Data Protection Bill [H.L.]

HL Deb 19 July 1983 vol 443 cc1108-47

House again in Committee.

Clause 4 [Registration of data users and computer bureaux]:

Lord Elystan-Morgan moved Amendment No. 16: Page 4, line 5, leave out ("users who hold") and insert ("banks which contain").

The noble Lord said: With the Committee's permission, I wish to deal also with Amendments Nos. 17, 18 and 23. The purpose of these four amendments is to seek to correct a fundamental flaw in the Bill as it now exists, and that is to substitute the words "data bank" for "data user" where those words occur in the first three instances, and in respect of Amendment 23 to define "data bank" as meaning any collection of personal data that is automatically processed.

The Bill as it is now drafted allows a data user to operate a large number of different data banks but nevertheless requires him to make only one registration as a single user. He could do this by using a general description of a purpose, or amalgamated purposes, which would allow different data banks to be merged without infringing, it seems, the registration provision. This factor is of considerable relevance when one considers a multiple user such as the Home Office, which operates at least a dozen different data banks, including the national police computer, the various immigration control data systems, the prison parole indexer and so on. The argument in respect of this matter has already been very cogently put by many noble Lords, in particular by Lord McIntosh of Haringey at Second Reading, when he described how he in his office, by using the various requisite code words, would be able to plug into between 300 and 350 different systems.

The fundamental weakness of this Bill as we on this side of the Committee see it is that it aims its strictures at data users rather than data banks which are effectively the repository of the masses of private information which the convention sought so clearly to deal with. It is therefore on that basis that I commend these four amendments to the Committee, and formally, in respect of Amendment No. 16, I beg to move.

Lord Elton

First may I say how nice it is to see the noble Lord, Lord Elystan-Morgan, back from the fastnesses of Wales. Secondly, I must congratulate him on a brevity which I cannot altogether match but which I will seek to match. The effect of the amendments he has proposed would be to convert the register from what is predominantly a list of data users who hold personal data, to a list of what are here termed data banks. I must first comment that having set themselves that task the authors of the amendment promptly. and I think understandably, give it up. Some of the problems implicit in the conversion in the clause surface, yet even they are ignored; so we are presented with data banks instead of data users when the data users are just that and nothing else, but we still have data users where they are data users who also carry on computer bureaux. So we have a sort of hybridity here and the register is to contain a list of data banks, but the first participation to be shown must be the name and address of the data user.

Lord Mottistone

Will the noble Lord forgive me for intervening? Clearly a data bank cannot communicate with the registrar. It must be either a data user or a computer bureau. The reason for choosing data banks—you could choose the word "databases" if you prefer—is exactly the problem which the computer people would call interface. There is no difference of substance.

Lord Elton

I am not sure that there is not. I agree that it is the question of communication which matters, and therefore presumably the communicator ought to be registered, because it is to the communicator that the data subject must address himself if he wants to know what is in the data bank. I do not want to pursue this point too far, because it is not the substance of our difficulty. I was merely pointing out that at present the amendment is not drafted in a workable way.

I do not understand the benefit that the changes are intended to bring. In any register some identifiable person, legal or natural, must be listed; otherwise it will fulfil no useful purpose. The Bill achieves that by placing the obligation of registering on data users who have to specify the data they hold and the uses to which they put it. Thereafter the registrar can look to those data users to discharge the responsibilities that the Bill introduces. If, as the noble Lord suggests, it is the data banks which are to be registered, then there must be registration of the person controlling the data banks, and the amendments have not offered us that. If they did, we should, in all probability, find ourselves face to face with no more than a paraphrase of what we have already called "data users".

The noble Lord appears to be concerned that the registration process will suffer from having data users rather than the data they use being registered, but one way or another both are in fact already registered. Under the scheme of the Bill what happens is that data users register, if you like, their data banks. What the noble Lord seems to have in mind is that the data banks are registered, presumably by the controllers; that is, by the data users. I am not sure whether I am going round in circles but I do not see the distinction; certainly not one which would warrant the wholesale revision of so much of the Bill as would be required. If a person comes to the register and looks at the Home Office registration, for instance, he will find that each of the purposes for which the data are held is registered, and that will reveal to him the existence of the immigration and nationality department computer, the police national computer and so on.

I think the noble Lord's anxiety was that there might just he a single line entry which, holus-bolus, would reveal nothing to him; but if he looks at the requirements of the registration I think he will be reassured, because the requirement is that the different purposes (and indeed this is implicit in the principles in the schedule) have to be individually revealed.

Lord Mottistone

I wonder whether noble Lords have looked at Clause 6(2), which I believe covers their particular point? I may be wrong.

Lord McIntosh of Haringey

Unfortunately it does not do so as at present drafted. It states: Where a person intends to hold personal data for two or more purposes he may make separate applications", and it will be the subject of a future amendment to say that he "shall" make separate applications; it makes a great deal of difference. Until that amendment has been agreed to, the subsection to which the noble Lord, Lord Mottistone, has referred does not help us very much.

In the meantime, I should like to support my noble friend in saying that the unit of measurement should be the data bank and not the data user. As the noble Lord the Minister has said, there are certain safeguards in other parts of the Bill—such as the provision that the purposes for which a data bank is held should be declared and registered. But the fact that it is registered in that way does not protect the data subject, because the data subject does not necessarily know, and cannot be expected to know, how to search for the different data banks of a data user in order to find out whether his or her interests are likely to be affected by it.

Therefore, the principle that the unit of measurement should be the data bank—something that is recognisable by the outside world—rather than the data user (the person who holds one or, in most cases, more data banks) is absolutely essential. If we depart from that, we shall detract from the rights of the data subject. It is for that reason that I support the amendment of my noble friend Lord Elystan-Morgan.

Lord Avebury

I support the principle of this amendment but I wonder whether the probblem we face is not the drafting of subsection (3) of the clause. As I understand the Minister, the Home Office, for example, as a data user, would define separately the purposes for which each of the data banks in the Home Office is intended. In each case, there would be a separate description of the personal data to be held on each of those data bases; a separate description of the person or persons to whom it is intended to disclose the data held therein; addresses for the receipt of requests from data subjects for access to the data, and so on.

So the purpose which the noble Lord, Lord Elystan-Morgan has in mind, is, according to the noble Lord the Minister, already achieved in subsection (3). But that is not absolutely clear on the face of it. If the noble Lord, Lord Elton, will undertake to look at the wording of subsection (3) so that we do not have to depend on assurances given across the Floor of this Committee that, for instance, the Home Office will make perfectly clear the distinctions between the various data bases which it holds and the information contained within each of them, but can have that written on the face of the Bill, then certainly the noble Lord, Lord Elystan-Morgan, could take that assurance. I am sure that the people whose particulars may be included on the Home Office computers would appreciate that assurance, too.

Lord Elton

Your Lordships may recall that under the principles at the heart of this Bill, it is only legal to hold data (and we have described holding in the definitions clause) for one or more specified and legitimate purposes. If your Lordships will look at Clause 7(2), and the powers which the registrar has to refuse applications which do not reveal as much as is required by the Bill, your Lordships will appreciate that the two taken together will provide the reassurance which the noble Lord, Lord Elystan-Morgan, seeks.

I am perfectly prepared to write to the noble Lords. Lord Elystan-Morgan and Lord Avebury—and to the noble Lord, Lord McIntosh of Haringey, for good measure, since he has a direct interest in this matter—in elaboration of that; and if I have got it wrong they will put down an amendment at Report stage. I cannot put my finger on the point more precisely than that. but the two subsections taken together do mean that the data protection registrar has a duty to see that the data subject has a reasonable means of finding the personal data relating to him; and that the registrar has the power, in Clause 7, to refuse entries which do not reveal sufficient information to make this possible—and that therefore it is his job to see that the innocent inquirer can look at the register and find out where to make his inquiries about particular processes relating to his interests.

Lord Elystan-Morgan

I am extremely grateful to the noble Lord the Minister for his words of welcome. I am equally grateful to my noble friend Lord McIntosh of Haringey and to the noble Lord, Lord Avebury, for their support in varying degrees for this amendment. I suspect, however, that the situation is one that is far more fundamental than the noble Lord the Minister would have us believe. Although I welcome his assurance in relation to reading Clause 7(2) of the Bill together with the principles set out in Schedule 1, there are matters which remain unresolved.

First, by substituting "banks" for "users", a far more direct and obvious path is given to the data subject in the pursuit of his ends. Secondly, so far as the assurance given by the noble Lord the Minister is concerned, it is the case that such an assurance—even if the noble Lord is wholly correct in what he says—is greatly eroded by the provisions of Clause 28 of the Bill as at present drafted. Nevertheless, we will look with great interest at the words of the noble Lord the Minister. who has kindly agreed to communicate his views to us, and we reserve the right to take this matter up at a later relevant stage if necessary. On that basis, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendments Nos. 17 and 18 not moved.]

8.48 p.m.

Lord Mottistone moved Amendment No. 19: Page 4, line 14, leave out from first ("user") to ("shall") in line 15.

The noble Lord said: This particular issue, on which I have been advised by the British Bankers Association, relates entirely to clarity with relation to the position of computer bureaux in respect of data users of other kinds. I am sure your Lordships will be aware that many data users have sufficient capacity to be computer bureaux as well. It is important for them that the various requirements of Clause 4 should not make too much doubt arise, not only for their own purposes but also for those of their own potential clients.

As presently drafted—and in particular subsection (3)—the clause states, under paragraph (a)of that subsection, that the data user must give his name and address; and under paragraph (b) that he must provide a description of the personal data to be held by him. It then goes on to make mention of "the data". It could be construed that under Clause 4(3)(c), (d) and (e) it might be possible that a bureau might have to disclose information belonging to and in some cases only available to, the client of the bureau, which is clearly not the intention.

With this amendment I had time to write to my noble friend, and not only did he tell me that he knew all about this because it had been raised before but he gave me an answer which I personally find difficult to accept. It refers to: a description of the personal data to be held by him"— this is subsection (3)(b)— and of the purpose or purposes for which the data are to be held"; and it goes on to refer, in paragraphs (c), (d) and (e), to "the data". My noble friend tells me that "the data" is naturally consequential on "personal data held by him".

I do not read the English language that way. If it went on to say "that data" in paragraph (b)—"and of the purpose or purposes for which the data" were to be held—I would accept it. Rather more marginally, going on to paragraphs (c), (d) and (e), which are the really important parts of this argument, if it went on to say "may wish to obtain that data" or "the information to be contained in that data" then if you thought that (c) related back to the beginning of (b) the, word maybe, if you read it very fast with the word "that" throughout instead of the word "the", it would work. But I do not see that it is necessarily English or logical to say that the words "the personal data to be held by him" in paragraph (b) govern, as it were all the phrases "the data" in the subsequent paragraphs.

Therefore, I suggest to your Lordships that it is greatly simplified if you take my Amendment No. 19, with which I would bracket Amendments Nos. 21 and 22, as a solution to the problem. It clarifies the picture completely as to the computer bureau and "a data user who also carries on a computer bureau". I would have thought, therefore. that, though we might have this semantic argument about how the English language flows between paragraphs, it would be much simpler if my noble friend, if he cannot immediately accept my amendments, would undertake to look at it again to see if he cannot take the sense of my amendments in order to clarify the position.

The important thing is that we want British business to prosper in the world. If people who have more computer capacity than they need themselves can operate as computer bureaux, they not only need to convince their own fellow countrymen but potential customers overseas as well. I therefore beg to move Amendment No. 19.

Lord Elton

I hope I have followed my noble friend's argument sufficiently to answer it. A fact of life in the computer world is that many data users who own or lease computers have considerable spare capacity; and many of them find it an economic use of that spare capacity to hire it out, as it were, to other users who may not possess their own computer. In this way the original user is acting as a computer bureau. This is sufficiently usual for us to feel that we should avoid users in that position having to make a separate registration to cover their bureau role. Under Clause 4(2) a joint user/bureau—that is, one person doing two things—can merely indicate that he does both, and then under Clause4(3) can provide particulars in respect of the data that he holds as a user.

What my noble friend Lord Mottistone fears, I think, is that Clause 4(3) may be taken to require the joint user/bureau to provide particulars not only in respect of the data that he holds as a user but also in respect of the data that he may process on behalf of other users as a bureau; and, of course, if that were the case the Bill would indeed need amendment, for a bureau can never predict what data its customers will want to have processed. But that is not the case.

If I may, I would direct your Lordships' careful attention to paragraph (b) of Clause 4(3). It requires a joint user/bureau to provide, a description of the personal data to be held by him and of the purpose or purposes for which the data are to be held or used". I do not think it is absolutely clear that "the data" is a reference back to "the personal data to be held by him". The use of the definite article achieves that aim. And where the words "the data" similarly appear in the subsequent paragraphs (c), (d), (e) and (f), they also refer back to "the personal data to be held by him".

At this point we must remind ourselves of the special meaning given to "hold" in Clause 1. Only data users "hold" personal data, and when they do so they control the contents and use of the data. In other words, computer bureaux do not "hold" data. So when, under Clause 4(3), a joint user/bureau is required to provide particulars of personal data "held" by him, it can only possibly be in respect of the personal data he holds as a user; there is no requirement on him to describe the data he will process on behalf of others as a bureau. Indeed, the only requirement on him as a bureau is under Clause 4(2), to indicate that as well as being a user he is also a bureau.

I hope that explanation has not sounded too detailed and technical, and I hope it disposes of my noble friend's concern. I will certainly read with great care what he said. If I was enamoured of what he proposed, I would in fact say not "that" data but "those" data. I take a certain pride in having at last discovered that "data" is a plural.

Lord Mottistone

I stand corrected. I stopped learning Latin at the age of 13, when I went into the Navy, which was much more fun. I accept my noble friend's difficulty in sorting out the answer to this, and I am most grateful to him for undertaking to look at what has been said. What has never become clear to me is why my group of three amendments would not be acceptable as a good alternative to clarify the situation if there is any doubt, and I believe there still to be some doubt. I think my noble friend has been generous enough to suggest that maybe after looking at this he might feel the same way. I hope that his look might bring him around to finding a solution on the lines of mine, which he might care to put down himself. In the meantime, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Lord Avebury moved Amendment No. 20:

Page 4, line 24, at end insert— ("and in particular, a statement of whether, and if so in what circumstances, he may wish to disclose personal data when requested to do so for each of the purposes mentioned in section 28(1) of this Act;").

The noble Lord said: This amendment would enable the data subject to ascertain whether information which he gives to a particular data user, or which is given to the data user by a third party about him, is liable to be disclosed under the provisions of Clause 28(2). Information may be recorded on a data subject by a very wide range of data users. I do not need to go into this in detail, but it includes, for example, housing authorities, health authorities, banks, insurance companies, building societies, mail order companies, credit bureaux and employers. The Bill envisages that a police officer, an inspector of taxes or an immigration officer can go along to any of these data users and ask for information about a particular data subject, where he is suspected of a crime, trying to avoid taxes, or being in some way concerned with a matter of immigration control. Naturally, the data subject would like to know what is the policy of the user in this matter: is he going to release information to any of these officials on being given simply a verbal assurance that it is required for any purpose mentioned in Clause 28(1).

The amendment requires the data user to address himself to these questions from the start, during the process of registration, and make it plain to the data subjects what his intentions are when the Bill comes into operation. Will the data user give data about one to a police officer, to an inspector of taxes or to an immigration officer? One might not have committed an offence or even be suspected of committing an offence, but one might be concerned in some way with these matters, and the disclosure in question has only to be made on the broader ground that failure to disclose might prejudice any of those matters.

In what way is the user to be satisfied that failure to disclose would prejudice these matters if it is not to be a purely verbal assurance from one of the officials? Would he, for example, ask for a written statement asserting that prejudice might occur in the absence of disclosure? Or is the data user expected to delve into the merits of the disclosure and into the alleged criminal offence, the alleged avoidance of tax or breach of immigration control in question and the relevance of the particular personal data which is being sought to the matter in question?

We know that inspectors of taxes will only disclose information about a taxpayer to the police if they are satisfied that it is required for the apprehension of a suspect in a case of murder or treason. That practice goes back a very long way, to the 19th century. One of the points that was strongly made against further extension of disclosure when the question came before the Royal Commission on standards of conduct in public life—the report of which was issued in July 1971—was that inspectors of taxes are not qualified to say whether suspicions are well-founded and that the onus should not be laid on them to make difficult judgments of that sort. The argument applies with even greater force to other officials who may be asked to reveal data held by them.

The Royal Commission therefore concluded that information in the possession of the inspectors of taxes should be disclosed, other than in the circumstances I have mentioned, only on an application by the Director of Public Prosecutions to a judge of the High Court on proof of reasonable grounds for suspecting a corrupt act—that was what we were looking at in that case. The police would then have the power to inspect the records of the inspector of taxes. Therefore the inspector is not put into the position of making an assessment on the merits of the disclosure, because that is done by the court. We shall later be dealing with the Police and Criminal Evidence Bill which, I understand, makes provision for some disclosures in those circumstances.

What we are saying in the Data Protection Bill is that a vast range of officials in the kind of organisations I have mentioned are to be approached by officials. They will be asked to disclose confidential personal data on the grounds that are mentioned in Clause 28(1). There is no guidance whatever in the Bill on whether, and if so in what circumstances, they should disclose. Mention was made on an amendment a few moments ago of the provisions of Clause 7(2) under which the registrar may decline to accept an application for registration if he thinks the particulars that have been proferred are not sufficient. It will be interesting to learn whether the Minister thinks that without this amendment a data user would nonetheless be obliged to give the information which I am seeking to write into the Bill. But if that is not clear it is essential that we start with clarity in this matter and that all those concerned with the registration process should know where they stand, and that data subjects who give information about themselves and who may have information given by third parties to data users should know whether it is to be used for any of those purposes. I beg to move.

9.6 p.m.

Lord Elton

I wonder whether we may start by trying to put ourselves into the shoes of applicants facing the registration form. Under Clause 4(3)(d) there will be a section asking users to describe the persons to whom they intend or may wish to disclose the personal data that they hold. Some, of course, will list the police or the Inland Revenue, because regular such disclosures are made and will have to be shown. But many users will not at this time envisage disclosing data to such bodies. So they will make no mention of them. Under the amendment, there would then be a further question on the form: "Will you wish to disclose data for any of the Clause 28(1) purposes-crime prevention and the rest—and if so, in what circumstances?

Now the only sensible answer to that question that most applicants could give would be: "I really have no way of knowing until the police, or whoever, come along and ask me". (And that, of course, is why Clause 28(2) is so vital to the Bill—but we must not stray ahead to discussions ahead of us.) Most users will not be able to predict whether they would agree to a police request to provide information until they know the basis on which the request is made, the identity of the subject of the request, the kind of information being sought, and so on. I suggest that it would not only be unreasonable but unprofitable for users to be asked to provide such particulars, because if forced to respond, most users will be able to do so only in a wholly uninformative way: "Yes, I may wish to disclose in circumstances where I judge that any obligations of confidence are overriden by the public interest in disclosure." That, of course, is already inherent in the scheme and recognised by Clause 28(2).

But let us assume for a moment that an applicant for registration is a man of strong views who does not believe in coming forward to help the police in any circumstances. Let us assume that, when confronted with this secton in the application form, he replies: "No, I shall not wish to disclose for any of the purposes in Clause 28(1), in any circumstances." But then, a year later, there is a particularly nasty crime in the vicinity or his child is kidnapped or (for there is no need to be melodramatic) perhaps his own premises are burgled. The police come along and say that some information about an employee—his address, perhaps, or whether he was off work on a particular day—might be helpful in resolving who committed the crime. The data user might well find that his original assertion was very wide of the mark, and he would be fairly close to a breach of a public undertaking if he satisfied his own urgent desire to assist the police in their inquiries. I offer these examples not only to indicate now unrealistic the particulars proposed by the amendment would be but also to highlight how little benefit it would bring.

The data user in the second category I described, who changed his mind after his initial negative response, would under the amendment not be prevented from disclosing to the police, notwithstanding his register entry. For the noble Lord's amendment does not make disclosures that are in conflict with the proposed new register entry an offence. If I may say so, that suggests that the noble Lord himself may have some idea of how difficult it would be to tie a user down to absolute compliance with the response he has made.

I suspect that part of the noble Lord's mind in moving this amendment was on finding a way of initiating a debate about the non-disclosure exemptions in Clause 28(2). But I put that to him, as it were, before I heard what he had to say. He has restrained himself, and so have I. But of course the two do impinge one upon the other. One can dream up examples all day and all night about this sort of thing, but I wonder whether the noble Lord when he goes to the dentist wishes to be assured that the dentist will never make his dental records available. Suppose that the noble Lord were to be lost over the "Bermuda Triangle"—I am sorry that the noble Lord, Lord Winstanley, is not here; I should much rather have washed his corpse up on the beach!—suppose that the only means of identity is the dental record. Would the noble Lord not wish to have the possibility of his demise ruled out by a simple reference to the dentist's record?

If the noble Lord would not, and yet wants this amendment, presumably everybody under God's heaven who has any data equipment and bank will have to register the police, and any other enforcement agency of what he regards as proper law and order, as recipients of his confidences in this matter. A number of public bodies composed of people with high ethical standards already accept that even the confidentiality normally enjoined on their profession must in certain circumstances by overridden, and therefore they also would have to register themselves. I just wonder whether in fact the amendment would achieve the ends the noble Lord wishes.

Lord McIntosh of Haringey

I shall not bandy examples with the Minister. Obviously we could all find examples to prove our own case. All I would say in support of the noble Lord, Lord Avebury, is that there will be examples where the rights of the data subject will be diminished unless there is some pressure on the data user to declare in advance what kind of use he intends for the data. As the Minister says, this is properly a debate which should take place on Clause 28, so I shall not pursue it. But I want to make it clear that at that time I shall wish to support the noble Lord, Lord Avebury, in making sure that any deficiency in Clause 28, as it emerges from this Committee, is corrected as far as possible by protection for the data subject by making the data user make up his mind and say as far as possible in public what intentions he has with regard to the data.

Lord Avebury

I shall not press this matter. Having heard what the Minister has to say, I shall want to return to the subject in greater detail at Report stage, when I hope that more of your Lordships will be here to take part in the discussion. I would only say at this point that the Minister's supposed difficulties about absolute compliance with an amendment of the kind that I propose are completely exploded by the example that I gave of the Inland Revenue. It has had no difficulty over 150 years in complying with a self-imposed code of non-disclosure which is of a very absolute nature, for the reasons that I gave. In order to persuade taxpayers that it is in their interests to be completely frank with inspectors, it has to guarantee that the information which is given will not be used for any purpose other than the collection and assessment of taxes. This rule has been operated with scrupulous fairness over a very long period of time. There is no reason to suppose that any other data users would have a greater difficulty than the inspectors of taxes do. The difficulties which the Minister supposes would arise from this kind of amendment simply do not exist.

Before I sit down I would just say a few words on the question of the kind of judgment which a user has to make when he is presented with circumstances that he did not envisage at the time of registration—an employer, for instance, who has a burglary on his premises. Although he started in good faith by saying that he would not give any information about employees to the police, he finds that a particular employee is suspected and was absent from the premises on the day in question, and the police ask him whether he will therefore give some information about that person which may be relevant to the detection of the crime. Is this not simple? An employer in making his registration does declare, if that is his intention, that he will give information to the police where he is satisfied that prima facieevidence exists of a person having committed a serious crime. When he does that, he has to take into account the fact that he will be asked, when the time comes, to make his own judgment of the merits of the police case against that individual.

The employer may completely wrongly suspect the employee of having been involved in a burglary. Nonetheless he will accept that the police have something against the employee, and he will release confidential information on that basis. If that is the way that an employer wishes to use the data under his control, he should be obliged to say so in advance, and I think that the Minister's example reinforced my case. Certainly we shall return to this question at much greater length at the Report stage. I do not wish to delay your Lordships' Committee now, and, with that, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendments Nos. 21 to 23 not moved.]

Clause 4 agreed to.

Clause 5 [Prohibition of unregistered holding etc. of personal data].

9.15 p.m.

Lord Mottistone moved Amendment No. 24: Page 5, line 26, leave out from ("who") to the end.

The noble Lord said: With Amendment No. 24 I should like to take Amendment No. 25. These amendments effectively change the wording of Clause 5(5). so as to read: Any person who knowingly or recklessly contravenes any of the provisions of this section shall be guilty of an offence". As the Bill is at present worded, the holding of unregistered data is a strict offence. It says so in subsection (1) of the clause. But there can be circumstances where a user, or a bureau, might possess personal data while unregistered but does not do so knowingly or recklessly. For example, the user or bureau might be unaware that personal data were included among predominantly non-personal data. Therefore it is suggested that it would be fairer if the same liability applied throughout Clause 5. I beg to move.

Lord Elton

My noble friend has said that the amendments before us are designed to avoid inappropriate criminal liability being imposed under Clause 5(5). I hope to be able to persuade him that he really has nothing to fear, since the Bill is carefully drafted to achieve the effect that both he and I wish. Clause 5(5) makes it an offence to contravene Clause 5(1), or knowingly or recklessly to contravene the other provisions of the clause. Clause 5(1) provides that a person shall not hold personal data unless registered as a data user. This therefore is a matter of strict liability. But my noble friend has suggested that a person might do this unwittingly—for instance, where personal data were intermingled with a mass of non-personal data. Thus, he argued, we should amend Clause 5(5) so that to contravene Clause 5(1) is an offence only if it is done knowingly or recklessly.

In fact if one looks at the definition in Clause 1 of data user and holding personal data, it is very difficult to conceive of any situation where a person could "hold" personal data unwittingly. A person holds personal data if the data are processed or intended to be processed by reference to the data subject, and the person controls the contents and use of the data. Thus, to take the example of personal data intermingled with non-personal data, the personal data will be held only if they are processed, or intended to be processed, by reference to the data subject. If that is the case, the data user will be aware that he holds the data concerned. If he is not aware, he does not have the intention.

I would therefore suggest that the Bill already achieves the right result here by virtue of the definitions in Clause 1, and that it would be an undesirable duplication to add the concepts of knowledge or recklessness to the offence provision in respect of Clause 5(1). But, that said, if convincing examples of inappropriate criminal liability are put forward, we will of course look at the issue again. I simply do not think that they have as yet been found.

Lord Mottistone

I am grateful to my noble friend for that reply. It seems to me at first sight as though he has an answer to my problem, but I shall examine carefully what he said and consult my advisers, and I may come back with this point at the next stage of the Bill. For the moment, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 25 not moved.]

Clause 5 agreed to.

Clause 6 [Application for registration and for amendment of registered particulars]:

Lord Elystan-Morgan moved Amendment No. 26: Page 5, line 36, leave out ("may") and insert ("shall").

The noble Lord said: This matter has already been touched upon in the context of Amendments Nos. 16, 17 and 18. We are once again back to the question of whether the whole direction of the Bill with regard to registration should not be towards data banks rather than data users. I shall not go over that ground—it has already been well harrowed—but there are two points that I seek to raise in the context of this amendment, which is really a probing amendment.

First, is there any reason whatever why Clause 6(2) of the Bill should read: Where a person intends to hold personal data for two or more purposes he may make separate applications for registration in respect of any of those purposes"? Secondly, I seek to clarify what the noble Lord the Minister said a short time ago in the context of Amendments 16 to 18 when he seemed to give the impression—I think it was his deliberate intention—that so far as the Home Office was concerned, there would be separate registration in respect of the national police computer as opposed to the Parole Board's indexer and, again, the immigration department's data bank. If that is so, is there any reason whatever why Clause 6(2) should not be in mandatory, as opposed to permissive terms? I beg to move.

Lord Elton

I hope to reassure the noble Lord, Lord Elystan-Morgan, that there is nothing sinister in our proposal to allow what we might call pluralist or multi-purpose users to choose whether to apply for single, composite entry on the register or for separate entries geared to separate purposes. We think that they should be given a choice. What the noble Lords opposite are worried about, I think, is that the various individual purposes for which data are used will not be adequately revealed on the register and that therefore the restrictions on the use of data that hinge on the purposes being specified in the public register will lose their impact.

As cast, the Bill allows users the choice of making one or several entries. In regard to the Home Office I merely said that whichever course was taken, the information that the noble Lord felt should be made patent would be made patent. These amendments would deprive users of that choice and would oblige them to make a separate entry for each separate purpose in all circumstances. Yet all the purposes for which a user holds data will be clearly set out under the Bill as presently cast. It may be within a single register entry but each purpose must be listed.

I come now to the references that I should perhaps have made earlier. Under Clause 4(3)(b) each register entry must give a description of the data held and of the purpose or purposes for which they are held. The registrar has the power under Clause 7(2)(a), if the particulars provided by an applicant do not give sufficient information on that score, to require the applicant to give more information or submit the particulars in a different form. Of course, the registrar will not exhaustively vet every individual application but, if his attention is drawn to an inadequate application, he has the power to act. I do not doubt that he will give his personal attention to those users he sees as being of particular importance, including all Government departments.

In this way, then, the Bill already provides an important degree of supervision in this area. But there is a further consideration and one which will, I think, result in all users who hold data for a number of quite clearly different purposes having a strong incentive to register those purposes separately, as the noble Lord wishes. It concerns subject access. Any user registering singly could he required to give access under Clause 21 to all the subject's data embraced by a particular register entry. Where a user's data is divided between different computer applications which may be in quite different places, as well as designed to serve quite different purposes, he will not want to go to the trouble and expense of accessing each separate data base for data about the subject making the request. So the natural wish of users will be to register purposes separately where they really are separate.

This will go most of, if not all, the way to meeting the noble Lord's point without depriving users of the freedom to combine linked purposes in a single register entry where it would be artificial or impractical to separate them. I hope, therefore, that your Lordships will agree that this amendment is an unnecessary restriction on data users. Where purposes are altogether separate, it will be in the users' interest in any case to register them separately. Where they are not, we should not oblige them to split them. Even in a single entry, all the purposes for which data covered by the entry are held will be clearly shown.

9.25 p.m.

Lord McIntosh of Haringey

I fear that in his reply the Minister has shown scant understanding of the problems of the data subject who has the difficulty of finding out where he or she may be referred to and where it is in his or her interests to correct a record. It is not enough to say that he or she—the data subject—will know which data user to look for; he or she also has to know the nature of the data bank and the nature of the record. It is as important to be able to scan across a variety of records, across a number of data users, as it is to be able to scan the different kinds of information registered by a particular data user.

If I am accused, for example, of being a defaulter on a debt, I may not know which data user has accused me of being a defaulter on that debt. I may have the enormous difficulty of guessing or investigating which of the possible traders with whom I deal has accused me of being a defaulter on a debt. Under those circumstances, if any or all of those traders are enabled, under the existing wording of the Bill, to amalgamate their registration to cover a number of different types of information including—but not only including—the possibility that I or anybody else may be a defaulter on a debt, then I shall have enormous difficulty in knowing whether I should look in detail into the records that affect me—my personal data—from a particular data user. Unless all of those data users are forced to say separately and distinctly that the purpose of this set of records is to indentify defaulters on debts, then I as a data subject will not be able to find out whether I am so accused, and I will not be able to take advantage of the principles laid down in the Bill to correct any inaccurate data on my behalf.

Therefore, it is necessary that this amendment should be incorporated in the Bill in order, simply from the procedural point of view, that the data subject may be able to scan effectively the records which may affect him or her so as to make the corrections which are provided for under the principles. The answer that the noble Lord the Minister has given is not adequate for that purpose.

Lord Swinfen

Before the noble Lord sits down I should like to point out that surely when a data user registers the use with the registrar he must put down all the purposes for which he is registering data and. therefore, a data subject will know for what purposes he is using the data. It is not necessary to have two separate or a number of different registrations, provided all the subjects are covered under the same registration.

Lord McIntosh of Haringey

The noble Lord asked me that question before I sat down and I, therefore, take it that I have a duty to reply to it. I agree with the noble Lord, Lord Swinfen, to the extent that it does not matter very much whether there is a separate application. The important aspect is that it should be distinguished that it is for that purpose that the data are being registered. I am not satisfied at the moment that that is being achieved.

Lord Avebury

The difficulty that I have with the Minister's reply is that, first, he says that it is in the interests of the data users to lodge separate registrations in respect of each purpose, for the reasons that he has given, and that in any case even if they do not lodge separate registration applications, these will be clearly identifiable as groups of particulars ranged under each of the purposes that the data user wishes to employ.

So, to take the Home Office as an example, the immigration control computer and the particulars associated with it can be clearly identifiable separately in the Home Office application, assuming that the Home Office did not decide that the immigration system ought to be separately registered. Moreover, the Minister says that, as a longstop, the registrar has the powers in Clause 7(2) to decline to accept an application for registration if he thinks that insufficient particulars have been given. But, first, it does not say anywhere in the Bill that the data user is obliged to register the particulars under each separate purpose in such a manner as they could he as well identified as if they were the subject of individual registrations; secondly, nor does it say how the registrar is to perform this difficult function of assessing whether the particulars are sufficient for the purposes for which they are intended.

Further, the Minister tells us that he is quite certain that the registrar will scrutinise the public bodies and Government departments with particular care. How does he know that? It does not say it anywhere in the Bill. The Minister is probably right, but we are not talking about the assurances that are given across the Floor of the Committee, or even our conjectures about how the registrar will operate. We are dealing with what is proposed to become an Act of Parliament, and, therefore, we have to import a greater degree of precision into our discussions than I thought the Minister employed in his speech.

Lord Elton

I am sorry about that. The whole purpose of this Bill is to protect the data user and to enable us to conform with the convention with the same object in view.

Lord McIntosh of Haringey

Oh!

Lord Elton

The noble Lord, Lord McIntosh, has awoken to this fact rather late.

Lord McIntosh of Haringey

Is not the interest of the data subject part of the purpose of the Bill? Is not the convention concerned with the interests of the data subject?

Lord Elton

I shall read Hansard with great apprehension, because I thought that that was what I said. From what the noble Lord said, I must have referred to "the user", but I intended to say "the data subject".

Lord Elystan-Morgan

It was a slip of the tongue. The noble Lord said "data user".

Lord Elton

I am very happy to apologise and correct what I said.

The Lord Chancellor

For "plaintiff", always read "defendant"!

Lord Elton

I am grateful for the learned support that I am receiving on this difficult wicket. May I start afresh and say that a central concern of this legislation is to protect the interests of the data subject. That is a central concern of the principles. One of the principles is that data may be held only for specific legal purposes, and a function of the Bill is to empower the Data Protection Registrar, under an alteration put into the Bill at the request of noble Lords opposite, to pursue that objective. He is given the means of so doing in Clause 7(2). He is given the power to pursue that interest by not putting on the register entries which do not give data subjects sufficient information to allow them to seek access to personal data relating to them. That is his job, It is clear that it is his job, and this is a potential Act of Parliament. I should have thought that it was sufficiently clearly stated in the Bill as it is now worded to protect the interests of the data subject.

However, we must not forget the data user—and I think I have it the right way round this time; I do mean the data user—because he is already somewhat apprehensive of the administrative and other burdens which this Bill will place upon him. He is also bound to act in accordance with the data principles. He comes to put his name on the register. If it suits him to have one entry and one address with a whole series of functions listed under it, and all inquiries addressed to one entry at one address, well and good. If those functions are carried out at widely different places, and if they are very different, let him have 17 or 54 entries with 17 or 54 different addresses to which the data subject can apply.

But we are at one in this. We are not as a Government trying to construct an elaborate smoke-screen behind which information can be sheltered. We are arguing about the best way to do this. I honestly think that what we have is the proper way to do it. If the noble Lord, Lord Avebury, still feels very strongly that we have not, I can certainly undertake to read before the next stage what he has said with close attention, and, indeed, what other noble Lords have said. I should not like that to be taken as a promise to reconsider, but I want to be certain that I have all your Lordships' arguments on board and that I am not unconsciously brushing anything aside.

Lord Elystan-Morgan

In the light of everything that has been said, on this side of the Committee we feel that very strong, indeed irrefutable, arguments have been put in favour of the amendment. However, we respect the viewpoint of the Minister and in the weeks ahead we shall consider carefully what he has said, but we reserve the right to raise the matter again, if that be necessary, In the circumstances, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 27 not moved.]

Clause 6 agreed to.

Clause 7 agreed to.

9.37 p.m.

Lord Mishcon moved Amendment No. 28: After Clause 7, insert the following new clause:

("Codes of Practice.

.—(1) Where any data user or any body representative of any category of data users submits to the Registrar a code of practice as to the holding or processing of personal data for any purpose or purposes, the Registrar shall consider whether the holding or processing of personal data by that data user or by any data user within that category for that purpose or those purposes in accordance with the provisions of that code of practice would be likely to infringe any of the data protection principles, and the Registrar shall thereupon inform the person or persons submitting the code of practice of his views in that respect.

(2) If the Registrar is satisfied that the holding or processing of personal data by any category of data user for any specified purpose in accordance with the provisions of a particular code of practice would not be likely to contravene any of the data protection principles, the Registrar shall issue a certificate to that effect in relation to that code of practice.

(3) The Registrar shall have power to withdraw any such certificate at any time on not less than 12 months' notice.

(4) A failure on the part of any person to observe any provision of a code of practice shall not of itself render him liable to any criminal or civil proceedings but any code of practice at any time certified by the Registrar in accordance with this section shall be admissible in evidence in all criminal and civil proceedings and in all appeals to the Tribunal.

(5) In determining, for the purpose of any criminal or civil proceedings or any appeal to the Tribunal, whether any data user has contravened, or is likely to contravene, any of the data protection principles the court conducting the proceedings, or the Tribunal hearing the appeal, shall take into account in determining that question any relevant provisions of any code of practice for the time being certified by the Registrar for the relevant category of data user and the relevant purpose.").

The noble Lord said: The matter in Amendment No. 28 is weighty. The hour is late. The Committee is sparse in its numbers, but substantial in its intellect. What I feel I ought to do is to summarise my arguments because there is no point in taking the view of the Committee on a matter as important as this when the numbers, understandably, are so small. First, Amendment No. 28 follows an essential recommendation of the Lindop Committee; namely, that there should be codes of practice. The question whether they should be mandatory is answered in the amendment; they are not made mandatory. Organisations of data users, data users themselves, can submit codes of practice, which obviously are most desirable, in regard to the categories of trades and industries who over the years will be using computers. It is left as a voluntary exercise.

If it is a voluntary exercise one may ask why it needs to be put in a statute. The answer is that one can show that, as a result of codes of practice being in force, as a result, too, of the registrar's having given his certificate to them—and his certificate is only given if he is satisfied that the codes of practice do not offend any of the principles set out in the first Schedule—something flows as a result of the statute which would not flow if there were no statutory provision.

If your Lordships will turn to the amendment—I am trying to deal with it briefly—you will see that, having reached the stage of certification, with the registrar in paragraph (3) having the right to withdraw any … certificate … on not less than 12 months' notice"— then in any criminal or civil proceedings, when the court has the difficult task of seeing whether one of the principles has been defeated by the act of the data user, the data user can invoke in aid—and only invoke in aid—the fact that the code of practice has been complied with so far as he is concerned; and that is a matter (I repeat the words very carefully) which will be taken into account by the court or the tribunal concerned. It has no stronger effect than that, but obviously that is extremely useful.

We want to encourage codes of practice—about that there is no doubt. It will assist the administration of this Bill, it will assist the tidiness of the administration within various trades, and it will assist the members of those trades to know exactly where they stand, quite apart from the difficult interpretation given under another schedule to the principles of the convention; so we would want to encourage it. I have tried to explain how it is that one manages to encourage the voluntary codes of practice to be reached; and the registrar is the person here who will be examining them when they are submitted to him and who will make the decision as to whether a certificate is granted.

If I went on for very much longer I would not, I think, say anything more to convince the Committee. I hope that with these few words the Minister will feel constrained to say that he looks with the utmost sympathy upon this amendment and wishes that he had thought of it himself. If that be so, I shall be content. If his reply is not in such felicitous terms, then I shall seek an opportunity on behalf of my noble friends to test the views of your Lordships, not necessarily in Committee but at a further stage of the Bill.

Lord Elton

I always look with the greatest of sympathy on everything that the noble Lord puts before me—and, indeed, on all creatures. The less fortunate they are, the greater the sympathy! It does not mean that I agree with what is proposed. We are on familiar territory. We had more than one debate in the context of last Session's Bill on codes of practice; and the noble and learned Lord, Lord Elwyn-Jones, gave notice on Second Reading that he would return to the subject. Last Session the noble Lords opposite proposed codes of practice that had direct legal effect. Observance of a code would have meant that the user in question was not breaching the principles. And at Second Reading the noble and learned Lord appeared to continue to favour what he called "codes with the force of law". But, as we have heard, there has been a change of heart. The noble Lords opposite now propose something quite different. Before I consider what that something is, let me make one thing crystal clear. The Bill does not rule out codes of practice. I have said that already tonight, and I will not expand on it except to quote to your Lordships a passage in last year's White Paper: The Government sees some value in codes of practice in this field and expects…". I will not read further because I recall reading it earlier tonight. That continues to be our view. Under the Bill it will he for users to draw up general codes as and if they think fit. Moreover, we fully expect that the registrar will give advice and assistance as appropriate. His new general duty to promote observance of the principles makes clear that expectation.

Now let me turn to the amendment before your Lordships. The authors of the amendment have been very wily. They have profited from the arguments against giving their codes of practice a direct legal effect and they have come forward now with the opposite—codes of practice with no direct legal effect. Let us see what the results of that will be. Let us, for the sake of argument, assume that the registrar has certified certain codes for certain users as meaning that it is likely that compliance with the codes will mean compliance with the principles. He will be very weary because the job will have placed tremendous burdens on his resources and will have been extremely difficult; but the work has been done and the codes are now admissible as evidence in court proceedings or in appeals to the tribunal.

They will not be material in court proceedings because specific questions, not breaches of the principles as such, are at issue there. It is in appeals to the tribunal that they must be seen as having their principal role—and this is the great moment. Before we come to it, I must tell your Lordships that if the proposed provision were to work as the noble Lord suggests, the tribunal would find itself being asked to consider as evidence a code in which the registrar had agreed that certain acts were unlikely to lead to a breach of the principles in a case in which the registrar had taken action because he decided that there had been a breach. There is a conundrum there which I will leave on one side; but the great moment has arrived.

The splendid device, the new code of practice, has been designed, modified, tinkered with, approved, certified and is now trundled forward into its operating position. With what result? Presumably, the user served with a notice of breach of a principle will plead before the tribunal that he has complied with the code of practice that applied to him. He will remind the tribunal that the registrar has certified this as meaning that he was likely to have avoided a breach of the principles and he will sink back in the expectation of commendation. But what a disappointment!—for the tribunal is not there to consider whether there has been a breach of the code. It is there to consider whether there has been a breach of the principle, and the code is an interesting irrelevance. Compliance with the code is not the issue the tribunal has to decide, but compliance with the principles. That difficulty is unavoidable. It seems to me that the amendment is an attempt to strike an impossible compromise. On the one hand, it accepts that the principles are what matter and not the codes of practice. On the other hand, it nevertheless seeks to encourage the tribunal to look at the code of practice in determining breaches of principle.

The noble Lord has been courteously brief. I have other points to make but I think I have illuminated the central and weakening paradox that he has put before your Lordships. I have heard nothing that has resolved it and so I will go no further.

9.46 p.m.

Lord Mishcon

Before the noble Lord finally takes his seat and ends his irony, may I remind him that there is not only a code of practice that might be installed in this Bill but there is a code of practice that we on both sides have exercised until now, which is that we have treated each other's arguments and submissions with the greatest seriousness and we have not talked in terms of either of us being "wily".

What we were trying to do on our side—and I will content myself with this observation, in spite of the fact that I believe the noble and learned Lord also wishes to say something, though I could not quite hear him (usually I have the pleasure of hearing him and it makes me roar with laughter when I do)—in regard to a recommendation of a committee which has had many of its major recommendations not followed by the Government in regard to this Bill, was to follow it because we thought it was sensible and because various trade organisations have thought it was sensible, and we have tried with courtesy and understanding to listen to the objections of the Government when we tried before to give it some legal enforceability.

We have therefore moderated our suggestion in order to get the Government's co-operation and sympathy. It is fair enough that the Government should decide not to do it and not to give their cooperation: that is the Government's right. What the Minister does (and if he will forgive my saying so, he diminishes his stature in doing so) is to ascribe adjectives to the intentions of my noble friends and myself which are not merited and which upon further consideration, when he reads Hansard tomorrow morning in a far better mood, he will regret having used.

Lord Elton

I am in a good mood and I had not thought that I had said anything offensive. It seemed to me that I was not referring to what the noble Lords proposed but to the way they had set about trying, having failed to persuade us in one direction, to persuade us in the other. That is a legitimate approach, and if the noble Lord does not like it to be called "wily"—which I regard as a rather complimentary term—I will not use any terms at all.

Lord Mishcon

What other adjectives would the noble Lord propose?

Lord Elton

"Resourceful", "persistent". I can only say that I intended no offence and I regret it if any was taken. If I may address the amendment itself, the first approach of the noble Lords and the noble and learned Lord was a statutory code with legal force. We did not like that. They then came back with a statutory code with no legal force, and at that point I pointed out that either extreme would not work and that it is impossible to go in between; because, if you have a code with legal force, then it must outrank the principles—but the principles are supreme; that is in the convention—and, if it has no legal force, when it comes to the tribunal, the tribunal will have to consider the principles in preference to the code of practice and therefore the code of practice will not be relevant. It might be relevant if it had arrived by a different route, but when the case goes before the tribunal it will go because of a dispute between the registrar and the user. The user will say, "We are not in breach of this code, and the registrar has said that this code, if it is complied with, conveys the assumption that there has been no breach of the principles. But the registrar now says that there has been a breach of the principles, so there must be a fatal fallacy". As I said, I withdraw all adjectives from my description, but what I sought to do was to explain to your Lordships the merits of the case and why what the noble Lords opposite propose will not actually work.

Lord Mottistone

I wonder whether I can help both my noble friend and the noble Lords opposite. It seems to me that there is a germ of a good idea here. Noble Lords, in this amendment are encouraging codes of practice, and my noble friend has said that at all stages the Government, too, have encouraged codes of practice. Where, it seems to me as an observer of this latest exchange, it has come unstuck is that the present amendment has rather too much legalistic force within it, even if it is not compulsory. Surely it is very useful, if people are to produce codes of practice, and the Government have said that they like that, to have an opportunity to refer to the registrar to make sure that the codes of practice conform to the principles. That is useful for practical purposes.

Forget the law about this and whether it can be used in a tribunal, a court of law and so on: and perhaps there are bits of this amendment which point in that direction. It is useful to think that the code of practice of any company or any body which has been sensible enough to have one has the underpinning that it is not contravening the principles, and that is the end of it. If we have provision for the registrar to be able to advise them on the principles when they produce a code of practice, it might be argued that this does not have to be in the Bill. But it might be a good thing if it were, and it were done in an advisory sort of capacity, without all the fandangle of the law written into it. I suggest that to noble Lords opposite for another stage.

Lord McIntosh of Haringey

I wonder whether in his response the Minister has failed to understand the nature of this amendment. In his speech before the adjournment for dinner he raised some objections, with most of which I agreed, to the amendment moved by the noble Lord, Lord Digby. He said that the requirements for any code of practice—and I took great note of what he said, because it was relevant to this amendment—were that it should be practical, which I took to mean should save the time and money of data users, data subjects and, particularly, the registrar; that it should not claim to be above the law and that it should be in conformity with the principles laid down in Schedule 1 to the Bill. With all of those requirements I think we should agree.

What the noble Lord fails to understand is that the present amendment is not enforcing codes of practice on anybody. If that is the meaning of statutory codes of practice, this is not an amendment enforcing statutory codes of practice. What this amendment states is: Where any data user or any body representative of any category of data users submits to the Registrar a code of practice and so on. In other words, what the amendment is about is not who should submit the codes of practice and what they should contain in themselves, but what should be the response of the registrar and what should be the legal effect of that response. That is the force of this amendment, that is the advantage which this amendment has over Amendment No. 14 and that is why this amendment falls outside the strictures which the Minister has placed on statutory codes of practice.

There are no statutory codes of practice in this amendment. What this amendment says is that codes of practice have to be taken seriously. On any of the criteria which were discussed when we considered Amendment No. 14, the present amendment succeeds. The present amendment does not try to put codes of practice above the law. It does not try to set up an alternative set of criteria to the data principles set out in Schedule 1 to the Bill. It does not try to suggest anything other than that the recognition by the registrar that a code of practice is in conformity with the principles should be admissible as evidence in the courts of law. Therefore none of the restrictions which the noble Lord has suggested actually applies to this amendment.

I suggest to the Committee that, given that, in particular, subsections (4) and (5) of this amendment follow very closely the provisions of the Police and Criminal Evidence Bill, there cannot be anything in the amendment which should be objectionable to the Government, do anything other than help the efficient organisation of the work of the registrar, do anything other than help the position of the data user and, above all, of course, bearing in mind the recent exchange, do anything other than be to the benefit of the data subject.

Lord Elton

I think I dealt with most of the points the noble Lord referred to. There is nothing wrong with voluntary codes of practice. There is nothing wrong with the data protection register assisting or advising in them. What I sought to point out was that this amendment gave the imprimatur of the data protection registrar which might lead to a tribunal's being asked to consider it as an indication that probably no infringement of a principle had taken place. In fact, however, it would only have come to the tribunal because the registrar was thought by the user unfairly to have imputed such an infringement in the first place. That seemed to be a paradox which it was not possible to get around. I do not want to pursue the link that the noble Lord seeks to make with the Police and Criminal Evidence Bill beyond saying that the codes under that Bill stand on their own as arbiters of good practice and can therefore quite properly be given express evidential value. But that is not the case under the Bill before us because here it is the principles that are the essential yardstick. I consider we have gone on long enough. I think I have said as much, if not rather more, as I wished to say, and I shall sit down.

Lord Avebury

We shall be coming back to this subject at a later stage, but may I ask the noble Lord to consider the analogy of the Health and Safety at Work Act 1974, where there are statutory codes of practice and there is a general obligation on the employer to do everything which is reasonably necessary—I think it is Section 4—to ensure the health and safety of his employees? One would imagine that conflicts could occur there. Of course, if any question arose as to whether an employer has, in fact, complied with his obligation under Section 4 and he pointed in his defence to the code of practice which he had observed, the same kind of situation would arise as the noble Lord envisages would arise before the tribunal in this case. My noble friend says the same sort of thing occurs in trademarks legislation. I think there are parallels elsewhere in statutes which the noble Lord may have overlooked and will want to examine before we return to this subject at a later stage.

Lord Mishcon

I said to the Committee before that I thought this was neither the time nor the place, nor are the numbers present, that warrant a further discussion of this matter taking the time of the Committee. We shall obviously be returning to this theme at a later stage in the Bill. I am grateful to those noble Lords who have taken part in the debate upon what is a most important matter, and we will certainly bear in mind, for example, the very helpful remarks of the noble Lord, Lord Mottistone. With the leave of the Committee, may I withdraw the amendment?

Amendment, by leave, withdrawn.

Clauses 8 and 9 agreed to.

10 p.m.

Lord Elwyn-Jones moved Amendment No. 29: Before Clause 10, insert the following new clause:

("Information to be furnished to Registrar.

.—(1) A data user shall furnish to the Registrar, upon his request and within a reasonable time, any information about the holding or processing of personal data by that user which the Registrar may reasonably require for the performance of any of his functions under this Act.

(2) If a court is satisfied on the application of the Registrar that any data user has refused, or has failed within a reasonable time, without lawful excuse, to furnish to the Registrar any such information so requested, the court may order the data user to comply with that request within a time specified in the order.").

The noble and learned Lord said: In moving this amendment I trust that the reception it receives will be in a better tone and more in keeping with the courtesies of your Lordships' Committee and of the debate up until now than the noble Lord the Minister demonstrated in his reply to the courteous observations of my noble friend. If the noble Lord wishes a fight in those sort of terms on the rest of this Bill, he shall of course have it. But this is not an occasion which calls for that. We have applied our minds seriously to this matter, to achieve a result which makes sense of this Bill. To have adjectives such as "wily" thrown at us is intolerable, and I hope we shall see no repetition of it. If there is, there will he a reply of the same kind as that meted out to us from the other side of the Committee.

Lord Elton

Would it be helpful if I said what I thought I had conveyed before? I intended nothing offensive in what I said. If the word carries an implication of which I am not aware, then I am deeply sorry if I have offended the noble and learned Lord. I have the highest regard for him and his colleagues, as I hope I have always shown. I attempt occasionally to bring in to what might otherwise be mundane exchanges a little levity and colour. If, on this occasion, I have nudged the wrong paintpot and got the wrong colour, then I can only repeat that I am very sorry if I have offended the noble and learned Lord. I did not intend to do so, and I can say no more than that.

Lord Elwyn-Jones

Very well; in the light of that clear apology then we will, of course, forget the incident. Up until now, the relations on both sides of this Committee in trying to seek a solution in this miserably complex matter have been in a tone of good faith.

We now come to a modest but, I venture to submit, sensible requirement in Amendment No. 29; namely, A data user shall furnish to the Registrar. upon his request and within a reasonable time. any information about the holding or processing of personal data by that user which the Registrar may reasonably require for the performance of any of his functions under this Act", and if that is not forthcoming, the registrar should have the power to go to court.

There is a similar power provided for in Clause 24, as the Committee will note, in regard to rectification and erasure. At the moment, as we on this side of the Committee have said, the position is still (and the noble Lord the Minister will remember the fictitious correspondence I read out on the last occasion) that the registrar has no powers to obtain any information from any user. His only remedy seems to be a search warrant. It is unlikely that any sensible registrar will use that sledge-hammer. It is indeed doubtful what he might find if he did use it. Accordingly, the proposal we make in subsection (2) of the amendment is that if the court is satisfied on the application of the registrar that the relevant refusal has been without lawful excuse, the court may order the data user to comply with the request within a time specified in the order. I beg to move.

Lord Elton

We all start from a common position on this question. We agree that the registrar must be able to obtain sufficient information from data users and from persons carrying on computer bureaux in order to perform his functions: that is obviously crucial. Where the Government differ from the noble and learned Lord who proposes this amendment is in believing that the Bill as drafted already provides the registrar with adequate and appropriate powers for this purpose.

As we see it, there are three distinct circumstances in which the registrar may require information. The first is where he is considering an application for registration or for the alteration of an existing registration. In this case, he must have sufficient information to satisfy himself as to whether or not the applicant is likely to contravene any of the data protection principles. I do not believe we differ there, since I recall that the noble Lord, Lord Mishcon, accepted last Session that the appropriate sanction in such circumstances, where the registrar cannot get the information he needs, was for him to refuse the application on the grounds set out in Clause 7(2)(c).

The other two situations in which the registrar may need to obtain information are where a person who has not applied for registration is suspected of the offence of processing personal data in circumstances that require registration; and where a registered person is suspected of contravening any of the data protection principles. It was this latter situation which formed the basis of the example used by the noble and learned Lord, Lord Elwyn-Jones, when we last discussed this issue. He painted the picture of the registrar receiving a number of complaints from data subjects suggesting that a particular user was acting in contravention of the data protection principles—and of the Registrar then asking the user in question whether they were well founded. It was suggested that the user, in such circumstances, could refuse all co-operation, safe in the knowledge that there was nothing in the statute to compel him to answer, and that the registrar was unable to exercise his powers under Clauses 10 or 11 unless satisfied that a contravention of the principles had occurred.

The noble and learned Lord relied upon the user's rejoinder to underline his contention that the registrar would be powerless in such a case unless a refusal to supply information were itself made a specific offence. But I think the correspondence would have gone on. I think the registrar would have written to the data user saying, "You seem to have overlooked the provisions of Clause 16 and Schedule 4(1)", and he would have pointed out that this paragraph empowered a circuit judge to grant the registrar an entry warrant if he was satisfied there were reasonable grounds for suspecting an offence.

I shall try to telescope my responses by saying that I think what the noble and learned Lord feels is that this is an ultimate and draconian response to something that should be an intermediate. Our feeling is that the same goes with refusal to pay debt; you do not send a bill and at the same time say, "If you do not pay we are going to take you to court". You first of all send a reminder, then you send a rather angry reminder and then you send a solicitor's letter. All along, the person knows that eventually he may come to court. It is our feeling that the existence of this ultimate sanction is sufficient without it being regarded as a big stick which will always he brought into use.

Lord Avebury

I think the example the Minister has given illustrates the case very well. In the case of the debtor there are four stages; there is the reminder, the angry reminder and the solicitor's letter before you come to court. Here we have only the one step: the registrar, having failed to get a response, has then to go to the circuit judge to get an entry warrant. What we said on the previous occasion was that this was an enormous sledge-hammer to crack the nut and we wanted an intermediate procedure which would assist the registrar in discharging his duties. The fact that he has not got a power such as that contained in this amendment seems to me a very serious defect.

Lord Elton

That is just the point; the actual taking to court is the only part of the process I illustrated which is described in the statute. Similarly, the only part of the process in the statute here is the power to go to the circuit judge, but the letter and the angry letter can be replaced by similar letters in this context.

I hope I am not misjudging the extent of the anxieties of noble Lords, and I think I heard noises behind me. It does seem to me that what we propose here is a sufficient procedure which allows of gradations of response in exactly the same way as in almost any other civil or criminal procedure.

Lord Elwyn-Jones

Up to this moment we have not been able to identify anything in the Bill requiring the data user to furnish to the registrar any information about the holding or processing of personal data. This is the difficulty that we see. We are trying to help on this matter, and to avoid recourse to the draconian process of a search warrant. I hope that the Minister will, in the circumstances—I am comforted to know that he has heard some noises from behind him, which is always reassuring to this side of the Committee —look at this matter again. If he is willing to say that, I am prepared to take a certain course.

Lord Elton

Of course I will look at what the noble and learned Lord has said. However, he will understand that I cannot undertake to come back with a change of heart. But I will genuinely look at the matter again.

Lord Elwyn-Jones

I fully understand that the Minister is giving no undertaking, but in the circumstances I ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clauses 10 and 11 agreed to.

Lord Elwyn-Jones moved Amendment No. 30: After Clause 11, insert the following new clause:

("Notification by Registrar.

If the Registrar is satisfied that a registered person has materially contravened or is materially contravening any of the data protection principles he shall forthwith notify his findings to any data subjects who may, in his opinion, have suffered damage by reason of such contravention.")

The noble and learned Lord said: This is an attempt to save time, effort and money. The terms of the proposed new clause provide that if the registrar is satisfied that the registered person has materially contravened or is materially contravening any of the data protection principles he shall forthwith notify his findings to any data subjects who may have suffered damage by reason of such contravention. Moreover, when a registrar serves a deregistration notice on any registered person he shall notify that service to the subjects of the personal data held by that person.

The object of the amendment is to avoid the wholly improvident use of public resources when data subjects have to carry out independent investigations where the registrar has already spent a good deal of time and money in discovering and exposing contraventions of the data protection principles. It would seem good sense all round that in those circumstances he should make his findings available to data subjects who may have suffered damage as a result. I hope that this amendment will strike the noble Lord as sensible and that it will provide a good saving in public resources. I beg to move.

Lord Elton

The prospect of a saving in public resources is always profoundly attractive, but I am afraid I must rest on the arguments which I advanced earlier, strengthened as they are by the changes we have made since we last looked at this area, and to what is now Clause 34, on the general duties of the registrar. I absolutely agree that the registrar is likely to be uniquely placed to know of the uses, and abuses, of personal data, and I fully accept that it will be through him, in many instances, that data subjects will learn that things have gone wrong—whether through the publicity which his actions attract, the reports he publishes or the other steps he may choose to take to make information available. Clause 34 establishes very clearly the expectations we have of him in this regard: he must publish an annual report and disseminate information as he thinks fit, and he is specifically empowered (we put this point in to avoid all doubt) to give advice to "any person" as to the operation of the Bill and his functions under it.

There is nothing whatever to prevent the registrar, where he thinks fit, doing precisely what this amendment proposes. A situation could arise in which it seemed right to bring contraventions to the attention of the data subjects affected, and he is already fully empowered to do so. But I must resist, as I did before, any move to compel the registrar to take that precise action. It may, for one thing, be quite unnecessary. His dealings with the data user in question may have already attracted substantial public interest and publicity.

To require him to make this notification in all cases could involve a very considerable drain upon public resources. He would have to decide whether any data subjects might have suffered harm, then plough his way through the records to decide who had been, and in what way, and then duly notify each of them. That is the point on which I feel anxiety, because the notification itself might involve vast numbers of communications. By that I do not mean just thousands but literally millions of letters. Although this exercise is initiated only when a material contravention occurs, there is no limit at all to the triviality of the damage which may be at issue. I think that your Lordships are aware from this that our hostility remains as it was and is similarly based. I regret that I cannot be more comforting to the noble and learned Lord.

Lord Swinfen

Before the noble Lord replies, may I say that I wonder what would be the position if a tribunal or court were to decide that none of the data protection principles had been contravened, and the registrar had already by that time notified the data subjects that he thought that they had been. Surely the data user might then have a case for damages or something of that sort. It strikes me as a position that could prove very interesting legally.

Lord Elton

I think that the question is addressed across the Floor. My view would be that the data protection registrar would not pronounce upon something that was sub judice.But it is not my amendment, so I shall leave it to the noble and learned Lord.

10.16 p.m.

Lord Elwyn-Jones

It is suggested that the matter is resolved in the annual report of the registrar. My feeling about this at the moment is that one would expect that he would not condescend to particulars; otherwise that might indeed aggravate the damage. So I do not think that is a satisfactory answer. But if, on giving the matter further thought, instead of the words "he shall forthwith notify" one was given the words "he may notify his findings" in a particularly deserving case—it may be, to a data subject who may have suffered material damage—what is the registrar to do? Is he simply to sit upon it, hoping that the unfortunate data subject who may have suffered material damage will not find out? Ought there not to be some duty, if only of a permissive character, to communicate? I should like to give further thought to that possible way of dealing with it. But at the moment the picture of the registrar's having information about a contravention damaging a user, and nothing being done about it until the unknowing user discovers, does not seem to me to present a very satisfactory use of the registrar's power or knowledge. I do not know whether the noble Lord wishes to respond to that thinking for the moment.

Lord Elton

Only to remind the noble and learned Lord that there is the permissive power which he seeks in Clause 34. It is not only a question of an annual report. The registrar is also required to disseminate information as he thinks fit. In order to put the matter beyond doubt he is specifically empowered to give advice to any person as to the operation of the Bill and his functions under it. As I see it, the data protection registrar will be in a perfect position to communicate with individuals when it is appropriate so to do. But it seems to me that there will be occasions when perhaps a million people have suffered a fairly trivial inconvenience as a result of a breach, and it will be sufficient for him to place an advertisement in the newspapers or indeed to rely on the popular press to report it. Perhaps we should both consider what the other has said between now and Report.

Lord Elwyn-Jones

I am most grateful. I see the force of that. The noble Lord clearly sympathises with the problem I have raised. In the circumstances, I ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clauses 12 and 13 agreed to.

Schedule 3 [Appeal proceedings]:

Lord Mishcon moved Amendment No. 31: Page 36, line 42, leave out ("includes at least one person") and insert ("are persons").

The noble Lord said: This is a short point involving a short amendment, so I shall make a short speech. If your Lordships look at page 3 of the Bill you will find a very welcome new provision. It is that the Data Protection Tribunal shall have among its appointees, persons to represent the interests of data subjects". Your Lordships will find that provided for under subsection (5)(b) of Clause 3. If your Lordships will look just above that paragraph, you will find that the other persons who are to form the tribunal are to be, persons appearing to the Secretary of State to have professional knowledge or experience of the use, design or manufacture of data equipment". Your Lordships may think that that, too, is very sensible.

If your Lordships will now kindly turn to page 36, where Schedule 3 will be found, you may well think that you will find that the balance is equal, and that those members referred to in subsection (5)(a)—the professional people—will be matched by those referred to in paragraph (b), who are now to be those who represent the interests of data subjects. But your Lordships might be surprised to find that the division contained in paragraph 2 of Schedule 3 is such that, after the reference to the chairman or the deputy chairman, it is provided, half are persons appointed under paragraph (a)"; and then, when one gets to those persons who are to represent the interests of data subjects, the only provision is, the other half includes at least one person appointed under paragraph (b)". In my submission there ought to be an equal division between the two categories, the experts and those who obviously also represent the views and the interests of the data subjects. So that is the point of the amendment—that there should be an equal division between the persons referred to in paragraphs (a)and (b) of subsection (5). I beg to move.

The Lord Chancellor (Lord Hailsham of Saint Marylebone)

My emergence at 22 minutes past 10 in this interesting debate reminds me of a kind of Bateman cartoon. There was one that I remember from my youth. There was a little man who got up at six in the morning, put on his overcoat and went down in the train. Eventually he arrived at where there was an enormous orchestra of about 500 different instruments. He brought out of his pocket a little piccolo, blew one note, and went hack again. That was all that he had to do. The cartoon was called, The one note man.I am afraid I am rather in that position tonight.

The situation is that Clause 3 deals with the composition of the tribunal, Clause 13 deals with its functions, and Schedule 3 deals with the details of it. The idea is that, ordinarily speaking, the tribunal should consist of three members. It would be awful if it were two, because thay might differ. When the tribunal consists of three members it will comprise a chairman, who will be the "legal eagle" appointed by the Lord Chancellor, and then there will be a little man who is appointed under paragraph (c) of Clause 3(3) by the Secretary of State. He will be expert in the matters referred to in Clause 3(5). Then there will be another little man who is there to represent the data subject. How he represents the data subject who is the whole of the population of these islands, I am not sure; but, at any rate, that will be his function.

That will be the ordinary court which constitutes the tribunal. But we may occasionally have a five-man court, like the Court of Appeal, and it is designed that then the composition may be more variable, with a certain degree of flexibility. There may be two "legal eagles", instead of one. That will happen when a question of law is involved. It will always have a minimum of one man to represent the data subject. It might happen that instead of two "legal eagles" there will be two fellows under subsection (5)(a). Your Lordships will see that the Secretary of State has the power to appoint under subsection (5)(a) people with professional knowledge or experience in the use of data equipment, its design or its manufacture. It will of course occur at once to your Lordships that they may represent quite different fields.

The idea really is that a five-man tribunal will not be exactly based. It does not represent a situation like the Lands Tribunal or the Industrial Tribunal, where you have the employer on one side, the employed on the other and a legal chairman in the middle. You have a tribunal composed of those who are designed to deal with the question at issue. The standard case will be a three-man tribunal. The non-standard case will be a larger one in which there will be at least one member who represents the data subject, however difficult he may find it. You may find more categories than one—an extra lawyer, an extra man who deals with use, another man who deals with manufacture, plus always the man who represents the data subject.

This is the design of the Bill. I am bound to say that I have very few passionate convictions about the subject. That is the little note that my piccolo is designed to sound, and I am now sounding it. I hope that the Committee will take note of what I have said.

Lord Mishcon

The note sounded by the one-man band, if I may say so, is, as usual, very attractive. I shall play it over to myself in the quietness of my room at some future date and see whether I find it so attractive that this amendment need not take its place on a future occasion. If it does, I hope that the noble and learned Lord will play again. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Schedule 3 agreed to.

Clauses 14 to 16 agreed to.

Schedule 4 agreed to.

Clauses 17 to 20 agreed to.

Clause 21 [Right of access to personal data]:

10.29 p.m.

Lord Elystan-Morgan moved Amendment No. 32:

Page 17, line 27, at end insert— ("Provided that in appropriate cases, having regard to the means of any applicant, the Registrar shall have the power to order that the fees otherwise chargeable under this Act shall be wholly or partially waived.").

The noble Lord said: In putting forward this amendment, we seek to serve two purposes. The first is to protect the data subject from the danger of a situation where there are a number of registrations, bearing in mind that Clause 21(3) is an adjunct to the Bill as originally drafted, and that in some circumstances the search fees that will have to be paid by the data subject will financially embarrass him. One does not need a great deal of imagination to see how a fee of even a few pounds having to be paid in respect of a number of searches might constitute considerable hardship to many millions of our fellow countrymen. I am sure that the Minister takes on board, properly and fairly, that plea.

One must bear in mind that in many cases it will be people of the most humble financial status who are already affected deleteriously and unjustly by the very conditions that this Bill seeks to remove. It will be a great irony if we allow the matter of a few pounds to come between that body of people and the protection that it is the purpose of the Bill and the European Convention that the Bill seeks to incorporate to provide. It woud be ironic if they were to be frustrated on account of such a relatively simple situation as that. In putting forward that plea, I think it is right that the Committee should remind itself of what happens in other European countries that are also signatories of the convention.

So far as West Germany is concerned, the law of that country says that a full fee is payable, but apparently it is seldom enforced in practice. The Government in the Bundestag has said that in practice agencies should not be charged, and it appears that there is every prospect that even the letter of the law will be amended shortly. Most firms do not charge; credit bureaux do so, but only a very small fee. Apparently the situation in Norway is exactly the same. In Sweden a data subject can obtain one free copy from the record every year.

The second purpose that the amendment seeks to serve is to probe into the interesting but as yet, to us, dark recesses of the Minister's mind, hoping that we shall flnd there a generous response to the problem which we think can arise, and which will inevitably arise unless there is this warm understanding that we have appealed for in relation to what may indeed be crucial to the very success of the Bill. I beg to move.

The Lord Chancellor

For some extraordinary reason it has fallen to my lot to reply to this amendment. I simply cannot imagine why that should be so because it involves no knowledge of law at all. However, as I understand it, the situation is as follows. Under Clause 21(2) you may make one application for one kind of entry against or for you, and you pay one fee. Some cunning person has provided later on in subsection (3) that if there is more than one entry for a different purpose, then you pay a fee for each application. So the amendment deals with subsection (3) and does not deal with subsection (2). I think that that was intentional from what I gathered from the remarks of the noble Lord, Lord Elystan-Morgan, although those who have briefed me thought that it was unintentional. However, I gather that it is not unintentional and that it is a deliberate choice, and I can understand that, too.

Principle 7 provides—and it is also provided for in the convention—that: An individual shall be entitled [to the information required] without undue…expense". Of course that governs the whole of the philosophy under the Bill.

The idea is that regulations will provide maxima. The maxima will have to comply with the convention and will, therefore, have to comply with Principle 7. Therefore, the expense must not be such as would be considered undue. I rather doubt whether the humblest individuals would be very much troubled with this Bill; I rather fancy that the characters who will involve themselves in litigation and disputes about it will be of rather a different character, but we shall see.

The view at the moment is that there is no particular reason why the data user should be asked, in effect, to subsidise certain applications. On the contrary, the idea is that the applications will, by reason of the fees—which I gather will be pretty modest by modern standards—fund themselves. The idea also is that the registrar does not have a useful part to play in deciding whether or not to waive the fee at the expense of the data user.

The hope is that in many cases the applications will be conceded without a fee. It is not necessarily thought that a fee should be charged in every case. A fee will be chargeable in every case up to the maximum, but I should have thought that a good many of the Government and some of the private sector applications will be granted as of course, because the fee is not worth collecting.

At any rate, the case which I am asked to put forward is simply that it is not at the moment thought right that the data user should subsidise the applications. It is thought right that the applications should be funded by the fees provided. It is safeguarded by the principles and it is safeguarded underneath by the convention itself. I have put my case as simply as I can and as quietly as I can. It has no legal knowledge behind it. It is simply the Government's case.

Lord Elystan-Morgan

We certainly agree that the noble and learned Lord has put his case as clearly and as cogent1y as one would ever expect him so to do, although it is not a legal matter. We are not totally satisfied, and I hope we do not sound churlish on that account. We are, with great respect, begging leave to doubt the total correctness of what the noble and learned Lord says when he doubts whether it will be the humblest in the land who, on occasions, will have resort to these searches. We believe that in many cases that could well be so and that it would be a failure of this legislation if it were to be thought that it was confined to more privileged groups.

Nevertheless, we are extremely grateful to the noble and learned Lord for his words. We shall think very carefully about them—I said, in relation to another amendment, over the next few weeks—may I say, indeed, over the next few months. I hope that they will be happy and peaceful months in a sun-drenched long vacation, and that we shall come back, but reserving the right, if necessary, to raise this matter at an appropriate stage again. Therefore, for that reason, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 21 agreed to.

Clause 22 [Compensation for inaccuracy]:

10.38 p.m.

Lord Avebury moved Amendment No. 33: Page 18, line 35, at end insert (", but the data user shall not be entitled to receive damages both as provided in this subsection and from legal proceedings under the law of defamation.")

The noble Lord said: Your Lordships will be pleased to hear that I can move this amendment in a very few words. It concerns simply the possibility that a person may claim compensation under Clause 22 for data which is inaccurately recorded about him and at the same time he may be entitled to damages in an action for defamation. It does not seem right that a person should be enabled to receive a payment from two separate actions in respect of what is really the same fault on the part of the data user. Therefore, there seems to be a need for additional wording in this clause which makes it impossible for the data subject who claims compensation to do so simultaneously through the procedures in this Bill and through an action for defamation. I beg to move.

The Lord Chancellor

I am afraid that it is me again! There is a curious misprint in the amendment to which I draw attention straightaway. As I intervened in saying when my noble friend made a similar error, "Whenever you read 'plaintiff' you should read 'defendant'", so in this case it is quite obvious that the amendment would not make sense unless for "data user" you read "data subject". However, I shall proceed on that basis, knowing that it is a mistake I should probably have made myself if I had been drafting the amendment instead of replying to it.

The answer to this problem is that there is no reason why the data subject should not get damages under two causes of action, if he has two causes of action. He cannot get the same damage twice, but he cannot get the same damage twice under the ordinary law of the land. The courts would not award him two sums of money to recoup for the same loss. But let us look at the thing in this way. If he claims damages on the basis of compensation and on the basis of inaccurate information because he has suffered damage, he could claim it even if the matter was not defamatory, because the basis of the claim under the Bill is that it is inaccurate and that it can cause him damage because it is inaccurate. The famous case is where one says of a man that he is dead. It is not in the least defamatory to say of a man that he is dead, but it may cause him financial loss, especially if he is practising at the Bar.

There is no reason why the cause of action under the proposed statute should be based on defamation. On the other hand, if the thing is malicious, wrong and defamatory he is entitled to claim, in addition to his loss, what the Scots call solatium or aggravated damages, and in certain extreme cases, as defined in Cassell v Broome and Rookes v Barnard and the other cases we talk to each other about, he is entitled to get even exemplary damages. The idea of the Bill does not make it unreasonable or wrong that he should get both. His actual loss under either head, yes, but if he has two causes of action he is entitled, in our thinking, to get what damage he is entitled to under either, provided that he does not get the same sum under both. In so far as he gets the same sum under both, the general law will protect the defendant. If it is designed by the amendment to stop him from getting what he would otherwise be entitled to, on the whole we are against it. I hope with that explanation I have answered the point.

Lord Avebury

The noble and learned Lord is certainly not a piccolo but a much more resounding instrument of the orchestra, if not the whole orchestra in himself, as we have heard in the last three amendments. I am most grateful to him for the comprehensive and lucid way in which he has replied to this amendment. I should like to consider more carefully over the next few days what he has said about the possibility of two simultaneous actions in respect of inaccuracy and defamation. In the meantime, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Lord Mishcon moved Amendment No. 34: Page 19, line 9, at end insert ("unless—

1. (a) the data subject has notified the data user that he disputes the accuracy of the data; and
2. (b) the data user has failed to add to the data an indication to that effect so that the information cannot be extracted from the data in a form which does not include that indication.").

The noble Lord said: Again happily I can be brief. There was an old clause, No. 22, in the earlier draft of the Bill, and that has been improved, without any doubt, by Clause 22(4) in regard to the position of the data subject. This amendment says that it does not go far enough.

Let us suppose that a data subject discovers that some information about him held by a data user is incorrect or misleading as to any matter of fact, and tells the data user that that is the case. If the data user originally obtained that information from a third party then it is right that he should be reminded of this whenever he extracts it. But that alone, unfortunately, will not be sufficient protection for the data subject. Equally one cannot expect the data user to rectify the information merely because a data subject says that it is incorrect, or to hold a formal inquiry to decide who was right. That I readily concede.

What we ask for, at the very least, is that there should be a note on the data file to show that the data subject disputes this entry and to ensure that whenever the information is extracted that note will be there to say so. Several European countries, I understand, require the data user to do even more than this and to add the data subject's own version in no more than 50 or 100 words. Depending on the Government's response to the present amendment, perhaps such an additional obligation can be suggested; but I much prefer not to suggest it at Report stage if this amendment can be agreed to.

The Lord Chancellor

I ought to say that I have five pages of foolscap to read out. I may be able to be helpful up to a point. Clause 22 is concerned with compensation for inaccurate information and the point revolves round the provision which deals with the received-status exception, as I think one has come to know it in the jargon of this rather esoteric subject, in subsection (4). I think that lurking behind the amendment there is a valid point. I make absolutely no undertaking on this at all, because I am told there are all sorts of difficulties, but I think there is an argument, and a perfectly sound argument if one can give effect to this, to allow the data subject to put some sort of dissent note on the record where the received-status information is on the file. If the noble Lord will not press his amendment at this stage, I should like to take it back, without commitment, and to see whether the Government cannot think of a way in which to give the data subject the right to what I might call a dissent note written on the file against the received-status information dealt with under Clause 22(4). I rather hope, having said that, that without commitment on either side we can leave it at that this evening.

Lord Mishcon

I regard that intervention of the noble and learned Lord as most helpful and courteous, and I look forward with great pleasure to seeing whether what he has said leads to something constructive in regard to this matter. I well understand that he has not given an undertaking. I am most grateful for what he has said.

Amendment, by leave, withdrawn.

10.47 p.m.

Lord Wigoder moved Amendment No. 35:

Page 19, line 9. at end insert— ("Provided that, in the case of information received or obtained from a third party, the data subject shall be able to apply to a court for compensation under subsection (1) above and for orders under section 24 below unless the third party can satisfy the court that the information is accurate.")

The noble Lord said: We always seem to reach amendments to this clause at a late hour in the evening. It happened last time and it is happening again during the replay. I put this amendment forward not so much with a profound belief in its merits as with a profound scepticism as to the merits of the clause as it at present stands. As I understand it, Clause 22, as at present drafted, means that if a data user processes inaccurate information, the data subject shall have a right to compensation under Clause 22 and to rectification and erasure under Clause 24. But I also understand the clause to mean that, however wildly inaccurate, and, indeed, maliciously inaccurate, such data may be, the data subject has no remedy of any sort if the data user has had the forethought to write against the data: "Obtained from third party".

There is no obligation upon the data user to disclose who is the third party. There is no machinery, as I understand it, by which anybody can determine whether the data user's claim that he has obtained this information from a third party can be properly tested. Last time round, when on a slightly different amendment, the noble and learned Lord opposed this amendment by leaping to the defence of journalists who might be relying upon totally inaccurate information from other sources that they would be unwilling to disclose. If I may say so, I have not quite the same enthusiasm as the noble and learned Lord for seeking to protect journalists who are as rash as that; but I accept the point the noble and learned Lord made then.

What I seek to do in this amendment is to approach the issue in a rather different way and to say that where a data subject has suffered damage as a result of an inaccurate statement by a data user, it is not sufficient for the data user simply to say. "Terribly sorry: obtained from a third party." The data user under this amendment must take one of two courses. He must either say, "This information is inaccurate: therefore I am responsible and therefore damages, rectification and erasure will follow". Alternatively if he chooses to do so, he will say, "I will disclose who the third party is"; and therefore the third party can be made liable in proceedings, and it must be decided as against a third party whether he is liable for damages, rectification or disclosure. As this clause stands, I would submit that the data subject is being put in a totally intolerable position. Far too great an advantage is being given to the data user if inaccurate—and often grossly inaccurate—information is being processed, often to the very great detriment of the data subject. I beg to move.

The Lord Chancellor

I wish I could be as helpful about this particular amendment as I tried to be over the last one and as I may be about the next. The point is that if defamatory matter is published in any form the law of libel still applies, and the data subject (if he calls himself that) can still be the plaintiff in a libel action. The object of Clause 22(4) seems to me to be this: in regard to the storage or processing of computerised information, the subject is not entitled to damages simply because the data user has recorded from a third party inaccurate information. If, for instance, the police have got against my name: "Mr. Smith says that Lord Hailsham has criminal associates", this would not by itself entitle me under the statute to get compensation. There would very likely be an action for damages if, ex hypothesi,I found out, under the ordinary law of defamation. I believe that is right from the point of this Bill.

The amendment does not, I think, remedy the situation except by imposing on the data user the kind of liability to which a data user ought not to be subjected. To begin with, it says …unless the third party can satisfy the court that the information is accurate. In other words, however accurate the information might be and however much the data user or somebody else can prove that it is accurate, compensation is still obtainable, if loss or damage is suffered, unless the third party who supplied the information can prove it. That seems to me a very funny way of achieving the object, when the ordinary law of defamation could achieve it better and more rightly.

There are a number of cases where I think the whole philosophy of the Bill would be undermined if I were to yield on this particular point. In the case of the police, they will presumably use computerised information and, presumably, will be caught by the Bill. They are constantly obtaining information, some of which is accurate and some of which is less accurate, from police informers. I think that the flow of information would probably be dammed or shut up, or at any rate very much occluded, by this amendment if it became the law. In the case of the instance which I gave, that Mr. Smith said that Lord Hailsham had criminal associates, and they recorded it, they might very easily record it for the purpose of showing that Mr. Smith was an inaccurate informer or a malicious informer and was not to be trusted when he gave bad information about other people.

I would respectfully say that, although I understand the point which has been put by the noble Lord, Lord Wigoder, it will not do in this form; and although I have tried to be helpful about the previous amendment, and I might be helpful about another in due course, I do not think that this one will do. I cannot offer much hope of it along these lines, and, therefore, I cannot give any undertakings about it. Obviously, I will reflect upon anything which is said from the other side, but I just do not think it fits into the philosophy of the Bill and I think that the damaged party must he left to his remedy by way of defamation.

Lord Wigoder

I am grateful to the noble and learned Lord for his not entirely unsympathetic response. I have only two observations to make upon it. First, as I understand it, the position under Clause 22 is that any data user can nullify the whole object of this legislation by recording, if he wishes to do so, against every item of data, "obtained from third party". So far as I can see, there will be no check of any sort by anybody as to whether that claim is accurate or whether, if the claim is accurate, it is true. If that is so, it seems to me to drive a coach and horses right through the whole of this legislation.

The other observation that I seek to make to the noble and learned Lord is that he indicated that there might be certain circumstances in which there could be actions for defamation where information of this sort was inaccurate. But that would only apply if there were publication, and it might well be that, if the data user were in possession of grossly and maliciously inaccurate information that he had obtained from a third party, it would he quite impossible to prove as against the data user that there was, in fact, or had been, publication.

I make no further comments upon the matter as, once again, the evening is drawing on. I accept what the noble and learned Lord has said. But although he offers no great encouragement to this amendment—and it may he that this amendment is not very well conceived—I hope he will look at the criticism of the clause as it stands, which is more substantial than the case for the amendment that I put forward, and consider whether some amendment ought to be brought forward at a later stage. In the light of the noble and learned Lord's observations, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 22 agreed to.

Clause 23 agreed to.

Clause 24 [Rectification and erasure]:

Lord Mishcon moved Amendment No. 36: Page 19, line, 33, after ("above"), insert ("(other than subsection (4) of that section)").

The noble Lord said: I was less ambitious than the noble Lord, Lord Wigoder. That may have been a fault, and I do not intend now to recite the famous speech at Caesar's grave, but if it was a fault then of course I shall suffer for it. But I am on the same point on this amendment, which I move on behalf of my noble friends, and it is this. As your Lordships have heard, if the faulty information emanates from a third party, subsection (4) of Clause 22 states that the data shall not be regarded as inaccurate, because the information is itself incorrect or misleading. Clause 24 awards damages in certain cases, but really the point about Clause 24 that I want to make is that it does also offer rectification and erasure but goes on to say that quite obviously the effect of that would be that you cannot get rectification or erasure where the fault occurs. so the data user says, as a result of information from a third party.

I was not ambitious enough to claim compensation or damage in those circumstances, but the least that I do in justice, and I look imploringly at the noble and learned Lord and repeat the words, "the very elements of justice", is to obtain, if I can show that the information is inaccurate or misleading, at least erasure. That is the purpose of this amendment. I beg to move.

Lord Wigoder

Perhaps I may support this amendment.

The Lord Chancellor

I will try to be as helpful as I can about this without, I think, committing myself or the Government directly. First of all, I should like to say something to the noble Lord, Lord Wigoder, which I think was perhaps more relevant to what he was saying when he withdraw the last amendment. Of course, if you look at Clause 22 it does not entirely meet his point, but if you do record something which has not been given you by a third party but which is nonetheless inaccurate, you are not protected at all under subsection (4). In order to get the received status immunity which the data user obtains under subsection (4) of Clause 22, he has really got to state truthfully as a fact that he has had this information and he has had it from a third party, and if he does say that untruthfully then there is an error of fact under the previous subsections of Clause 22, and compensation is obtainable. I should like to make that absolutely plain. At least, I think it is absolutely plain on my reading of the clause.

The other thing is that I do think there is again lurking round this territory a perfectly valid point which the noble Lord, Lord Mishcon, has made—that it seems very hard that the data subject, if he can prove that the information received from the third party is inaccurate, should not be able in some way to have a note on the record to say he has proved it to be inaccurate. I doubt whether the Government would go so far as to say he is entitled to have the information erased. for the kind of reason that I gave in answer to an earlier amendment—that the police for instance, who are concerned very vitally in this, may want to know that Jones is a bad informant because he says Lord Hailsham has criminal associates and may want to leave that on the record. Lord Hailsham should be able, nonetheless—and I can quite see that there is a valid point here—to insist, through the court, on saying that Lord Hailsham has proved this, in court, to be absolute rubbish.

If I may, without commitment again on behalf of the Government, take the matter away and think whether we cannot get that right, I should like to be allowed to do so, and, if I am allowed to do so and if the noble Lord will withdraw his amendment, I think that is the best I can do for this evening.

Lord Mishcon

I am almost sure that this is the final observation I am going to make in regard to tonight's proceedings. I can only say to the noble and learned Lord that his orchestral concert has ended on a most harmonious note and I am grateful to him for it, and, on the basis of it, I beg leave to withdraw my amendment.

Amendment, by leave, withdrawn.

Clause 24 agreed to.

Clause 25 agreed to.

Lord Denham

I think your Lordships may feel that we have reached a satisfactory position in the Bill as far as today is concerned. I beg to move that the House do now resume.

Moved accordingly, and, on Question, Motion agreed to.

House resumed.