to rely on the fact that they follow that code of practice and, therefore, are immune in law.

Lord Mishcon

I am most grateful to the noble Lord. If he had not before in this amendment introduced the ability to "modify", I should have accepted that completely. It is the joinder of "modify" and subsection (7) which makes it rather difficult, for the reason that I have explained. I shall not detain noble Lords any longer. I am sure that noble Lords will much more enjoy the speech now to be made by the noble Lord, Lord Mottistone, than ever they have enjoyed a speech of mine.

Lord Mottistone

I thank the noble Lord; I shall not speak for long. If it will help my noble friend when he comes to revise his amendment, which he obviously realises he must, your Lordships may remember that I was in favour of codes of practice when we dealt with this point on the last occasion when we discussed the Bill. At the time, it was probably my noble friend the Minister who made me start to think about this. Broadly speaking, I think that centralised codes of practice set out on the lines of Amendment No. 14 probably have to be so broad that one could almost say that the Bill itself was a code of practice and that the Bill itself was telling people how to carry out the purposes of Schedule 1. Therefore, that is as far as we ought to go in having centralised codes of practice.

I think—and I believe that my noble friend the Minister also said this last time when we dealt with this point—that there is a great deal to be said for codes of practice on an individual company basis or, if you like, an individual data user basis, where they could well set up something for themselves. That might be a very good way of tackling the problem.

Then there is the problem of how this conforms with Schedule 1. That is where Amendment No. 28 comes in. I hope that there is a lot of support for that. I will not guarantee to vote for it. I may be put off totally by arguments from noble Lords opposite, as usual. It seems healthy to look at it as localised codes of practice rather than centralised ones. Therefore, for that reason, I do not support the principles of Amendment No. 14.

Lord Swinfen

The Committee will recall that at Second Reading I also supported the idea of codes of practice. However, I do not support this amendment because codes of practice should come from the industry itself, from below rather than from the registrar or the Ministry from above. As I said at Second Reading, the industry knows how computers are used and how the data will be used. It knows the loopholes in codes of practice, how they have been created and how to stop them far better than the Ministry does. I said then that it was a case of turning the poacher gamekeeper, and I am still of that opinion.

The British Computer Society already has a number of codes of practice, and other organisations and institutions that use personal data will build up their own codes of practice. Rather than having a code of practice that applied to a single company or a single user, I should prefer to have codes produced by institutions as part of the code of conduct of professional members. They are capable of producing codes to fit all the different requirements of their profession. Surely these can be approved by the registrar or the Ministry. I shall probably say some more on that on Amendment No. 28.

6.51 p.m.

Lord Elton

This is obviously the first leg of a two-part debate and we shall return to the issues on amendment No. 28, as the noble Lord, Lord Mishcon, has courteously said that he will use that as the occasion on which to deploy his arguments. I do not doubt that he now has a sneaking hope that I shall expend all my ammunition on this part of the debate and await his arrival at the top of the objective in the next debate open-mouthed and empty-handed. However, I think I shall be able to disappoint him because he is climbing the opposite side of the hill.

I remember that on the last Session's Bill in Committee we had two amendments proposing codes of practrice and they also adopted totally different and in some respects conflicting approaches, although noble Lords opposite, with their customary agility. Were able to support both. Perhaps that gives the game away about codes of practice. They have come to be regarded by some as "good things", regardless of their nature, with very little heed paid to the practical consequences which follow in their wake.

Before I deal with the practical consequences of the codes proposed by my noble friend. Lord Digby, I hope your Lordships will let me make one point crystal clear. We, as a Government, do not oppose codes of practice. We spelt out our position in the 1982 White Paper and we have stuck to it ever since. What we said was: The Government sees some value in codes of practice in this field and expects that some professional bodies, trade associations and other organisations may wish to prepare such codes as a guide to their members. But the Government does not consider that these codes should have the force of law". That continues to be our position. We have always foreseen that the registrar will be ready to play a part in advising representative bodies on codes of that kind—codes operating as general guidelines as to how users might best order their practices so as to minimise the risk of breaching the principles. The new duty on the registrar to promote observance of the principles clearly points him in that direction. What we are wholly against are codes of practice elevated to a position above the principles—codes that take over from the principles. That, I regret, is what the amendment proposes.

The key provisions of the proposed new clause are subsections (6) and (7). They relegate the data protection principles to a secondary role. Subsection (6) seeks to achieve the effect that if a user breaches a code then he may be treated as if he breached a principle. Subsection (7) provides that if a user complies with a code then he must be deemed also to have complied with the principles. In other words, it is the code that matters, not the principles. But, we should consider the consequence of that. Let us take the fifth principle, requiring accuracy. All a code could do would be to suggest ways of minimising the risk of inaccuracy—good practice as to the collection of information, its recording and regular checking, perhaps. A user might do all that, but still end up with inaccurate data. Do we really want the registrar's hands to be tied in those circumstances? Data subjects would scarcely take kindly to inaccurate data about them sitting on the computer and the registrar being unable to do anything about it because the user had complied to a code of practice. It would make nonsense of the whole scheme.

Let us take the fourth principle: that data should be adequate, relevant and not excessive. A code might indicate what those concepts might generally be taken to mean, for banks, say, for local authorities or for police forces. But it could only be a general indication. What if in a particular case it was glaringly obvious that although the code was met the data were held in a way not foreseen by the code and were inadequate, irrelevant or excessive, or all three. Again the registrar would be powerless, the data subject would be without redress. I could go on, but I will not. It is not only the registrar or the data subject who would suffer; the data user would too. He would face action on breach of a detailed code; and if a code applies to a class of user—whatever that wholly unidentified term means—it may be fine for 90 per cent. of that class, but wholly inappropriate for the other 10 per cent. Yet the minority would find itself obliged to comply with the codes on pain of penalty from the registrar. It would place data users in a rigid straitjacket that they would regret.

Codes of practice have their place. They can be of real value as general guidelines that individual users can follow, in whatever way is appropriate, to see the nature and scale of their operations; but once users have to comply with them codes of practice wholly change their character. Like a cuckoo in the nest, they totally take over from the principles which should rightfully be installed there and place intolerable burdens on the users who have to obey them every day.

We are therefore of the view that while codes of practice have a role, it is not a role that should be given statutory expression in the Bill. They are best left to be drawn up by users themselves—I am obliged to my noble friends Lord Mottistone and Lord Swinfen for their observations on this. They should be assisted, as appropriate, by the registrar. If users are then helped to observe the principles, well and good; but it must be the principles against which the registrar measures the exercise of his supervisory powers. He must determine observance of those principles in the light of the circumstances of the particular case, not by reference to an artificial, arbitrary and inevitably incomplete code of practice. I hope that my answer has not been too stark for a probing amendment, but it seemed to be of merit in making our position abundantly clear.

Lord McIntosh of Haringey

I welcome the terms in which the Minister has answered this probing amendment because I believe that on several occasions in his speech he has given support to Amendment No. 28. I know that we are not finally discussing Amendment No. 28 but it is in practice impossible not to look at the differences between the two in discussing the first of the two amendments. The first issue the Minister raised was that of practicality. I assume that we are talking here about saving unnecessary duplication of effort, unnecessary time and money on the part of the registrar, data users or groups of data users, or, as would have been in the amendment of the noble Lord, Lord Digby, the committee, now not to exist in that form.

I believe that the registrar's task will be absolutely impossible without some codes of practice. I realise that that does not answer the question which Lord Elton raises of whether the codes of practice should be statutory. If you look at the practicalities of a registrar by himself with a staff of only 20 people dealing with individual applications for registration and not having the help of groups of data users in codifying common elements in registration procedures and registration conditions, the registrar simply will not be able to cope.

Take a large organisation like ICI. With the numbers of data banks which ICI hold and the numbers of data processing operations in which it is involved, the numbers of applications which would have to be made on behalf of ICI alone for registration under the Act would take literally years—I do not mean just man years but work-group years—to codify, to get into some common form and into a form in which an application for registration can be made. It would then require many man years of work by the registrar's staff to look at those applications, and, if ICI were to be the first applicant for registration, it is possible that, with a staff of 20 people, you would land up with a second application being considered three or four years after the first application, because the staff of the registrar would not be capable of handling further applications within the time period. I can see that some noble Lords think I am exaggerating. They should talk to some of the large business organisations and see how complex are their data processing facilities. On pure grounds of practicality, there has to he something and it has to be widespread—and we will argue later as to whether it should be statutory.

The next point the Minister made was that such a code of practice should not be above the law. He was objecting to the last subsection of Amendment No. 14—and, I think, rightly. I would point out that the amendment does not make the code of practice above the law; it introduces the evidentiary criteria from the Police and Criminal Evidence Bill. The final point I would make is that the code of practice must be in conformity with the principles. That is provided by Clause 28. I welcome the fact that the Minister has not said a single word against the clause which will be discussed later this evening.

Lord Elton

We were not discussing it; but I shall have plenty to say later.

Lord Digby

With both Front Benches against me, I shall certainly read the Hansardreport of this debate with great care. I think it has been interesting, and it has helped me. I should like to say that I had assumed that the code of practice would not be approved, whether by the Secretary of State, the registrar or the Committee, unless it conformed to all the principles. That was the basis of my argument—which, doubtless, was expressed wrongly. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

7.4 p.m.

Schedule 2 [The Data Protection Registrar and the Data Protection Tribunal]:

Lord Mishcon moved Amendment No. 15: Page 33, line 19, leave out ("Except as provided in section 17(2) of this Act.")

The noble Lord said: I think I can deal with this amendment very quickly. To a large extent it is a probing amendment, although I suppose that if the probe reveals the weakness that I suspect there is one would want to take it further on another occasion. We were delighted to find that the registrar was completely independent. He was not subject to the administration or the supervision or whatever of the Secretary of State, but functioned as an independent person. One finds that it is clearly stated in the Bill, on page 33, paragraph 1(2): Except as provided in section 17(2) of this Act, the Registrar and his officers and servants shall not be regarded as servants or agents of the Crown".

You then say to yourself, that that is all very well, but how much of this independence is taken away from him by "section 17(2) of this Act"? So you turn to Clause 17(2), and you there find in that provision that for the purposes of Section 2 of the Official Secrets Act (wrongful communication of information) the registrar and his officers and servants, shall be deemed to hold office under Her Majesty". What worries me and, I believe, other Members of the Committee is that there will be many things which, one would have thought would, in the course of his duties bring him up against the Official Secrets Act, if he is subject to that Act.

One has only to talk about the question of his coming into security matters, of his coming into confidential matters on immigration, of his being given confidential information by the Home Office in regard to matters of that kind and matters that also affect the police. For my part, I do not know where we get to if you impose the Official Secrets Act upon the registrar and his servants although in another part of the Bill it specifically says that, to keep his independence completely clear, he is not to be an officer of the Crown.

If the noble Lord the Minister can help us on that, I think that we shall know then whether, as a result of our probe, we can be perfectly happy or whether, at another stage of the Bill, we ought to be looking very much more closely at this provision. I beg to move.

Lord Elton

Clause 17(2), to which the offending words are a cross-reference, deems the registrar, his officers and servants to hold office under Her Majesty for the purpose—and only for the purpose—of Section 2 of the Official Secrets Act. That is a purely technical device for ensuring that the registrar's office are properly constrained so far as the unauthorised communication of information is concerned, and it sits alongside the provisions of Clause 17(3), which provide a further check on the disclosure of information other than in the course of their duties under the Bill. Nothing in Clause 17(2) undermines the independence of government of the registrar and his staff—which may be part of the noble Lord's concern—which we have been careful to ensure in the Bill. Clause 17 is a straightforward provision to ensure that the registrar, having obtained the information he needs to perform his duties, thereafter uses it responsibly.

If he were not to be subject to the Official Secrets Act, we could scarcely expect holders of information to which that Act did apply to reveal that information to him. It would be a curious result if a measure to defend personal privacy were to run any risk at all of privacy being betrayed by misconduct in the registrar's office. The chances arc remote, but it seemed right to make doubly sure that this could not occur. I hope the noble Lord will accept that there is nothing sinister in Clause 17(2); and, if Clause 17 is unobjectionable, it follows that there can be no reason to object, either, to the purely technical cross-reference in Schedule 2, which is there purely for the avoidance of doubt and to show that there is no conflict between the two provisions. I hope that this will reassure the noble Lord.

Lord Mishcon

I am anxious not to detain the Committee, and the noble Lord has been very courteous. But I feel that a little more of an explanation is due to the Committee as to what precisely would be covered by the Official Secrets Act. If, in an immigration case, as I have said, where the registrar is inquiring as to whether or not there has been an improper use of powers by the Home Secretary, and whether the data subject ought to be given certain information, the Secretary of State tells him that this is subject to the Official Secrets Act or labels a document "confidential", does it mean that the registrar cannot then divulge this to the data subject or to the data subject's advisers?

If the noble Lord feels that I am asking something of which he did not have full notice—and I can well understand that—and if he feels that it is a matter, because it is so important, on which he should write to me, I shall be content if that is his reply. But if he did that, I should like to have a full and comprehensive reply to the anxieties that I have expressed.

Lord Elton

I think that the loophole which the noble Lord has generously given to me is one through which I ought speedily to progress. I shall at the same time investigate the interesting prospect of all ministerial lapses being covered by the Official Secrets Act, which would make life a lot easier for all of us. I do not really think it is on, but I will not detain your Lordships at this stage. I will write to the noble Lord about what is a fairly complicated matter.

Lord Mottistone

May I have a copy, too?

Lord Elton

Yes; but if the list gets much longer I will have copies put in the Library. For the time being I will write to all the Front-Benchers concerned and all those who have raised their voices.

Lord Mishcon

I am most grateful to the noble Lord, and in those circumstances, as an expression of my gratitude, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Schedule 2 agreed to.

The Earl of Swinton

I think this might be a convenient stage at which to adjourn the Committee for dinner. I suggest to your Lordships that if the Criminal Attempts and Conspiracy (Northern Ireland) Order takes less than one hour and 20 minutes, we perhaps should not resume the Committee stage of this Bill before 8.30. I beg to move that the House do now resume.

Moved accordingly, and, on Question, Motion agreed to.

House resumed.