Data Protection Bill [H.L.]

HL Deb 24 March 1983 vol 440 cc1236-86

3.34 p.m.

Read a third time.

Lord Elwyn-Jones moved Amendment No. 1: After Clause 3, insert the following new clause:

("General duties of Registrar.

. In addition to the specific duties imposed on him by this Act, the Registrar shall have the following general duties—

1. (a) to promote and facilitate compliance by data users with the data protection principles;
2. (b) to facilitate the exercise by data subjects of their rights under this Act;
3. (c) to advise data users and data subjects on the application of the data protection principles;
4. (d) to promote the benefits to both data users and data subjects flowing from the holding and processing of personal data in compliance with the data protection principles;
5. (e) to investigate complaints of contraventions of the data protection principles, and to make the results of such investigations available to the data users and data subjects concerned.").

The noble and learned Lord said: My Lords, this new clause deals with what we submit is an important omission from the Bill—namely, to prescribe duties on the registrar. It is not intended as a kind of penalty to be imposed on the registrar, but to give him statutory authority to do what he ought to do in fulfilment of the object of the Bill, and indeed what he is expected to do to fulfil his duties under the scheme of the Bill.

The whole competence of this scheme of data protection depends upon, first, the registrar's own abilities, and, secondly, his power to do his duties in regard to securing fulfilment of the principles of data protection. Already certain limited specific duties are laid down in the Bill, but no general duties. We on this side of the House think that it is desirable—indeed, necessary—that the general duties of the registrar should be set out. We propose to do so in the five paragraphs (a) to (e) of the proposed new clause.

The first is: to promote and facilitate compliance by data users with the data protection principles;". The principles are set out very clearly; they come from the convention; they are part of the Bill. But there is no provision requiring the registrar to promote and facilitate compliance with them. The next is: to facilitate the exercise by data subjects of their rights under this Act;". That again seems a desirable thing to be regarded as part of the registrar's duties. Thirdly: to advise data users and data subjects on the application of the data protection principles;". Then: to promote the benefits to both data users and data subjects flowing from the holding and processing of personal data in compliance with the data protection principles;". That is really designed to promote the benefits of computerisation, about which I understand the Government are enthusiastic, provided of course that the principles are complied with. Then finally; to investigate complaints of contraventions of the data protection principles, and to make the results of such investigations available to the data users and data subjects concerned". Silence about these duties in the Bill will not ease the position of the registrar; on the contrary, it will make his difficulties all the greater because he may well be put to the question: "Under what authority are you proposing to do this or that aspect of the duties that are set out in the new clause as proposed?"

I have received from the Consumers' Association a letter in support of this amendment, and I understand that they have themselves written to the Minister asking him to consider this amendment and expressing the hope that it may find favour in his eyes. May I express the same hope. This is a useful amendment; it is a considerable strengthening of the position of the registrar. I beg to move.

Lord Lloyd of Kilgerran

My Lords, as the noble and learned Lord, Lord Elwyn-Jones, has said, there is a lacuna in the Bill, which has been discussed at earlier stages in this House. The lacuna is that there has been a failure to clarify—indeed, to set out—what are the duties of this registrar. To use the happy phrase of the noble and learned Lord, Lord Elwyn-Jones, silence about these duties can only bring confusion and misunderstandings. Therefore, these amendments have the full support of these Benches.

In view of the sympathetic noises that from time to time have issued from the Government in regard to this point, I should have thought there would be little difficulty in the Government being able to accept the majority of the paragraphs of this particular amendment. I support the amendment.

The Parliamentary Under-Secretary of State, Home Office (Lord Elton)

My Lords, I am well aware that the noble Lords opposite are deeply suspicious of the absence from the face of the Bill of a bald statement of the functions which the detail of the Bill quite clearly reveals as proper to the registrar. They feel, and have made it quite clear, that the registrar should have displayed on the wall of his front office, as it were, something like the ten commandments of his trade. They do not trust his commonsense, they do not trust public expectation and they do not trust even the force of the declared will of Parliament, which has the power to dismiss him from office. They will only repose confidence in a statement in one part of the Bill of what is inescapably to be deduced from the whole of the rest of the Bill. I cannot say that I find this asessment either of the intelligence of the registrar or of the force of public opinion—or, indeed, of the power of Parliament—in any way attractive. But that is, of course, a subjective objection to accepting this amendment, and your Lordships will expect something of more practical consequence from me if I am to persuade your Lordships to reject it.

What worries me, therefore, is this. Whenever one creates a duty, one creates a requirement that it shall be performed. The amendment describes its contents as consisting of general duties, but if anyone were to ask the registrar why in an individual instance he was not performing one of them he would find that they were too precisely drawn for him to escape into their generality. Let us look at one of them—the proposed duty in paragraph (e) of the amendment to investigate complaints. In fact, regardless of this amendment, the registrar will investigate complaints. That is a principal purpose for which his office is being created. He will be equipped to investigate complaints. He will have the means to investigate complaints, and he will have the power to rectify them. Why, then, your Lordships may ask—and the noble Lord, Lord Lloyd of Kilgerran, has in effect asked—can he not have a duty to investigate complaints? I will tell your Lordships why. It is because once one prescribes the duty in the statute it becomes mandatory in every instance: anybody—and, indeed, everybody—can require him to fulfil this function in their own case; and, what is more, they can take him to court if he does not. However pressing the need for him to apply his staff and resources in other functions, therefore, this function will be inescapable and he must pursue the trivial complaint, the irrelevant complaint, the complaint which the data user is actually already in the process of rectifying: all must be pursued unless he is to court a writ of mandamus.

That would be absurdly to distort the way in which he discharges the duties we want him to discharge, and ought not to be admitted to the Bill. The same goes for the other requirements brought up to us in paragraphs (a) to (d) of the proposed new clause. For instance, there is the duty to promote and facilitate the compliance by data users with the data protection principles; the duty to facilitate the exercise by data subjects of their rights under the Bill; the duty to advise data users and data subjects on the application of the data protection principles; and the duty to promote the benefits to both users and subjects flowing from the holding and processing of personal data in compliance with data protection principles. They read like a list, perhaps not quite exhaustive but very representative of all that we hope and expect the registrar to achieve. And that is what it ought to be—a list of hopes and expectations. If the expectations are not fulfilled Parliament will very soon wish to know why, and can do so without any amendments at all. But because it is drawn up as a list of duties it is clearly unacceptable.

I can therefore tell the noble Lord, Lord Lloyd of Kilgerran, the noble and learned Lord, Lord Elwyn-Jones, and, indeed, the Consumers' Association, that there is no lacuna in the Bill here. I am sorry, therefore, not to have the satisfaction of asking your Lordships to approve the amendment. It is, I regret, thoroughly unsatisfactory. It can only lead to a distortion of the way in which the registrar discharges the very functions which the amendment itself seeks to promote. It would be harmful to the purposes of the Bill and to the interests of data subjects and data users alike. If it is not withdrawn, I shall have to ask your Lordships to resist it.

Lord Mottistone

My Lords, may I briefly support my noble friend on one point which I believe is also significant? It is my experience that where one has tight terms of reference for anybody, and particularly someone in a new function, one limits him in the areas one has not covered. I should have thought that above everything in this Bill—and we are dealing with a new subject, a new area, on which administration is very much open to change as experience is gained—it is particularly unwise to put ourselves into a position where the registrar might be constrained not to use his initiative in areas because they are not in this list but where experience may show it to be necessary. I should have thought that in addition to the points made by my noble friend on the Front Bench those are factors which the movers of the amendment might well consider before they take any further action.

Lord Mishcon

My Lords, in the language of satire, which is not usually the sign of strength, the noble Lord the Minister talked in terms of these duties being similar to the ten commandments being written outside the registrar's office. When the Almighty issued the Ten Commandments there was no doubt about his right to do so. The difficulty that we are faced with in this connection is that the registrar has not yet been appointed. We have no power, no right and no privilege of seeing him and interviewing him in this House at this moment—I have an idea that the noble and learned Lord the Lord Chancellor is making a witty intervention.

The Lord Chancellor

I apologise, my Lords.

Lord Mishcon

Not a bit, my Lords. The noble and learned Lord has no need to apologise; he lightens the atmosphere of this House so often. I have an idea that he brought in Moses. If he did, I can only say that I believe I am right in pointing out that Moses had no right to break the Ten Commandments and shatter them in pieces. Therefore, no right exists with the noble Lord the Minister to deal with the amendment in the same way as he seeks to deal with it this afternoon.

However, I return to the issue. It is not a question of whether or not the registrar is being told to do things. Indeed, in answer to the noble Lord, Lord Mottistone, these are expressed specifically to be general duties in addition to the special duties given by the Bill. But my point is that one wants to see to it that no lawyers hereafter can do something that your Lordships would not want them to do, which is to challenge the registrar in this highly technical Bill—and it is—in relation to rights and duties of an entirely new nature never before created by our legislature.

We do not want to find that we have passed a Bill which enables lawyers to argue that the registrar is not acting infra vires. That is the real point of this amendment. If on the face of the Bill—and we make no apologies for putting it on the face of the Bill—one specifically says that the registrar has, in addition to his specific duties, these general duties, one is clearly setting out for the benefit of the registrar what he can do and what everybody can then see he can do.

The noble Lord the Minister said that there was already written in the Bill a power to investigate. I have not seen it. If it is there, spelt out in clear terms, and if he interrupts my speech and points out where the clause is before I am seated, I shall apologise to the Minister. I find I am still standing.

Lord Elton

My Lords, I apologise for regarding the question as rhetorical. We debated at length the power of the registrar to have access to information and to go and look for it; actually to inquire and get evidence. That is the sort of power I have in mind.

Lord Mishcon

My Lords, your Lordships have heard that reply delivered with the same amount of courtesy as vagueness. To say that we have been debating the general power and so on is surely not to answer the straight question: Please, where is the power to investigate, which the noble Lord the Minister expressly said was written in this Bill? We cannot be referred to a debate in your Lordships' House. We want to see it in the Bill if that is where the Minister says it is. A message is about to reach him which may enable me to sit down again and the Minister to rise again.

Lord Elton

My Lords, I regret to tell the noble Lord that the power is implicit and not explicit, which is why I cannot give him a line reference.

Lord Mishcon

My Lords, so much is implicit in what the noble Lord says in regard to this Bill and this amendment and so little is explicit that I think your Lordships will be grateful to those, including the Consumer Council, who wish everything to be explicit in this innovation, as I said, in our legislation and in the creation of the registrar. I do not think that I can usefully add anything to this—

Lord Elton

My Lords, since the noble Lord has tempted me, may I a third time intervene to say that, if he will look at Clause 16, what I have in mind are the powers of entry, for instance. It is implicit, in that the powers of entry would not exist if the registrar were not expected to inquire, but it is explicit in that the powers of entry are given under the Bill.

Lord Mishcon

My Lords, this is typical; it is typical of this Bill. If I may say so in all humility, I am scared about what we are doing. There is no question of a Select Committee taking evidence here and all of us trying to become experts on data, computers and so on. Let us look at the very clause that the noble Lord the Minister has referred us to. Your Lordships will be amazed to find that this is the clause which deals with an application being made to a circuit judge in order that the circuit judge may, if he thinks it justified, issue a warrant for search. How in the name of heavens can that be interpreted to be a power of the registrar himself to investigate? This is the ultimate power of the registrar, when he finds that everything else has failed on investigation, he needs some urgent documents, he thinks that he cannot get them and he applies under this clause to a circuit judge. This is not the normal power to investigate. This is what we are faced with on this Bill—I say this with all due deference—vague replies and references to sections which are supposed to say things which, if you look at them, you find they do not say. What we are trying to do is to put down specific duties so that everybody knows where we are and this House knows that it is doing its duty.

Lord Drumalbyn

My Lords, the noble Lord now says "specific duties". I am a total layman in this. Can he say that, whereas in this case a general duty is laid—and all these various general duties—in any particular case that would mean that the registrar would be under a duty to carry that out? Is that what he is saying?

Lord Mishcon

My Lords, in general terms the answer is, Yes. Quite obviously, if flippant applications were made for the use of the powers, the registrar—and one knows this—is quite entitled to say, "I do not think that this comes within my duty because this is a flippant application and I do not intend therefore to carry out my duty in this connection because it is no duty at all". So what we really have is the registrar's right to act. If you cast a general duty upon him in the terms of this amendment, then he knows that he has a right to act and he also knows that in a proper case he has a duty to act.

Where the noble Lord the Minister was absolutely right was in this. If the registrar did not discharge his duty in an appropriate and proper case, then it is absolutely right that he could be made to do so by an order of the court, and this House knows that no order of the court would ever be made unless the court were satisfied that it was reasonable and proper for such an order to be made for the registrar to carry out his duty. There is no answer to this amendment, and I say that with all deference.

Lord Swinfen

My Lords, while I have a certain sympathy with the amendment, I think it is mistaken. The computer, which is really what we are discussing in this Bill, is an extremely new tool. Most of us in this House do not know what it can do or what it will be capable of doing in the future. I feel that this rather roomy jacket that the noble Lords opposite wish the registrar to wear will, as time goes on, become tighter and tighter until it becomes a straitjacket, and, once computers are used for more and more things, will tie the registrar down very considerably rather than give him the leeway that his own common sense should allow him.

Lord Donaldson of Kingsbridge

My Lords, I have listened to this argument with the greatest of interest. To begin with I was rather in favour of the amendment. It seems to me that the noble Lord, Lord Mishcon, has concentrated on paragraph (e), but if we take (a), (b), (c) and (d), it seems to me perfectly obvious that each one of those refers to the job of the man who is put in charge of whatever it is; in this case the registrar. If the Front Bench would remove (a), (b), (c) and (d), which are clearly unnecessary, we could then dispute (e) more easily. I should not mind a little bit being added to (e), but I do really think that the noble Lord who is conducting the Bill has made his case about the other points.

Lord Elwyn-Jones

My Lords, I do not want to pursue the metaphor of clothing in this matter, but I should have thought that to have—what was the phrase used?—a roomy jacket was better than, to coin a phrase, to go naked into the chamber, or whatever it may be the registrar will have to enter. My submission to the House is that the registrar will be far better protected and served in embarking upon his office to have these duties stated in those general terms, as his protection and his shield. That, in my submission, is a far greater source of strength to him than the risk of proceedings being brought for mandatory injunctions or whatever the other proceedings may be.

There is advantage, in spite of the suggestion of the noble Lord, Lord Donaldson of Kingsbridge, in maintaining the generality of paragraphs (a), (b), (c) and (d). One would expect those duties to be carried out, I quite agree, but it seems to us that, unless they are specifically set out in the way that they are in the new clause, the registrar could he frequently faced with the difficult question: "What is your authority for doing what you propose to do? There is neither a statement of your power to do it, nor an expression of your duty to do it in the Bill as it stands". In those circumstances, I take up the challenge of the Minister to seek the views of the House upon this matter.

3.58 p.m.

On Question, Whether the said Amendment (No. 1) shall be agreed to?

Their Lordships divided: Contents, 73; Not-Contents, 100

DIVISION NO. 1
CONTENTS
Airedale, L.	Kilbracken, L.
Amherst, E.	Kilmarnock, L.
Amulree, L.	Leatherland, L.
Ardwick, L.	Listowel, E.
Avebury, L.	Lloyd of Kilgerran, L.
Aylestone, L.	McNair, L.
Banks, L.	Mishcon, L.
Beswick, L.	Molloy, L.
Birk, B.	Nicol, B.
Boston of Faversham, L.	Oram, L.
Brockway, L.	Peart, L.
Bruce of Donington, L.	Perry of Walton, L.
Byers, L.	Phillips, B.
Cledwyn of Penrhos, L.	Pitt of Hampstead, L.
Collison, L.	Ponsonby of Shulbrede, L. [Teller.]
Cooper of Stockton Heath, L.
Craigavon, V.	Prys-Davies, L.
David, B. [Teller.]	Rathcreedan, L.
Diamond, L.	Rea, L.
Elwyn-Jones, L.	Sainsbury, L.
Evans of Claughton, L.	Seear, B.
Ewart-Biggs, B.	Sefton of Garston, L.
Fisher of Rednal, B.	Stedman, B.
Foot, L.	Stewart of Alvechurch, L.
Gaitskell, B.	Stewart of Fulham, L.
Gardiner, L.	Stone, L.
George-Brown, L.	Strabolgi, L.
Gladwyn, L.	Tanlaw, L.
Hanworth, V.	Taylor of Blackburn, L.
Harris of Greenwich, L.	Thurso, V.
Hatch of Lusby, L.	Underhill, L.
Irving of Dartford, L.	Wade, L.
Jacques, L.	Wallace of Coslany, L.
Jeger, B.	Wedderburn of Charlton, L.
Jenkins of Putney, L.	Wells-Pestell, L.
John-Mackie, L.	Wilson of Langside, L.
Kennet, L.	Wootton of Abinger, B.

NOT-CONTENTS
Abinger, L.	Ingrow, L.
Adeane, L.	Killearn, L.
Ailsa, M.	Kinnaird, L.
Avon, E.	Lane-Fox, B.
Bathurst, E.	Lauderdale, E.
Bauer, L.	Long, V.
Belhaven and Stenton, L.	Lucas of Chilworth, L.
Beloff, L.	Lyell, L.
Belstead, L.	McFadzean, L.
Campbell of Alloway, L.	Mackay of Clashfern, L.
Cathcart, E.	Margadale, L.
Cawley, L.	Marley, L.
Cayzer, L.	Massereene and Ferrard, V.
Coleraine, L.	Merrivale, L.
Colwyn, L.	Mersey, V.
Cork and Orrery, E.	Molson, L.
Cottesloe, L,	Mottistone, L.
Craigmyle, L.	Mowbray and Stourton, L.
Craigton, L.	Norfolk, D.
Daventry, V.	Northchurch, B.
Davidson, V.	Northesk, E.
De La Warr, E.	O'Brien of Lothbury, L.
Denham, L. [Teller.]	Orkney, E.
Derwent, L.	Pennock, L.
Donegall, M.	Platt of Writtle, B.
Drumalbyn, L.	Portland, D.
Duncan-Sandys, L.	Rankeillour, L.
Ellenborough, L.	St. Davids, V.
Elliot of Harwood, B.	Saltoun, Ly.
Elton, L.	Sandford, L.
Erne, E.	Selkirk, E.
Fortescue, E.	Sempill, Ly.
Fraser of Kilmorack, L.	Skelmersdale, L.
Gainford, L.	Stamp, L.
Garner, L.	Strathclyde, L.
Glasgow, E.	Strathspey, L.
Glenarthur, L.	Sudeley, L.
Glenkinglas, L.	Suffield, L.
Gormanston, V.	Swinfen, L.
Gridley, L.	Swinton, E. [Teller.]
Hailsham of Saint Marylebone, L.	Terrington, L.
	Torrington, V.
Harmar-Nicholls, L.	Trefgarne, L.
Hatherton, L.	Trenchard, V.
Hayter, L.	Trumpington, B.
Henley, L.	Vaux of Harrowden, L.
Hives, L.	Vivian, L.
Holderness, L.	Ward of Witley, V.
Hornsby-Smith, B.	Wise, L.
Hunt of Fawley, L.	Young, B.
Hylton-Foster, B.

Resolved in the negative, and amendment disagreed to accordingly.

4.5 p.m.

Lord Elwyn-Jones moved Amendment No. 2: Before Clause 10, insert the following new clause:

("Furnishing of information by data users.

.—(1) A data user shall furnish to the Registrar, upon his request and within a reasonable time, any information about the holding or processing of personal data by that user which the Registrar may reasonably require for the performance of any of his functions under this Act.

(2) If a court is satisfied on the application of the Registrar that any data user has refused, or has failed within a reasonable time, without lawful excuse to furnish to the Registrar any such information so requested, the court may order the data user to comply with that request within a time specified in the order.").

The noble and learned Lord said: My Lords, I beg to move Amendment No. 2. This amendment again, as I submit, seeks to fill a void in the Bill and is intended to strengthen the position of the registrar by giving him power to order a data user to provide him with information. The registrar, for instance, may require information from a person concerned about the holding or processing of personal data by the user and may do so in circumstances which the registrar thinks reasonable to require for the performance of his functions.

The position at present is that under Clauses 10 and 11 the registrar has to be satisfied that there has been contravention of any of the data principles. But unless the registrar has all the information he needs and has power to require the data user to supply him with the information, how can he reach the stage of being satisfied about whether or not there has been contravention?

One might visualise correspondence taking place between the registrar and a user running on the following lines. The registrar might write, "In recent weeks I have received a number of complaints from different individuals claiming that confidential information about them has come into the possession of certain third parties. The complainants have no direct knowlege as to how this came about, but the single factor common to them all is that they gave the information concerned in confidence to you in the first place. I see that you are on my register as a data user who holds personal data of that kind, but there is nothing in the purposes you have registered which would indicate that you disclose it to others. Indeed, your registration particulars specifically say that you do not. I should, therefore, be grateful if you would let me know whether you have in fact disclosed to any third parties any personal data held by you about any of these complainants. I enclose a list of their names to enable you to check this and I look forward to your reply".

As the Bill now stands, would not a reply from the user to the registrar such as follows be a justifiable one? "Thank you for your letter. At some expense I bought a copy of the Data Protection Act. I see from Sections 10 and 11 that you have powers to serve various notices on me but only if you are satisfied that I have contravened some data protection principles. Clearly, you are not so satisfied at the moment, otherwise you would not have written to me. Indeed, the information you give in your letter would not be enough for any reasonable person to be satisfied that I have committed what would, in fact, be a criminal offence. What I cannot find anywhere in the Act is any obligation on me to give you information which would then entitle you to take steps which I might find very inconvenient indeed, nor anything that you can do to me if I do not supply you with the information. I may, of course, have missed something. Will you please tell me if I have?"

That is not an actual piece of correspondence on which I can draw, but it is a perfectly legitimate potential one. Here at any rate is a place in the Bill where, once again, our interest is to strengthen the position of the registrar with these duties imposed upon him, and to enable him to obtain information from data users in such circumstances as I have described.

In the second part of the proposed new clause there is a provision that: If a court is satisfied on the application of the Registrar that any data user has refused, or has failed within a reasonable time, without lawful excuse to furnish to the Registrar any such information so requested, the court may order the data user to comply with that request within a time specified in the order. If that became the law, then, as in the ordinary course of events, one would expect that the court's order would be complied with. Here at any rate is a specific area where the need to give the registrar the power to require the data user to furnish information is not at present provided for in the Bill; it is a necessary power and should be provided. I beg to move.

Lord Elton

My Lords, I agree that it is, of course, essential that the registrar should be able to obtain sufficient information about data users, and computer bureaux, to enable him to perform his functions under the Bill. On that, the noble Lords opposite and I are at one. Indeed, in drawing up the Bill we considered the very point addressed by this amendment: should the registrar be given an explicit power to require users to provide him with information for which he has asked or should he not? After careful deliberation we concluded that there should be no such power and that we should instead ensure that the Bill was so constructed as to allow the registrar to operate effectively without it.

Your Lordships will wish to know why we reached that conclusion. There are, I think, three principal circumstances in which the registrar may wish to obtain information. The first is where he is dealing with an application for registration and he is not altogether happy about the applicant. He may suspect that all is not well, while not knowing enough to satisfy himself that the user is, in fact, likely to contravene any of the principles. So he wants to find out a little more.

But here Clause 7(2)(c) makes the necessary provision. It empowers the registrar to refuse an application where he considers that the information available to him is insufficient to satisfy him that the applicant is unlikely to contravene any of the data protection principles. In this type of circumstance the registrar may ask questions of an applicant and, where the applicant refuses to answer them fully and the registrar is not satisfied that the applicant will not breach the principles, he can reject the application. In those circumstances, the powers of the registrar are clearly already sufficient. The user who refuses to answer the registrar's questions will not get what he wants, which is registration, and without registration he cannot operate. If he does not operate, he poses no threat to the data subject.

The two other situations in which the registrar may wish to obtain information are where—as the noble and learned Lord has suggested may be the case—he suspects that an offence under the Bill has been committed, or where he suspects that a registered person has contravened the data protection principles. Of course, in the vast majority of cases the registrar will simply ask, in the courteous tones of the noble and learned Lord, Lord Elwyn-Jones, for the information and it will be given to him. No power to require will be called for. The question then is: what of the minority who refuse, voluntarily, in the equally courteous tones of the noble and learned Lord, to give the registrar the necessary information?

The answer is that in these circumstances, at the end of the road lie the registrar's entry powers under Clause 16. Where his suspicions of an offence or a contravention of the principles are compounded by a refusal by the user to provide information, he can request access to the user's premises, and if that access is refused, he can ultimately, under Clause 16(1), go to a circuit judge for an entry warrant.

It is our firm view that the combination of these powers and the knowledge that they are available to the registrar at the end of the day will be just as effective in ensuring that the registrar gets the information he wants as would any new clause of the kind proposed by the noble Lords opposite.

I rather gather from the reaction to what I have said among noble Lords opposite that they feel that this is to wave an extreme power which ought not to be waved. But the power is in the position of a dog on a chain in a garden with a notice on the door saying, "Beware of the dog". If people go into the garden willy-nilly and the householder is unable to cure the offence without using the dog, he is doubtless at liberty to use the dog—to unleash it to bark or bite, as the case may be. In this case the existence of the power threatens the ankles, if I may so put it, of the data user who is recalcitrant, and I think will cause him to behave himself.

However, I would just add one other reason why we preferred not to include a specific power to require information in the Bill. We must have regard to the importance of the privilege against self-incrimination. A provision obliging data users to supply information on request to the registrar could sit uncomfortably with that privilege. Once one makes provision for that, much of the supposed value of the new clause is lost, for those who have nothing to fear will be ready to give the information without being required to do so and those who have something to hide will, for the most part, be able to plead self-incrimination and simply sidestep the requirements on them under this amendment. I refer to "lawful excuse" in the amendment, which is where that comes in.

I suppose I should also mention that the new clause is directed solely at data users and, as far as I can see, absolutely ignores persons carrying on computer bureaux. I should have thought that if there is sauce for the data user here, there ought also to be sauce for the person running a computer bureaux, who would be the gander. For those three reasons I think that this is an unsatisfactory amendment.

4.18 p.m.

Lord Mishcon

My Lords, we have wandered in our similes and metaphors from Moses walking up Mount Sinai to get the Ten Commandments, to dogs that are chained in kennels in a way that would horrify the noble Lord who generally occupies the Bench to my left in your Lordships' Chamber. I am really wondering where we are getting. We are not looking upon the data user as being of any canine quality; we are looking upon him as being a respectable citizen who is entitled to look at a Bill and see what his rights and duties are under that Bill.

Everybody admits that prior to registration the sanction is non-registration. But, post registration, the registrar is seeking some information in order to know, if you like, whether a complainant data subject is putting forward a flippant complaint or a genuine complaint and whether, indeed, one of the principles set out in the schedule is being breached. To say that there is no intermediate stage of being able to point to a clause in a Bill where the data user (or it may be that one ought to add the data bureaux as well) is obliged to give that information—no intermediary stage at all—and to be told that a circuit judge is going to have an application in front of him in order that a warrant may be issued to search the premises and see whether there are any documents available which can give this information, is really a nonsense.

Quite apart from the insulting way in which this provision would be exercised if there were no intermediary stage, how can anybody be sure that a search warrant, which can only be for documents and for machines, is going to reveal the information which the registrar wants to have? It is not a question of looking at the minority of citizens. The majority of our citizens reject—and possibly quite rightly so—the interference of bureaucrats, as they think, into the conduct of their business and their private life.

That is why the Inland Revenue have the powers to insist upon answers to questions, and that is why, where Parliament thinks it necessary, somebody has the right to ask for the information, to call for it, and to demand it. This is one of those occasions. When we talk in terms of, "It might be incriminating", are we really saying that a data user should be protected, although he is breaching every one of these principles, because he is not worried about the warrant and it will not reveal anything? To say that he is going to be protected because if he gave the information it might show that he was breaching any one of these principles, and it is Parliament's duty therefore to protect him, is really making a nonsense of all these provisions and the protection of the data subject, and everything else.

There is no cogent reason for refusing this amendment other than the one that the Minister gives which, if he will forgive my saying it—and I am not trying to copy his analogy with the dog—is a very lame dog reason. That is, that there is the right to exercise the sanction of exercising a power which, I repeat, may do the registrar no good, quite apart from the fact that it is a pretty dreadful power to exercise when all the registrar is doing is inquiring in order to get information post-registration. The noble Lord the Minister, if he will forgive my saying so, must do a bit better than that.

Lord Avebury

My Lords, I thought that the policy of the Tory Government was to diminish the powers of officials to enter private premises of businesses or individuals. Yet here is the Minister coming along and telling us that at the first sign of any trouble with a data user or data bureau, the first thing that is to happen is that the registrar will threaten to exercise the powers that have been conferred on him to enter with a search warrant and turn the place upside down looking for documentary evidence of alleged contravention of any one of the data principles. As the noble Lord, Lord Mishcon, has just remarked, it is not going to be an easy matter to go through the whole of the files of a business to discover what may be one minor contravention.

I cannot understand the Minister in his refusal to accept some modest power for the registrar to avoid the much greater sledge hammer of a search warrant and entry on to somebody else's premises. If you take the analogy of the dog which he gave, it is rather as if you said that if somebody comes down the garden path and you think that he has some irregular purpose in mind, you send the Doberman pinscher to bite him immediately, and later you may find that he was only the postman.

The noble Lord is saying that when a complaint is made to the registrar of an alleged violation of one of the data protection principles, the registrar has no mechanism for compelling the person to give him the necessary information to ascertain whether or not that complaint has any validity other than threatening to go in with a warrant. Well, that is absurd. I hope that the noble Lord will have a second thought on this matter.

Lord Elton

My Lords, it may be that the illustration of the dog, which need not be as savage as Lord Avebury's Doberman pinscher, was not a good one. If the noble Lord has cause to send out bills of account to people who owe him money he does not send out a notice saying that he will take them to court if they do not pay. Everybody knows that that will happen if they do not pay a bill. Therefore, the existence of a power to use in the event of a failure to meet an obligation does not seem to me in any way unreasonable when one is saying why the obligation should be met.

Nor is this the instant response. The noble and learned Lord, Lord Elwyn-Jones, read out a courteous letter and a courteous reply, to which a further exchange might follow: "Dear Data User, Thank you for your letter in reply to mine. I am sorry you don't feel able to give me the information I requested. I earnestly entreat you to do so. I have, as you will know, a power under Clause 16 to come and look for it if you don't. This would cause me trouble and expense, and doubtless be inconvenient to you. But I am sure we can arrive at an amicable arrangement. I merely wish to be given the information which will enable me to know whether you have done the thing which it was suggested to me that you have done and which was referred to in my last letter. If you have not, the matter is closed. If you have, I shall ask you not to do it in the future".

He could go on—although I think that the noble Lord, Lord Avebury, would think that this was unduly threatening—to say that if he did not propose to desist in the future then under another clause, I think Clause 10, he would be able to put on him an enforcement notice. This is not pointing a pistol at anybody's head. It is a reasonable request to do something reasonable. If it is unreasonably refused then the registrar must have a power to put it right. The noble Lords have spent much of this afternoon saying that the registrar does not have sufficient powers and they are not sufficiently explicit. It is a pity that when we give him an explicit power they find that also a matter for regret.

Lord Hunt of Fawley

My Lords, as a doctor I would feel very strongly indeed about being forced to give confidential, personal evidence given me by a patient in strict confidence to a registrar. I would go to any lengths to protect that doctor/patient relationship, even if it meant going to prison, It is terribly important that we protect the doctor/patient relationship, otherwise patients will not talk to us and doctors will not make any notes, except perhaps in a shorthand which only they can read.

Lord Elton

My Lords, if the House will permit, it is the purpose of this provision to protect this relationship. In the noble and learned Lord's example, if things were being learnt about patients who were all patients of one doctor which were supposed to be confidential, then the registrar would say that there was a breach of a principle and he wanted to be told how it had happened. His duty is to protect the data subject and not to threaten him.

Lord Elwyn-Jones

My Lords, surely it must be at the basis of this operation that the registrar shall be enabled to obtain the relevant information. What is suggested is that the sledgehammer of seeking an authority from a judge to enter premises, to search the premises for information which ought readily to be available, is grotesque. If ever there was a sledge-hammer being used to crack a nut, there has never been a more clear example.

This invasion of premises on a search warrant is very much a last step remedy by executive authority; and to be called in as the first stage remedy, as proposed by the arguments of the Minister, is grotesque, if it is not embarking upon the absurd. In those circumstances, regretfully I must invite the House to express a view on this matter.

4.29 p.m.

On Question, Whether the said amendment (No. 2) shall be agreed to?

Their Lordships divided: Contents, 69; Not-Contents, 96.

DIVISION NO. 2
CONTENTS
Airedale, L.	Hatch of Lusby, L.
Amulree, L.	Houghton of Sowerby, L.
Ardwick, L.	Irving of Dartford, L.
Avebury, L.	Jacques, L.
Aylestone, L.	Jeger, B.
Banks, L.	Jenkins of Putney, L.
Beswick L.	John-Mackie, L.
Birk, B.	Kennet, L.
Bishopston, L.	Kilbracken, L.
Boston of Faversham, L.	Kilmarnock, L.
Briginshaw, L.	Kings Norton, L.
Broadbridge, L.	Leatherland, L.
Brockway, L.	Listowel, E.
Byers, L.	Lloyd of Kilgerran, L.
Collison, L.	Lovell-Davis, L.
Cooper of Stockton Heath, L.	McNair, L.
Craigavon, V.	Mishcon, L.
Diamond, L.	Nicol, B.
Donaldson of Kingsbridge, L.	O'Brien of Lothbury, L.
Elwyn-Jones, L.	Oram, L.
Ewart-Biggs, B.	Perry of Walton, L.
Fisher of Rednal, B.	Pitt of Hampstead, L.
Foot, L.	Ponsonby of Shulbrede, L. [Teller.]
Gaitskell, B.
Gardiner, L.	Prys-Davies, L.
Hanworth, V.	Rathcreedan, L.

Rea, L.	Taylor of Blackburn, L.
Sainsbury, L.	Thurso, V.
Seear, B.	Underhill, L.
Sefton of Garston, L.	Wallace of Coslany, L. [Teller.]
Stamp, L.
Stedman, B.	Wedderburn of Charlton, L.
Stewart of Alvechurch, B.	Wells-Pestell, L.
Stewart of Fulham, L.	White, B.
Stone, L.	Wootton of Abinger, B.
Tanlaw, L.

NOT-CONTENTS
Abinger, L.	Ingrow, L.
Ailsa, M.	Killearn, L.
Auckland, L.	Kinnaird, L.
Avon, E.	Lane-Fox, B.
Bathurst, E.	Lauderdale, E.
Bauer, L.	Long, V.
Beloff, L.	Lucas of Chilworth, L.
Belstead, L.	Lyell, L.
Bessborough, E.	McFadzean, L.
Campbell of Alloway, L.	Mackay of Clashfern, L.
Cathcart, E.	Mancroft, L.
Cawley, L.	Margadale, L.
Cayzer, L.	Marley, L.
Coleraine, L.	Massereene and Ferrard, V.
Colwyn, L.	Merrivale, L.
Cork and Orrery, E.	Mersey, V.
Cottesloe, L.	Molson, L.
Craigmyle, L.	Morris, L.
Craigton, L.	Mottistone, L.
Cullen of Ashbourne, L.	Mowbray and Stourton, L.
Davidson, V.	Norfolk, D.
De La Warr, E.	Northesk, E.
Denham, L. [Teller.]	Orkney, E.
Derwent, L.	Pennock, L.
Donegall, M.	Platt of Writtle, B.
Drumalbyn, L.	Rankeillour, L.
Ellenborough, L.	Rugby, L.
Elliot of Harwood, B.	St. Davids, V.
Elton, L.	Saltoun, Ly.
Fortescue, E.	Sandford, L.
Fraser of Kilmorack, L.	Selkirk, E.
Gainford, L.	Sempill, Ly.
Glanusk, L.	Skelmersdale, L.
Glasgow, E.	Spens, L.
Glenarthur, L.	Strathclyde, L.
Glenkinglas, L.	Strathspey, L.
Gormanston, V.	Sudeley, L.
Gridley, L.	Suffield, L.
Hailsham of Saint Marylebone, L.	Swinfen, L.
	Swinton, E. [Teller.]
Harvington, L.	Terrington, L.
Hatherton, L.	Torrington, V.
Henley, L.	Trefgarne, V.
Hives, L.	Trumpington, B.
Holderness, L.	Vaux of Harrowden, L.
Hornsby-Smith, B.	Vivian, L.
Hunt of Fawley, L.	Ward of Witley, V.
Hylton-Foster, B.	Young, B.

Resolved in the negative, and amendment disagreed to accordingly.

Clause 16 [Powers of entry etc.]:

4.38 p.m.

Lord Mishcon moved Amendment No. 3:

Page 15, line 11, at end insert— ("(11) Nothing in this section authorises the inspection or seizure of any document or other material in respect of which, or data contained in which, a claim to legal professional privilege could be maintained.").

The noble Lord said: My Lords, it may be remembered that there was an amendment tabled in precisely these terms on Report. We are here dealing with the issue of legal privilege, a privilege which has been honoured by centuries of tradition in our law. Indeed, as the Minister said on Report, it has a relevance in Clause 32(2) of the Bill, where, on the question of access, legal privilege is admitted and is therefore an exception to the question of the right of access. The Minister also referred to the Police and Criminal Evidence Bill, in which, similarly, this right—which is the right and privilege of the client, not of the lawyer—is protected. The noble Lord, Lord Glenarthur, said: We must think carefully of the possible consequences for data subjects of the proposed exclusion, and we must not lose sight of the provisions both in the Police and Criminal Evidence Bill and in Clause 32(2) of the Bill with which we are dealing. For the time being I am pointing to the difficulties and warning against moving hastily before all the implications arc fully thought through. In the circumstances, I hope that the noble Lord"— referring to my noble friend Lord Elystan-Morgan— will not press the amendment but will give us time to continue our consideration. I hope he will be satisfied that we have taken the point fully on board".—(Official Report, 10/3/83; col. 406.] I imagine that the noble Lord the Minister has had time further to consider this matter, and I hope that the consideration has led to a conclusion which is rather more favourable than the conclusion that has resulted from his consideration of the other amendments that we have so far moved. I beg to move.

Lord Elton

My Lords, I am grateful to the noble Lord, Lord Mishcon, for reminding us of this complex point. When my noble friend Lord Glenarthur spoke to a similar amendment on Report he repeated that the Government acknowledged the existence of an important point of principle, and he explained why for the moment we were doubtful about going so far as proposed in the amendment. Our reservation stemmed from a recognition that most instances in which the registrar might seek access to a solicitor's premises—and I cannot believe that they will be at all frequent—would be in investigating suspicions of breaches of the legislation or contraventions of the data protection principles by the solicitor himself as data user. He might, for example, have grounds for suspecting that the solicitor was disclosing data other than as indicated in his registered particulars, or that inadequate security measures were being taken to protect the possibly very sensitive data which he held. In those circumstances, it would clearly be in the interests of the clients of the solicitor concerned that the registrar should make his investigation. The blanket application of a doctrine of legal professional privilege, as proposed in this amendment, would actually reduce the protection available to those who place information about themselves in the hands of their legal advisers.

However, on Report my noble friend also indicated that we conceded that there were circumstances—not dissimilar from those of which the Police and Criminal Evidence Bill takes account—from which it would be right to exclude the registrar. Just as the police are denied the ability, by warrant, to seek access to evidence which may have been placed in the hands of a legal adviser by a suspect, so, it could be argued, should the registrar be prevented from seeing what a data user, whom he might be investigating for a data offence, or a suspected breach of the data protection principles, had said to his legal adviser on those matters. It would clearly be wrong for the registrar to seek to strengthen his own case in respect of a data user by gaining access to what that user had confided to his legal adviser. That, I acknowledge, would be to trespass upon what the noble Lord, Lord Elystan-Morgan, termed on Report as the last bastion of privacy.

Having said that, I must also say that the drafting of an exemption to meet that kind of case is a matter of great complexity. On Report my noble friend indicated some of the considerations to be borne in mind. The difficulty of the matter has proved too great for us to be able to come forward with proposals in time for the final stage of the Bill in your Lordships' House, and I must ask your Lordships to allow us to take action in another place. As the noble Lord, Lord Avebury, pointed out on Report, the amendment would confer on lawyers a very special unnecessary privilege, hugely in excess of anything demanded by the interests of their clients. But we have on board the central issue. It will not be lost sight of in the transition from one House to another, and therefore I hope that the noble Lord will be content to leave it with us. If he really feels that we shall need to be reminded, then his honourable friends in another place can do that, but I do not think that it will be necessary.

Lord Mishcon

My Lords, when the noble Lord the Minister refers to my honourable friends in another place I am sure that he appreciates that this is a nonpolitical amendment, and indeed is sponsored by the Law Society, among others. I was very glad to hear what the noble Lord the Minister said. I can well understand that there are complexities in drafting. In view of his assurance—and I believe that I can correctly define it as an undertaking—I am perfectly happy to beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 25 [Jurisdiction and procedure]:

Lord Mishcon

had given notice of his intention to move Amendment No. 4:

Page 20, line 14, at end insert— ("(3) In any proceedings brought under sections 22, 23 or 24 above any findings by the Registrar shall be admissible in evidence.")

The noble Lord said: My Lords, on the last occasion the noble and learned Lord the Lord Chancellor was good enough to say that he would consider what had been said, and that he would honour me by writing to me. That honour has now been enjoyed; the noble and learned Lord was kind enought to write to me on 22nd March. In his letter—if I may quote him—he stated: I have considered further the evidential value in civil proceedings of the findings of the registrar, but my conclusion is that what I said at the time is substantially correct, namely that if the findings are such that they ought to be admitted in evidence, they may be admitted under the existing law, but if not, not. Clearly a conviction based on a finding of inaccuracy may be admitted under section 11 of the Civil Evidence Act 1968. But what of a finding that is not put to the test in court or which when so tested is rejected? To say that a registrar's decision to issue an enforcement notice for inaccuracy should be admissible in proceedings under clause 22 is a bit like saying that the issue by the police of a notice of intention to prosecute for careless driving should be admissible in civil proceedings for negligence even though the prosecution may have failed or may not have been brought. This is not to deny that evidence which comes into the possession of the registrar (or the police) in one context may not be useful to the plaintiff in another. But there is, I think, no difficulty about the admissibility of such evidence; the general law should suffice". In view of what was stated in the letter—and I am most grateful to the noble and learned Lord—I do not think it very advantageous for me to proceed with the amendment.

[Amendment No. 4 not moved.]

Clause 27 [National security]:

Lord Mishcon had given notice of his intention to move Amendment No. 5: Page 20, line 41, leave out ("required") and insert ("necessary")

The noble Lord said: My Lords, this amendment relates to a matter of semantics, and on the last occasion we went through a merry exercise dealing with the question of whether "required " really means "necessary", and whether "necessary" is not a better word. Again in this instance the noble Lord the Minister has been good enough to write to me. Although, if he will forgive me for saying so, I still think that the word "necessary" is preferable, and that the word "required" is ambiguous—certainly to members of the public—I do not think that this is a proper point for me to press on Third Reading in your Lordships' House. If in another place Members take the view that, for the reasons that we tried to give on the last occasion, the word "necessary" is a better word than "required", the time of that House may be better exercised on such a point than would be the time of this House on Third Reading. Therefore I do not propose to move the amendment. I should add that I have in fact spoken to Amendments Nos. 5 to 8.

[Amendment No. 5 not moved.]

[Amendments Nos. 6 to 8 not moved.]

Lord Mishcon moved Amendment No. 9: Page 21, line 12, after ("that") insert ("the disclosure of ")

The noble Lord said: My Lords, I beg to move Amendment No. 9. In this connection I am trying very hard to improve the draftsmanship of the Government's new clause; and I do so in all humility. As your Lordships will see, the amendment relates to Clause 27(4), which is to be found on page 21 of the Bill. Your Lordships will notice that, if I may say so with respect, the present wording is quite misleading, and I do not think that it fulfils the Government's own purpose. With your Lordships' permission, I shall read the subsection, which is a short one. At present it states: For the purposes of subsection (3) above a certificate signed by a Minister of the Crown certifying that personal data are or have been disclosed for the purpose mentioned in that subsection shall be conclusive evidence of the fact".

If one reads the English logically, that means that the certificate is merely evidence of the fact that the Minister has certified that personal data are or have been disclosed. What the subsection really ought to state—if I may read it with the suggested wording included—is: For the purpose of subsection (3) above a certificate signed by a Minister of the Crown certifying that the disclosure of personal data is or was necessary for the purpose mentioned in that subsection shall be conclusive evidence of that fact". Of course "that fact" is the fact that disclosure was necessary, not that the disclosure has been made, or not made, as the case may be. In those circumstances, I trust that the Government will be gracious enough to thank those who have taken the trouble to amend their own clause only in the hope of making it clearer. I therefore hope that the Minister will think we have achieved a useful purpose.

Lord Elton

My Lords, I should like to begin by thanking noble Lords who, with such assiduity, have given their intellects and time in seeking to amend this Bill at all points, and particularly as the noble Lord, Lord Mishcon, invites me to do so at this point. I regret that my letter to him did not extend to cover this point, also. On looking at this pair of amendments we discover that they have a substantive effect and one that, to our minds, is not desirable. What would happen would be that a person seeking information for national security purposes, in order to allow the holder of the information to qualify for the exemption, would have to show that the disclosure was necessary for the purpose of safeguarding national security. That would require a degree of prescience that would be beyond even those who discharge national security duties.

No one can be absolutely certain until they see the information whether or not its disclosure is necessary for a particular purpose, but they will not see it until it has been disclosed. The data user can only count on the protection of the clause against a charge of improper disclosure if the provision in the clause that disclosure was necessary for the purpose of safeguarding national security is satisfied. The odd (and, I am sure, unintentional) effect of the noble Lord's amendment would therefore seem to be that the user could never know whether disclosure was justified until after the disclosure had been made. In those circumstances, I think that disclosures would be inhibited, there would be what is now termed a "Catch 22" situation, the user would be very reluctant to co-operate and the national interest would suffer.

Lord Mishcon

My Lords, I do not think that Third Reading is meant to be the stage of a Bill where arguments take place about drafting and words. The noble Lord the Minister must forgive me for saying that if I had wanted to do so I could have answered him at some length; but I feel that, having put on record the reason for the amendment, again it may be looked at between now and the time when it goes to another place, and perhaps looked at in another place. In those circumstances, but in no way admitting that this wording is not far better than that now existing, I ask leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 10 not moved.]

Clause 28 [Crime, taxation and immigration control]:

4.54 p.m.

Lord Mishcon moved Amendment No. 11: Page 21, line 28, after ("which") insert ("the Registrar is satisfied that").

The noble Lord said: My Lords, this is a very important amendment. I wonder whether your Lordships will remember the debate which took place in regard to this matter. The exact reference to it is at column 650 of our proceedings of 15th March. There was a debate between the noble Lord the Minister and myself in regard to a very simple matter. We know that we are dealing with a very controversial clause in Clause 28 but everybody now has to take it for granted for the time being that that is the clause in the Bill which deals with the question of exemption of personal data in the cases of the prevention or detection of crime, the apprehension or prosecution of offenders, the assessment or collection of any tax or duty or the control of immigration.

Then the clause goes on to say that personal data held for any of those purposes are exempt from the subject-access provisions in any case—and I am reciting these words slowly on purpose— in which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection".

Who is the judge of whether it is likely to prejudice any of the matters mentioned in this subsection? That was the question that we asked from these Benches last time; because what we wanted to do—and this is the self-same amendment—was to say that the registrar must be satisfied in that connection. The noble Lord the Minister, in dealing with that debate, referred the House (in a way which I know he meant to be helpful but which I could not help thinking was unintentionally misleading) to the provisions of Clause 21(8), where the court has the right in certain circumstances to adjudge upon certain matters. It is useful therefore to refer back to Clause 21(8). Clause 21(8) says this: If a court is satisfied on the application of any person who has made a request under … this section …"— and I am leaving out words which do not matter— the data user in question has failed to comply with the request in contravention of those provisions,"— that is the request for access, and so on— the court may order him to comply with the request; but a court shall not make an order under this subsection if it considers that it would in all the circumstances be unreasonable to do so, whether because of the frequency with which the applicant has made requests to the data user under those provisions or for any other reason".

This is the point that I tried to make last time and about which the noble Lord the Minister could not satisfy me, and I hope that also he could not satisfy your Lordships about it. I am afraid that he has not satisfied me in the courteous letter which he was good enough to send me on this matter. If we leave it like this, the court is in difficulty in deciding whether or not this Bill gives the right to the data user himself to judge (without anybody else having to adjudge upon this matter) that the prejudice exists in regard to any one of those four categories that I have just read out. It is very likely that the data user in this case will be a Ministry. Therefore, the Ministry is presumably to be the judge of whether this is prejudicial, and does not have to satisfy the registrar (unless you have the words that this amendment suggests in the Bill) and when the matter gets to the court, the court is going to be in the difficulty of saying, "Looking at the provisions of this Bill, it looks as though this is purely a matter for the data user to be satisfied about. I am told the data user is satisfied". In those circumstances, the court has no further power.

It is in these circumstances that one has to put into the Bill perfectly clearly who it is—and the noble Lord the Minister admits that there must be some check upon this; otherwise we are merely giving completely arbitrary powers. Somebody outside the data user has to be satisfied about this matter. We suggested the registrar. The noble Lord the Minister, quite apart from his other arguments, felt that the registrar possibly was not a suitable arbiter. It may well be that what he wants to say, on reflection, is that the court should be the arbiter or that somebody else should be the arbiter.

All that I am saying in this amendment on behalf of my noble friends is that there has to be somebody. We have put the registrar there because we thought it was the most convenient, speedy and expedient way of dealing with the short matter of whether the prejudice exists or not. If the Government were to substitute for the registrar some other independent authority, then my noble friends and I would not complain. But to leave it as it is is to leave a vacuum which a court may find it difficult to deal with, and indeed may find it much worse than that—easy to deal with by saying that it has no power over this matter at all.

If the noble Lord the Minister, with his usual charm, says that it is obvious that the court has the rights and that everything to him is (if I may say so without being disrespectful) so obvious, I wish it were so obvious to Members of your Lordships' House and I wish it would be so obvious to judges in our courts and to the registrar, whoever he may be. If he says it is obvious that there must be somebody who can judge this and that there must be some sort of appellate procedure, I ask him also to deal with this question. If it is so obvious that it is the courts; if it is so obvious that it is the registrar; if it is so obvious that it is some other authority, what is the harm in spelling it out in the Bill with clarity instead of leaving it an ambiguous mess? I beg to move.

Lord Mottistone

My Lords, I entirely support the amendment as described by the noble Lord, Lord Mishcon. It seems to me that it is consonant with my original amendment at Committee stage which sought to place some sort of checking authority upon officials handling this information and which, at Report stage, I narrowed to consider just those that are covered by Clause 27. I have withdrawn my opposition to safeguarding us against hidden manipulation under Clause 27, because I see that it is very difficult to put that into effect. But—here I am heartened by the fact that the noble Lord, Lord Mishcon, says he is quite open as to who should do this function—I believe most strongly that officials, however well meaning, however competent, however determined to serve their country they are, are not able properly to discipline themselves if there are no other means by which they should be disciplined.

I believe also that in this area of data, this is, if anything, more important than it is with written records, because written records have their own limitations. There is a limit to how much one can write out with a typewriter, even with modern equipment. But in the data world the possibility of burgeoning information and of not complying with those parts of the data principles which require one to dispose of information that one does not need—to paraphrase it—will potentially mean, if there is not a check, that this could multiply, and, what is worse, could be cross-connected so readily, much more readily than written records. I implore my noble friend on the Front Bench to listen with great care to the case for this amendment, even if he does not like the actual wording. I hope that before the Bill leaves Parliament there will be something in it which reflects the thought behind this amendment.

Lord Lloyd of Kilgerran

My Lords, I support the appeal that has been made to the Government that in the context of this very controversial clause clarification as to who is to be satisfied should be introduced. I strongly support the amendment on the grounds that Lord Mishcon has explained so clearly.

Lord Elton

My Lords, if it really appears that everything is so obvious to me, I am a great deal cleverer than I thought I was. I have found this a very difficult Bill to master and I had hoped that by tackling those difficulties in public I had helped your Lordships a little towards understanding it. I must rehearse again for the benefit of your Lordships arguments that I have already put to the noble Lord, Lord Mishcon, in correspondence. For it is again a matter on which, after consideration of what he said at the last stage, I can find no defect in the Bill. I will turn to my noble friend in a moment. I shall first address the noble Lord, Lord Mishcon. The noble Lord has suggested that if the test for exemption in Clause 28(1) is left at large—simply that one of the matters listed in that subsection is likely to be prejudiced by giving subject access—then neither the registrar nor the courts will be able effectively to challenge a claim of a data user that prejudice was likely to occur. If that really were the effect of Clause 28(1), as drafted, we would seriously consider amending it. But it is not. It could only be, as the noble Lord suggests, if the provision were cast in terms of the data user being satisfied that prejudice was likely to occur, or it appearing to the data user that prejudice was likely to occur. But no such words are found in the Bill.

Instead it is left at large so that others—including the registrar and the courts—can reach their own view. The noble Lord will perhaps tell me, since when have the courts considered themselves unable to interpret the law? If a data subject, making use of the provision in Clause 21(8) to seek a court order for access, goes to the court to challenge a user's right to refuse access on the grounds of prejudice to a Clause 28(1) matter, there is absolutely no question in our minds: of course, the court will not feel obliged to accept the view of the user or indeed the view of anybody else. It will find its own view. I can find nothing to suggest that the courts will be so easily dissuaded from performing one of the very functions for which they exist.

And what goes for the courts here, goes for the registrar too. If a subject seeks his assistance, claiming that a user is contravening the seventh principle by not providing access, he is scarcely going to be put off by simple assertion by the user that a Clause 28(1) exemption was justified. He will come to his own view on that; and if it differs from that of the user and he orders access, then there will be the tribunal to adjudicate, should the user wish.

I hope the noble Lord will accept that there is no need for the amendment at all. If that were all and the amendment were merely harmless and superfluous, we might be tempted, at least momentarily, to yield to the noble Lord, because it gives him such pleasure to gain his point and we like making this an agreeable process. But as I explained at the last stage, it would further cut directly across the subject's avenue of access to the court. It would, ironically in fact, have just the effect that the noble Lord has, mistakenly I suggest, complained that the clause as drafted has. For it would restrict the courts to one consideration only—the consideration of whether the registrar has satisfied himself that prejudice was likely. That is the harm that the noble Lord asked me to identify that lies in his amendment. If therefore the subject wished to avail himself of Clause 21(8) and challenge the exemption in the courts, he would find that that right was severely curtailed.

My noble friend Lord Mottistone has returned to his suggestion that the registrar should be given some role in supervising the use of data for national security purposes. I am sorry to have to disappoint my noble friend.

Lord Mottistone

My Lords, I did not say "national security". I have given up under that. No, it is under this Clause 28. I want to be sure that all officials are properly supervised. That is the great point.

Lord Elton

My Lords, I presume that that embraces the matter of security.

Lord Mottistone

No, my Lords.

Lord Elton

My Lords, my noble friend has dropped the matter of security.

Lord Mottistone

My Lords, no; I am sorry. I have not dropped the matter of security; I have attempted to make it clear because I thought those of your Lordships who were present at previous stages of this Bill might think that this was so. But, as I wrote to my noble friend, I have accepted the argument on Clause 27 absolutely; but I am only talking about Clause 28. I gained the impression, from what the noble Lord, Lord Mishcon, was saying, that somehow the officials dealing with Clause 28(1) were going to get out from under being supervised. That I strongly think is wrong.

I think there should be some sort of data supervision for people under Clause 28(1), which is what my original amendment at the Committee stage sought to achieve. My noble friend at that stage told me that that was perfectly all right because I would find that under later parts of Clause 28 these people are subject to supervision. I was alerted when I heard what the noble Lord, Lord Mishcon, was saying. He may have been mistaken, but if I am mistaken I apologise to your Lordships. The fact is that we really must not have officials able to act without any sort of supervision in the data area. I accept that, in the special circumstances of Clause 27, I have reluctantly to bow to the fact that they need this for national security purposes. But in this area I do not think they do, and I do not think they should.

Lord Elton

My Lords, I have, therefore, to give the same answer to my noble friend as I gave to the noble Lord, Lord Mishcon: that the courts are the guardians of the liberties of this country and, if there is a misuse of powers, it is to the courts that the person against whom they are misused must look for protection. I hope my noble friend can accept that. It is a matter which we have looked at at some length and I am satisfied that that is the right answer.

Lord Mishcon

My Lords, it is a weak answer, it is an inconclusive answer and, were it not for the fact that the Minister was so charming, I would say that it was a very wrong answer. He should not have made that answer and I say that for this reason. If the House is frankly to deal with this matter, it must be satisfied—and the noble Lord, Lord Mottistone, interpreted my remarks absolutely correctly—that we have excepted security here and are now on the entirely different matters of the four categories in Clause 28. Somebody cannot just say, "I take the view that one of these items will be prejudiced", and that will be the end of the matter and the data subject will have no rights at all. Somebody has to supervise it.

I am even going so far in my argument as to concede that the data subject has to go to the courts in order to get his rights, which is not an easy matter for a data subject to do. But I am taking that for granted for a moment. I have looked at Clause 21(8) and I say to the House in all humility that, on the face of it, it does not give the court the power to go behind the opinion of the data user, as to whether or not matters are being prejudiced. This is where I inferred that it was not a complete answer and, as I said earlier, if the Minister were not so charming I would say that it was a very wrong answer to give to the House.

I would have expected the Minister to say, "What we are going to do is this. There appears to be some doubt about it, so why should we not make the statute clear, so that it is not just lawyers who can understand it, with inferred right and so on? Everybody should understand it. What we are going to concede is this. In Clause 21(8), which deals with the court's rights in the matter we will spell out that the court has the right to look into the question of prejudice under Clause 28, and see whether it was a genuine plea that was made by the Government department or whoever was concerned." If the noble Lord the Minister had said that, I would have sat down with some amount of contentment. I would have known that this proper battle which we are fighting had in some way been won.

What is happening is that the noble Lord the Minister is saying to the House, "This is the power which the court has and that is the answer to the amendment." I am saying to the House that I cannot find it, and the noble Lord the Minister cannot show me the words that give it. If the answer of the noble Lord the Minister is that this power is in Clause 21, why make it an inferred power? Why not make it a power that is clearly written in the Bill? If the noble Lord the Minister will give an undertaking, even at this stage, that it will be written into Clause 21(8), then I, from my point of view, will not persist with this amendment.

Lord Avebury

My Lords, before the Minister replies, may I introduce one further minor consideration which seems to me important in the light of his remarks? It is deliberately left at large that the data user and the registrar may consider their view as to whether personal data comes within the exemptions here. If there is a conflict of opinion between the data user and the registrar as to whether a particular piece of personal data should be exempt from the subject access provisions under Clause 28(1), there is no power for the court to resolve that, because it must be the data subject who makes the application which is refused. That leads on to the process of an application to the court under the provision that the noble Lord quoted earlier, Clause 21(8), and, in the event of a dispute between the data user and the registrar, the registrar himself has no power to ask for a ruling of the court. It is only the data subject who has that right of access to the court.

We are thinking of the situation in which the data subject, while he may have an interest in gaining access to the data, has not the means or the skill to bring an action. For example, he may require the information for the purpose of overcoming an objection to his remaining in the United Kingdom, or to entering the United Kingdom in the first place, and this is not a matter on which he may be prepared to spend a great deal of money, important though it is to him, because he may not have the financial resources. But if the registrar considered that access was being unreasonably withheld, then he would have the financial resources to bring a test case in the courts, but the clause in question, Clause 21(8) does not give him the right to do that.

It seems to me that, in any case, it would be best wherever possible to have this difference of opinion—if such exists—resolved before going to the courts. In other words, first of all, the data subject asks the registrar whether he would look at the particular data and see whether there should be access to it. The registrar would then decide that access had been wrongfully withheld and, if the amendment of the noble Lord, Lord Mishcon, were accepted, he would declare that in that case the subject should have access. After that, if the data user still felt that access ought to be withheld, it could be the subject of court proceedings. But I suggest that, in 99 cases out of 100, after the registrar had made a decision, both the data user and the data subject would accept it and that would avoid court proceedings.

We are in the same area as we were in earlier, where it seems to me that the Government are forcing people to go to an extreme to find out what their rights are, when we have a perfectly good registrar who is part of the Bill, and who would enable us to do this much more cheaply from the point of view of the data subject, and much more satisfactorily from the point of view of the data user, than having to be dragged before the courts every time there is a dispute.

Lord Elton

My Lords, by your Lordships' leave, if I may speak again, the noble Lord, Lord Mishcon, has accused me of being charming. It is kind of him to do so, but he has used that as the reason for not saying that I am wrong. Perhaps it would serve the House if I were less charming and said that I believe the noble Lord is plumb wrong, because the fact is that both the registrar and the court can go behind the user, as the noble Lord puts it, and I really cannot see his difficulty in regard to Clause 28(1). Incidentally, for the record, there have been frequent references to Clause 21(8), but I take it that we are all talking to Clause 28(1). In subsection (1), it is laid down that personal data held for any of a number of reasons, … are exempt from the subject access provisions in any case in which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in this subsection. That likelihood is something which can be acted upon by the data user in his own judgment and appealed against by the data subject. The data subject can go to the court. The court will look at whether or not it was likely to prejudice any of the matters and the court will decide. If it was likely, the data user was right and if it was unlikely the data subject was right and the exemption was illegal. That is what the court is there to try.

As to the other matter which was mentioned by the noble Lord, Lord Avebury, as I said before, what goes for the court goes for the registrar. If a subject seeks his assistance, claiming that a user is contravening the seventh principle by not providing access, the registrar is able to come to his own conclusion as to whether or not an exemption is justified. The registrar will come to that conclusion, and if it differs from that of the user he will serve an access order. Then there will be a tribunal to adjudicate, if the user so wishes. So we stay out of what the noble Lord regards, perhaps rightly, as the complication and expense of the courts.

This is a simple matter. Not many things in this Bill are obvious to me, but this is pretty obvious and I am a little surprised that it is not obvious to the noble Lord who has so much more experience than I of both the courts and the law. The advice I have had is so wide and so convincing and is, to me, so clearly understandable that I can only express my regret if I have not made it clear to your Lordships.

Lord Mishcon

My Lords, before the noble Lord the Minister sits down, since everything is so clear to the Minister I have one simple request to make of him. On an application by a data subject regarding matters where exemption has been claimed under Clause 28(1) because they are likely to prejudice any one of those four categories, could the noble Lord kindly point to the words in the Bill which give to the court the power to examine the question of prejudice? If the noble Lord reads those words to your Lordships I shall sit down and will even hope to be polite enough to apologise for wasting the time of your Lordships. If the noble Lord does not do so but instead talks in terms of inference, then I must ask him, since this must be ambiguous if it is purely an inference, to give the House the reason why the actual words should not plainly be written into the Bill. If the inference is there, what is the harm if the actual words are used so that everybody can know what their rights are and so that the courts can know it, too? I sit down and invite the Minister to do that.

Lord Elton

My Lords, if the House is happy for me to accept that invitation, I will read out subsection (8) of Clause 21: If a court is satisfied on the application of any person who has made a request under the foregoing provisions of this section that the data user in question has failed to comply with the request in contravention of those provisions, the court may order him to comply with the request …".

Lord Mishcon

And with the leave of the House, my Lords, before the noble Lord the Minister sits down, those are the words which I quoted. The words do not bar the argument by any advocate that the court has to be satisfied that the data user—the Ministry, as it most likely will be—has not wrongfully used Clause 28(1) because the department in its wisdom has decided that one of the four categories will be prejudiced. The court is not given the power expressly to look behind that provision. If the noble Lord the Minister says that it is and that this is what he intends it to have, I ask him again: why can it not be expressed so that everybody knows it?

Lord Elton

My Lords, the noble Lord keeps asking me to speak after I have finished speaking. I think this is my fourth intervention and it must be my last. The provision in Clause 28(1) is that there shall be an exemption when there is likelihood of prejudice—not in anyone's mind but an absolute likelihood at large for the court to decide. If the noble Lord goes to Clause 21(8), there is nothing there which says that it should be the department which must be satisfied. The noble Lord wanted to ascribe it to the registrar; he must be satisfied. He now says that the Bill somehow says that it is the department which must be satisfied. It does not. It is not in the Bill. The noble Lord cannot get me to read it out because it is not there. It is prejudicial to his case. I cannot speak again. If I cannot make myself clear at this stage I never shall, so I hope the noble Lord will get on with it and divide the House so that we can see who is right.

5.25 p.m.

On Question, Whether the said amendment (No. 11) shall be agreed to?

Their Lordships divided: Contents, 63; Not-Contents, 95.

DIVISION NO. 3
CONTENTS
Airedale, L.	George-Brown, L.
Avebury, L.	Glanusk, L.
Aylestone, L.	Hanworth, V.
Banks, L.	Harris of Greenwich, L.
Beswick, L.	Hatch of Lusby, L.
Bishopston, L.	Houghton of Sowerby, L.
Boston of Faversham, L.	Irving of Dartford, L.
Briginshaw, L.	Jacques, L.
Brockway, L.	Jeger, B.
Bruce of Donington, L.	John-Mackie, L.
Collison, L.	Kagan, L.
Cooper of Stockton Heath, L.	Kennet, L.
David, B.	Kilmarnock, L.
De La Warr, E.	Kirkhill, L.
Donaldson of Kingsbridge, L.	Leatherland, L.
Elwyn-Jones, L.	Lloyd of Kilgerran, L.
Ewart-Biggs, B.	Lovell-Davis, L.
Fisher of Rednal, B.	Mishcon, L.
Foot, L.	Molloy, L.
Gardiner, L.	Mottistone, L.

Nicol, B.	Stewart of Alvechurch, B.
Ogmore, L.	Stewart of Fulham, L.
Peart, L.	Stone, L.
Perry of Walton, L.	Swinfen, L.
Pitt of Hampstead, L.	Tanlaw, L.
Ponsonby of Shulbrede, L. [Teller.]	Taylor of Blackburn, L.
	Tordoff, L.
Prys-Davies, L.	Underhill, L.
Seear, B.	Wallace of Coslany, L. [Teller.]
Sefton of Garston, L.
Segal, L.	White, B.
Southwell, Bp.	Wootton of Abinger, B.
Stamp, L.

NOT-CONTENTS
Abinger, L.	Killearn, L.
Ailsa, M.	Lane-Fox, B.
Airey of Abingdon, B.	Lauderdale, E.
Ampthill, L.	Lawrence, L.
Avon, E.	Long, V.
Bathurst, E.	Lucas of Chilworth, L.
Bauer, L.	Lyell, L.
Beloff, L.	Mackay of Clashfern, L.
Belstead, L.	Macleod of Borve, B.
Bessborough, E.	Mancroft, L.
Campbell of Alloway, L.	Margadale, L.
Cathcart, E.	Marley, L.
Cork and Orrery, E.	Massereene and Ferrard, V.
Cottesloe, L.	Merrivale, L.
Craigmyle, L.	Mersey, V.
Cullen of Ashbourne, L.	Molson, L.
Daventry, V.	Montagu of Beaulieu, L.
Davidson, V.	Morris, L.
Denham, L. [Teller.]	Mowbray and Stourton, L.
Donegall, M.	Newall, L.
Drumalbyn, L.	Norfolk, D.
Ebbisham, L.	Northesk, E.
Eccles, V.	O'Brien of Lothbury, L.
Ellenborough, L.	Orkney, E.
Elliot of Harwood, B.	Rankeillour, L.
Elton, L.	Romney, E.
Ferrers, E.	St. Aldwyn, E.
Fraser of Kilmorack, L.	St. Davids, V.
Gainford, L.	Selkirk, E.
Glasgow, E.	Sempill, Ly.
Glenarthur, L.	Skelmersdale, L.
Gormanston, V.	Strathclyde, L.
Gridley, L.	Strathspey, L.
Hailsham of Saint Marylebone, L.	Sudeley, L.
	Suffield, L.
Harmar-Nicholls, L.	Swinton, E. [Teller.]
Harvington, L.	Terrington, L.
Hatherton, L.	Teviot, L.
Henley, L.	Teynham, L.
Hives, L.	Torrington, V.
Holderness, L.	Trefgarne, L.
Hornsby-Smith, B.	Trumpington, B.
Hunt of Fawley, L.	Vaux of Harrowden, L.
Hunter of Newington, L.	Vickers, B.
Hylton-Foster, B.	Vivian, L.
Ilchester, E.	Ward of Witley, V.
Ingrow, L.	Westbury, L.
Keith of Castleacre, L.	Young, B.

Resolved in the negative, and amendment disagreed to accordingly.

5.32 p.m.

Lord Avebury moved Amendment No. 12:

Page 21, line 42, at end insert— ("( ) Any personal data disclosed under subsection (2) above shall be reported by the data user making the disclosure to the Registrar together with a description of the data so transferred; and the Registrar shall make a record of such transfer and description. ( ) Any record made in accordance with the foregoing subsection shall be made public after a period of ten years or such lesser period as the Registrar may determine.")

The noble Lord said: My Lords, this amendment deals with the non-disclosure provisions of Clause 28(2) and follows some remarks I made at an earlier stage concerning the representations which a number of us had received from the British Medical Association; and I am sure that the noble Lord is aware of the association's views on Clause 28 as a whole. They do not like the idea that medical information may possibly be disclosed to a third party where it is likely to prejudice any of the matters mentioned in subsection (1).

I know that the noble Lord the Minister has assured us on a number of occasions that no holder of personal data is obliged under these provisions to disclose confidential data—but the inference is that he will do so. It has been said on more than one occasion that, for example, the hospital authority cannot be relied upon to observe the same kind of rule of absolute confidentiality in relation to personal data as a doctor would. Therefore, if a police officer, an immigration officer or a tax inspector goes to the hospital secretary and asks for confidential information relating to the affairs of a patient, then the hospital secretary, looking at Clause 28(2) of this Bill, will see that he is virtually enjoined to give that information to the police officer, immigration officer or tax inspector. I am quite sure that there will be an increase in the number of such disclosures of confidential information from medical files as a result of this particular clause appearing in the Bill.

The British Medical Association, of course, would like to have absolute confidentiality, but that is something we shall certainly not achieve in this House, although the Minister may find that when this Bill goes to another place these provisions will excite a little more wrath from the outside world than they have done so far. Just as with the Police and Criminal Evidence Bill, where people have woken up very late in the day to the inquiry of what the Government are trying to do, I believe that in the case of this Bill, after the British Medical Association and other professional bodies (to say nothing of the right reverend Prelates, who have suddenly got into the act on the Police and Criminal Evidence Bill very late in the day) have started to make representations on these provisions, the same will occur. I believe that the Government will have a much tougher battle in the other place than they have had here.

I am trying to do something very modest, and only by way of a marker; to suggest that where transfers are made to exempt systems under Clause 28(2) then the very least we can ask is that a record should be kept of them by the registrar and that this record should include a description of the data transferred, with disclosure after a specified period of time. I am suggesting that this should be 10 years or such lesser period as the registrar may determine (and, in parenthesis, the British Medical Association did not in their proposals say precisely what the period should be). But clearly, if the information was of a very sensitive nature and it was required in connection with the first of the purposes mentioned in Clause 28(1), concerning the prevention or detection of crime, then after the lapse of a certain number of years there would be no conceivable objection to allowing personal access to that information on the exempt system. If we are not to achieve the deletion of subsection (1)(d), and if we are not to achieve an absolute bar on the transfer of medical data, then this is the very least that we should demand in your Lordships' House. I beg to move.

Lord Elton

My Lords, the noble Lord, Lord Avebury, returns here to a proposal that has been considered in one form or another both in Committee and on Report. It is a proposal for a mechanism whereby exempt disclosures under Clause 28(2) will have to be notified to the registrar. Both in Committee and on Report I drew attention to how difficult a question this was and how important it will be to ensure that, if the Bill were to retain any such provision, its detail should be exactly right. I can best illustrate this difficulty by making brief reference to each of the amendments moved by the noble Lord, Lord Avebury, and his noble friends at earlier stages.

At Committee stage, we were presented by the noble Lord, Lord Wigoder, with an 18-line amendment setting out a proposed new procedure in some detail. It required the person making the disclosure to notify the registrar within four weeks of the extent and nature of the disclosure, and it required the registrar within 22 weeks (making six months in all) to publish details of each disclosure notified to him; and it entitled subjects of such disclosures to have access to the data about them that had been disclosed. In Committee I saw some difficulties and dangers in that approach, and I seem to remember that I was not alone.

On Report, the noble Lord offered a scaled down version of the original amendment, containing only the requirement for disclosures to be notified to the registrar within four weeks. That was a probing amendment, of course, but now we have a further refinement of the approach; a requirement to notify the registrar, and then a requirement (it is not stated on whom, but presumably on the registrar) to publish details of the disclosure after 10 years or any shorter time that the registrar may determine.

These three amendments illustrate some of the main difficulties involved. First, there is the question of the time limits. Should there be one within which disclosures are notified, as in the first two amendments, or should there not, as in the latest amendment? More important, should details of the disclosures be published within a certain period of disclosure? Six months was suggested in the original amendment and it is now up to 10 years in the present amendment. That range in itself demonstrates the problem. How does one decide the shortest period of time after which all danger of prejudicing such matters as criminal investigations has evaporated, and, at the other end of the scale, how do we decide what is the longest period of time that can elapse before the purpose of publication has itself faded out? I think there should be either guidance or at least an indication of where the guidance should be found by the registrar in arriving at that conclusion.

First, we have to consider the question whether he should be required to publish the disclosures at all, and, if so, what would publication involve. What does the "extent and nature" of the disclosure or as now proposed the "description" of the data actually mean? These are not idle questions; I am not trying to throw chaff in your Lordships' eyes. At the heart of them is the question whether the identity of the data subject or subjects should be revealed and published. If a data user were to disclose data about me under Clause 28(2) to the police—thereby, I would hope, eliminating me from an inquiry—I am not sure that I would be altogether happy about publication of the fact. Various conclusions might be drawn. I might be glad to be eliminated from police inquiries in a notorious case, but if the case was very notorious I really would not want it to be generally learnt that I had been included in them in the first place, nor would I welcome the press inquiries that would inevitably follow. Indeed, if the identity of subjects is to be made known, all kinds of practical problems have to be grappled with. And these questions are central to any consideration of the purpose of this mechanism and whether that purpose can be satisfactorily achieved without unacceptable consequences for the registrar, for the bodies needing information for Clause 28 purposes, and even for the data subjects themselves.

This is not an issue that we will lose sight of in the transition from this House to another place. We have it very much under consideration, and I hope that the noble Lord, Lord Avebury, will be as patient as his noble friend was and not press this particular version. I think I ought to add one word of reassurance. There is no inference from Clause 28(2) that a user would or should disclose anything. It is not true, either, to suggest that Clause 28(2) enjoins users to disclose, any more indeed than the General Medical Council's own guidelines, in which they envisage disclosure of medical records in exceptional circumstances, enjoined disclosures either. I do not think the clause embodies the sort of positive threat that some people feel it does. It is a power to disclose, a right, a justification for disclosure; not an injunction to disclose.

Having said that, we do recognise the sensitivities of this issue. We are aware of the anxieties of the public and important bodies to which the noble Lord has referred, and we are considering how these can be met; but I am afraid we cannot meet them in the, hopefully, not very long time between now and when the Bill passes in this House.

Lord Avebury

My Lords, I am grateful to the Minister for that assurance; it is certainly an advance on anything that was said to my noble friend Lord Wigoder or myself at an earlier stage. Perhaps I can get one point across to the Minister before we leave the subject. What people are really concerned about is that these transfers to exempt systems will be taking place as time elapses, and nobody will have any means of monitoring them unless there is some kind of provision as set out in the amendments we have drafted, no doubt defectively. What people will want to know—not just the British Medical Association but, I suggest, the vast majority of patients, and others whose records will be kept—is whether when they go and give information to a hospital they can do so in the certain knowledge that the hospital secretary will not be disclosing it to exempt users for all sorts of other purposes. They will only know that if some record is kept of the disclosures to exempt systems and the numbers of such disclosures that take place over a period of time.

If it was wholly exceptional and there was only one in the whole NHS in 10 years, nobody would be terribly worried. But I suggest quite seriously that if people find it is being done on a large scale the result will be that they will refuse to give information where it is essential for their own good. I am grateful to the noble Lord for taking this on board, and we will look forward to seeing what is done about it in another place. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 31 [Domestic or other limited purposes]:

5.45 p.m.

Lord Mishcon moved Amendment No. 13: Page 22, line 41, after ("held") insert ("(hut not disclosed)").

The noble Lord said: My Lords, with your Lordships' permission, may I speak to Amendments Nos. 13 and 14? This refers to Clause 31 of the Bill, where personal data are held for domestic or other limited purposes. The material subsection is (3), which says: Neither paragraph (a) nor paragraph (b) of subsection (2) above"— which means questions of registration of personal data with clubs and people of that kind— applies to personal data relating to any data subject unless he has been asked by the club or data user whether he objects to the data relating to him being held as mentioned in that paragraph and has not objected". The word there is "held". At the last stage—and I must confess I think it was pretty late at night, just after 9 o'clock—the noble Lord the Minister very graciously pointed out that he was going to move an amendment for which the Government could accept no credit whatever; that the credit was due to my noble and learned friend Lord Elwyn-Jones, and in a humble way to me, for the amendment that we had put and argued. This was graciously accepted, but my noble and learned friend with the caution for which he is so well-known said (at column 689): it would seem that the mischief has now been remedied, but we shall look a little more closely at this group of amendments before the final stage of the Bill. In the meantime, we are grateful to him for having taken up the point and for so generously acknowledging the fons et origo of it".—[Official Report, 15/3/83.] Some reflection has taken place in the meantime, and while the gratitude is still there from these Benches, we ask the Government to have another look at this, as I hope they have done since this amendment was put down, because, unfortunately, they have not met the point.

As the clause now stands, a user may ask me whether I have any objection to his holding personal data about me. If I say that I do not, he is then, quite rightly, entitled to hold them, but also, quite wrongly, to disclose them, when he has never asked me whether I have any objection to that, that being the disclosure. True, the new user does not have the benefit of my consent, but very likely he would not need it, because he may quite lawfully be on the register as a user who holds such data and collects them from other users, even though he is someone to whom I would never have given the data myself.

Therefore, if I can put it shortly, if I am only to be asked whether I object to personal data about me being held, it would be quite misleading if, as a result, I found myself unknowingly consenting not only to their being held but also to their disclosure. Therefore, the amendment the Government were good enough to put down the last time as a result of our representations does not really meet this point, but I believe the amendment we have now put down does. I beg to move.

Lord Swinfen

My Lords, before my noble friend replies, there is a small point that puzzles me, and may puzzle other Members of the House, basically because I am not legally qualified. What in this clause is the meaning of, "family"? How far does it extend?

Lord Elton

My Lords, your Lordships will recall the exchanges we had to which the noble Lord has referred. During that last stage we as a Government accepted that the original casting of Clause 31 had the strange effect of allowing exempt data to be disclosed once the subject's consent had been given to their being held. The person receiving the data could then continue to claim for exemption even though the subject knew nothing about his holding the data.

I explained on Report that the original cast of this clause did not properly reflect our intentions—and there is a magnanimous admission! Our Report stage amendments overcame the problem by ensuring that if a user benefiting from the exemption passes the data on to another user, that new user will not inherit the exemption: for him to benefit he too will have to give subjects the opportunity to object to him holding the data.

In the light of this, I listened very carefully to what the noble Lord said. I understand his anxiety but I wonder whether it is altogether soundly based and whether it is altogether sensibly met by his new amendment. We are dealing here with very limited data—details of members of clubs (and then only of clubs that are unincorporated) and names and addresses. Do we really want to go so far as to say that the exemption is only applicable if the data are never disclosed to anybody? If one model railway club asked another for certain members' addresses to send them details of some special offer—to go on a trip to Didcot, for instance—are we saying that that information can in no circumstances be given (whether or not the members might be desperate to make the trip) short of having to register the club as a data user with the registrar?

As for persons under Clause 32(2)(b) making use of the exemption, what would be the effect there against what I hope I may term the computerised vicar—if the right reverend Prelate does not find the term offensive—whom I used as an example earlier? He could never divulge the address of one parishioner from his computer without losing his exemption. It is an interesting question as to whether in sending out his parish magazine through the post, if he could afford so to do, he was thereby disclosing to the postman the data consisting of names and addresses. If so, the amendment would make the exemption impossible to use.

I do not wish to sound frivolous, and I do not want to sound as if I am quoting from Misleading Cases by A. P. Herbert—and that is always a danger with a layman questioning legislation—but I do think that these amendments go too far. The necessary protection for data subjects does already exist. If they object so strongly to any disclosures whatsoever of their data they can make it a condition of their consent to the holding of the data that there shall be no disclosures. If they consent to a disclosure, the recipient of the disclosure cannot make use of that information without first telling them that he has the data and, if they do not consent to his having it, again they are protected. The amendments approved on Report ensure that when exempt data are disclosed there will be this protection. I hope that the noble Lord will be content with the small but well-intentioned amendment that was put in on Report.

Lord Mishcon

My Lords, I still do not know why the poor data subject in these circumstances should not be told frankly that there is a risk of disclosure, and that his consent should not, in fact, be full. I therefore feel that this amendment is a sensible one. However, again I do not think it is right on Third Reading to persist in an amendment of this kind. The point has been registered and the noble Lord was gracious enough to try to meet it on the last occasion. Perhaps it will be looked at in another place with a more searching eye than we have used on this occasion. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 14 not moved.]

5.55 p.m.

Lord Drumalbyn moved Amendment No. 15:

Page 23, line 6, at end insert— ("( ) Personal data comprising only names and addresses available to any person from published sources are exempt from the provisions of Part 11 of this Act and of sections 21 to 24 above.")

The noble Lord said: My Lords, this amendment is the same as the one I put down on Report and relates solely to personal data comprising only names and addresses drawn from public sources such as the electoral register and telephone and street directories, which are available to anyone. The amendment exempts them from registration under Part II and from Clauses 21 to 24 relating to a data subject. It exempts them from having to give the subject access to personal data held about him and from the duty to have inaccuracies in an entry concerning him rectified or erased. It exempts them also from compensation for damage suffered by reason of any inaccuracy and from compensation for loss, destruction or unauthorised disclosure of data about him.

I hope your Lordships will agree that I need not go over the reasons why I have suggested these exemptions. I explained them in the debate on the amendment on Report, and my purpose in moving the amendment is simply to give my noble friend an opportunity to tell the House the outcome of his further consideration of the amendment. Despite some misgivings on the part of the noble Lord, Lord Mishcon, my noble friend gave the amendment an encouraging reception but said that he would prefer not to accept it at that stage. I hope that he will be able to give it a still more favourable reception on this occasion and accept it. I beg to move.

Lord Donaldson of Kingsbridge

My Lords, I support this amendment in so far as it is a means of legitimising, through the Bill, the business of mail order. It seems to me that mail order is a decent sort of business. It is on the whole well conducted by major companies, although there may be some which do not, and it is an endeavour to find out what people want and then give it to them. That seems to me to be desirable.

As I see it, the mail order business is very much dependent on buying addresses and then addressing people once. If those people reply, they address them a second time in relation to their reply. In other words each time they write round they limit it to those people who are asking for something or expressing an interest. That is absolutely legitimate and I believe that this amendment expresses that fact. That is what I want to see and if the amendment is sound and not inadequate in some way, I shall support it. However, I should say that I speak for myself and not my colleagues.

Lord Swinfen

My Lords, with great respect to the noble Lord opposite, this amendment would not be of great assistance to mail order houses because in order to he effective and keep down their costs they must have more information than just a name and address. There are many names and addresses that one can easily get from telephone books and electoral registers but it is no use writing to try to sell expensive equipment in poor areas. The mail order houses are specialist firms and they do not broadcast generally. They broadcast very selectively. In order to do that, they need far more information than just names and addresses.

Another reason why I do not like this particular amendment is that it is almost impossible to have just a name and address without some other form of information. Names and addresses on their own for most purposes are absolutely useless. Quite honestly, the amendment would not serve any purpose.

Lord Mottistone

My Lords, I do not entirely agree with my noble friend Lord Swinfen in his last remarks. It seems to me that this is another version of the unicorn hunt which we last pursued under Amendment No. 82 on Report, and which my noble friend on the Front Bench told me that he very kindly continues to explore with the CBI and others. I should have thought that it was a way of limiting. Indeed, Amendment No. 82 sought to go further. But, for all the reasons that I shall not repeat now, including the experience on the Continent of running these same systems, one needs to limit the register to a practicable size. I should have thought that my noble friend's amendment was one way of doing that and that it needs to be considered under the general heading of "where is the unicorn?"

Lord Elton

My Lords, I have a great deal of sympathy with my noble friend Lord Mottistone because I also thought that it was a unicorn we were being lured away in pursuit of on Report. Looking more closely at what my noble friend then said and taking other consultations into consideration, we have come to the conclusion that what we are presented with here is not a unicorn but a device to meet a specific problem faced by the direct marketing industry when use needs to be made of electoral and other publicly available lists in order to check that the users' own lists remain up to date. That I think explains to my noble friend Lord Swinfen how the information can be so limited in this regard. I hope that I can set my noble friend's mind at rest and convince him that the problem feared in the use of publicly available lists would never in practice arise.

To take first the electoral registration officer, I think that my noble friends feared that the situation could arise of an electoral registration officer who had failed to register commercial organisations as a potential recipient of his (computerised) electoral lists, so that he would be forced, if he were not to fall foul of the non-disclosure provisions, to refuse to make such disclosures in future. But I do not think a problem could ever arise where the intention is to produce lists which are made generally available to the public—whether, as in the case of the electoral register, because there is a legal requirement to make them publicly available, or simply (like the telephone directory) because the general practice is to publish. Those producing such lists would register "the public" as the potential recipients of the data, and that would cover disclosures to commercial organisations, along with everyone else, who together constitute "the public".

My noble friend's other point was that the registrar might refuse to allow an organisation to make use of data derived from such sources—on the grounds, I presume, that it had not been for such purposes that the data had originally been collected. To refuse to register a purpose, however, the registrar would have to be satisfied that a breach of the data protection principles, or one of them, was likely, and that would mean in effect that he must look at the first principle which provides that the information to be contained in personal data shall be obtained, and the personal data shall be processed, fairly and lawfully. But in the case of publicly available data, I do not believe that the registrar could conclude that this principle had been breached, given the interpretation of the principle provided by the second part of the schedule. He would, indeed, be able to ask himself whether the information in question had been obtained fairly, but in doing so would be required (by subparagraph (1) of Part II of Schedule 1) to consider whether any of those from whom the information was obtained had been deceived or misled as to those purposes. Where we are talking about information that is supplied in the knowledge that it is to be made public, for anyone to make use of it as they please, then it does not appear that the ingredients for deciding that an unfair collection has taken place could be present.

I might add—I think it is worth being complete, and it will only take a moment—that subparagraph (2) of Part II of Schedule 1 introduces a further saving provision so far as material collected under statutory authority is concerned—as in the case of the electoral register. This provides that all information shall: in any event be treated as obtained fairly if it is obtained from a person who (a) is authorised by or under any enactment to supply it; or (b) is required to supply it by or under any enactment". This would thus appear to cover both the obtaining of information from the electoral register by a commercial organisation (since the registration officer is required to make the information available publicly) and to the original collection of the information by the registration officer, from those who are required by law to supply it.

I hope that this explanation of how we see the principles operating in this area will serve to reassure my noble friend—and those who work in the area about which he is concerned—that there are no grounds for the fears which have been expressed. I think that the legitimisation that the noble Lord, Lord Donaldson of Kingsbridge, sought of the eminently respectable and useful trade of mail order businesses is not here required.

Lord Drumalbyn

My Lords, I am grateful for those two explanations of two aspects in this amendment. I am sure that this will help others to understand what is really involved here. I do not think that I could possibly agree with my noble friend Lord Swinfen in regard to direct mail. I am advised that this is being done already but at great cost and with great difficulty. The object of the technology behind this Bill at any rate is to enable these things to economise resources and not to have to spend so much money in preparing the lists. But I believe that they do in fact exist at the present time.

As to what my noble friend said. I agree entirely with his definition of this device which I am proposing. I think that this is exactly what it is intended to achieve. What he did not mention was the fact that this is very close, as I said at the previous stage, to what is already mentioned in subsection (2)(b): personal data held by a data user only for the purpose of distributing, or recording the distribution of, articles to the data subjects and consisting only of their names and addresses". The main difference—and it is very close to what I am suggesting—as I said before, is that under my amendment subsection (3) would not be brought into operation, and therefore it would not be necessary to ask the club or the data user in this case whether he objects to the data relating to him being held as mentioned in that paragraph. That process would then be eliminated. There is no real reason why it should not be. In most of these cases what is done is to send out some form of document, pamphlet or whatever to attract the attention of the recipient and to interest the recipient in becoming a customer.

Incidentally, I should like to ask a matter which has not arisen before, I do not think: What is meant by the word "articles" in subsection (2)(b): personal data held by a data user only for the purpose of distributing, or recording the distribution of, articles to the data subjects"? In particular, I must ask whether a piece of propaganda, for example, would count as an "article", or whether would it be necessary, without my amendment, to send out a communication inquiring whether the prospective data subject is interested in the article, publication or whatever it might be that would be sent afterwards. I think this is an important point. Otherwise, as I say, a very great deal of extra cost would be involved, really to no purpose whatsoever so far as I can see. Here is information that is already available and is already being used for this kind of purpose. There really is no necessity to ask any prospective customer whether he would wish to be placed on the file, so to speak. If there is any necessity to send it out, will the sending of some form of pamphlet be in order, and could it be operated as an inquiry as to whether a person wished to become a data subject or not? This is an important matter in connection with this amendment. As this is not cleared up at the moment, I think that it would be right at the moment to—

Lord Elton

My Lords, if your Lordships will allow me, I can just say that the word "articles" in this context is used in the sense of a thing; not a written piece in a newspaper but almost anything the noble Lord chooses to name, including all the very respectable and tempting things that the noble Lord, Lord Donaldson of Kingsbridge, was referring to in the mail order business. It is an unrestricted phrase.

Lord Donaldson of Kingsbridge

My Lords, it would not include a stockbroker's advice, for example, I imagine.

Lord Elton

My Lords, I can see no reason why it should not include anything from Holy Writ to brochures.

Lord Drumalbyn

My Lords, I feel that we cannot carry the matter any further tonight because my noble friend is obviously not in a position to accept the amendment now. However, I hope very much that it will be carried further in another place. Meanwhile, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 35 [Application to government departments and police]:

6.10 p.m.

Lord Gardiner moved Amendment No. 16:

Page 25, line 20, at end insert— (" (6) Subsection (1) above shall not be treated as affecting in any manner the responsibility of any Minister of the Crown for the acts or omissions of any government department.")

The noble and learned Lord said: My Lords, the sole object of this amendment is to have it made clear in the Bill that the contents of the Bill do not affect the doctrine of ministerial responsibility. When I put forward this amendment at the Report stage of the Bill there was a question which I thought was relevant to it, which I asked, and which was this: Do the Government agree or not agree in the case of a computer like the immigration computer that the question of who the data user is is really a question of law for the construction of the court? The data user as such is defined in Clause 1(5) and it is really a question of law, which could be determined at any time by the court, I suppose, on a construction summons, as to who in such a case is the data user. Is it the Minister, the department or somebody else?

In the course of his very courteous reply the noble Lord, Lord Glenarthur, did not in fact answer that question at all, and therefore at col. 707 of the Official Report for 15th March I said: I am grateful to the noble Lord for what he has said. I am not clear from what he said whether or not he is taking the view that the question: 'who is the registered data user in relation to a Government computer?' is a matter for the construction of the court". The noble Lord did not make any further reply. The noble Lord, Lord Elton, then rose and he did not answer the question either. So if I am not being discourteous I venture to ask the question again now.

The only reply made to the amendment itself was that it was not a necessary amendment because there was nothing in the Bill which would affect the doctrine of ministeral responsibility. No other objection was made to it. It was simply said that it was unnecessary. It is a very bold lawyer who ever is too certain about how a court will construe an Act of Parliament. Indeed, as we know from your Lordships' House when sitting judicially, even the most learned judges do not always agree.

Here is a Bill of a very special kind. Our Parliament, after all, has been passing Acts of Parliament for hundreds and hundreds of years. It is agreed by the Government that this Bill is absolutely unique in providing as it does, because there has never before been a Bill in which a Government department is treated as a person for the purposes of the statute. That was one of the questions to which I did get an answer last time. The answer is quite clear and quite unequivocal: there is no statutory precedent for an Act of Parliament treating a Government department as a person for the purposes of the Act. So here is something entirely new. If it is entirely new and, therefore, probably all the more difficult to say how a court will construe it, what possible real objection can there be to accepting this amendment which is a plain statement that nothing in the Act affects the doctrine of ministerial responsibility?

There was a further example of the peculiarities of the situation when I asked previously who would be responsible—for example, in the case of the immigration computer will it be the Home Secretary or the Home Office? First, I was told that it would be the Minister—the Home Secretary; then six hours later that was changed and I was told that it would be the Home Office. Now I am told that there is no difference in a sense between the two. So I ask again if the Government would reconsider this matter—it is a very short point—and make it plain in the Act by a simple amendment of this kind that the doctrine of ministerial responsibility is not affected and that the Home Office, in effect, means exactly the same as the Home Secretary and does not mean, on the one hand, the civil servants and on the other hand, the Minister. That should be made plain in the Act. I beg to move.

Lord Elton

My Lords, when the noble and learned Lord, Lord Gardiner, moved an identical amendment on Report he said that his aim was to obtain information and he has made clear that that again is his intention and that last time I rather failed to satisfy his wishes. I shall try and do better this time.

The noble and learned Lord has again raised the question of precedents for the treatment of Government departments in Clause 35(1) as persons. He has acknowledged our position and I hope that he is satisfied with our earlier response that this is a new situation demanding a new approach. There is not a precedent for it. The objective of Clause 35(1) is that separate departments are to be treated as separate entities for the purposes of the Bill. I consider that that is the right approach in the interests of protecting data subjects and of achieving comprehensive exposure of disclosures of data between departments. If departments were not separate persons, data would be free to move secretly between different parts of Government entirely untouched by the legislation that we are now preparing. I do not think that that is what is wished.

However, the noble and learned Lord also asked whether we accept his contention that the question of who is a data user is a question of construction for the courts to decide. My answer to that must be, Yes—clearly, any question of interpretation of a statute is a matter for the courts and not for the Government. It is, as the noble and learned Lord just said, a very bold lawyer—and, indeed, a very bold politician—who predicts how a court will construe anything. It goes for politicians as well as for lawyers. As the noble and learned Lord has made clear, we can only act on the assumption that a court will make the construction that we intend. Our assumption has been that departments will apply for registration, and Clause 35(1) makes provision to ensure that in such circumstances central Government will register as a series of separate departments and not simply as one entity, the Crown. Clause 35 (1) would be of no effect if Ministers registered as data users. We believe that the registration of departments as data users would be fully in accord both with the provisions of the Bill and with constitutional practice.

I next come to what is perhaps the noble and learned Lord's principal concern: does the concept of a department as a data user conflict with the doctrine of ministerial responsibility and does it detract from the position of the Minister in charge of his department? At the last stage my noble friend Lord Glenarthur made clear that Clause 35(1) in no way conflicts with minsterial responsibility. It is still the Minister who is politically responsible and accountable for the actions of his department. Indeed, I rather suspect that the noble and learned Lord knows the answer to that question already and is merely seeking assurance and confirmation.

Perhaps the best way I can provide that is by drawing a parallel with constitutional practice in one particular part of the United Kingdom—Northern Ireland—with which I have had some passing acquaintance. There, unlike general practice here, Government departments are bodies corporate; and a common practice ever since those departments were created has been to draft legislation not in terms of Secretaries of State and Ministers but in terms of departments which thus have statutory duties and functions vested in them. But that does not affect in any way the doctrine of ministerial responsibility. Until direct rule, it was always the Minister at the head of the department who was responsible. It was always he who directed and controlled the department as a whole and the individual civil servants who worked there. There is thus no tension between a role in law for a department and the continuing control of that department by its Minister. And I might add that there are also many instances where certain Whitehall departments—the Treasury, for example—rather than their ministerial head, figure as such in legislation.

The noble and learned Lord's fund of knowledge in this sphere dwarfs my own. I hope I have been able to reassure him both that Clause 35(1) represents a sensible approach for data protection purposes in this particular Bill, and that it presents no threat to the doctrine of ministerial responsibility. This clause is not going to change the fact that it is the political heads of departments who are responsible for the departments acts and nor will it affect the Minister/civil servant relationship.

Lord Avebury

My Lords, before the Minister sits down, perhaps he could answer one question. He said very reassuringly that the object in making Government departments register as separate persons under the Bill was to eliminate the possibility that data would be secretly transferred, as he put it, between one and another. Will he give the House a blanket undertaking therefore that no personal data will be transferred between one Government department and another, except as already provided by statute?

Lord Elton

My Lords, I do not know what the noble Lord means by "already". If he is talking about the statute which we are about to pass, I think that I can give that undertaking. The intention of the Bill is not to create secrecy; it is to protect the data subject in a way consistent with the efficiency and liberties of the data user. The distinction between departments was very clearly put into the Bill in order to expose the traffic of any information not specifically exempted between departments.

Lord Gardiner

My Lords, naturally, I shall not pursue the matter here. I am not objecting at all to the unique course which has been taken in all the circumstances of this case in making a Government department a person within the meaning of the Bill. The only question I raised was as to its effect on ministerial responsibility. In effect, we are at one about it. The Government are saying that this does not affect the doctrine of ministerial responsibility. All I am asking is: Can we not say so in one sentence in the Bill? That is all. If it has to be determined by a court one day, it would be of great assistance to the court—would it not?—to know that in some circumstances this unique Act will not affect ministerial responsibility. That is what I want; that is what the Government want. All I am asking is whether it can be put in one sentence to say so. I can only hope that when the Bill goes to another place the Government will reconsider this question. Meanwhile, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 38 [Commencement and transitional provisions]:

6.23 p.m.

Lord Elwyn-Jones moved Amendment No. 17: Page 27, line 9, leave out from ("particulars") to end of line 13.

The noble and learned Lord said: My Lords, at the last gasp of the Report stage, at no less an hour than 22.44 hours, my noble friend Lord Mishcon, moved, as a final amendment, an amendment to leave out from Clause 38 a remarkable provision in subsection (2), which deprives the registrar for a period of two years of the power:

1. "(a) to refuse an application for registration or for the alteration of registered particulars; or
2. (b) to serve an enforcement notice imposing"

the requirements of the notice and compliance with that.

The consequence, as we see it, will be that for two years after the appointed day this Bill will be nothing more than a sham. No compliance with the convention will be possible or will clearly be made. It is true that there will be a register, but the register may disclose on its face the most appalling scandals or, for instance, offer for sale data information or something as objectionable and clearly to be dealt with as that. But neither the registrar nor anyone else will have power to do anything about it for two years.

There may be a case for not being able to refuse registration for some period, but there cannot conceivably be any case for not putting right even the most blatant contraventions of the data protection principles once the appointed day has come. If what is now in Clause 38 remains, there would be a total failure of compliance with the terms of the convention, because the power of the registrar and the power to act to protect the data user would be compulsorily dormant for two years.

When the matter was raised—as I have said, at a very late hour—my noble friend Lord Mishcon, said on 15th March, at column 716 of the Official Report: All I can possibly do, in sheer common sense"— which, if I may say so, is quite a sensible phrase— is to ask him [the Minister] to be good enough between now and Third Reading to consider this point very carefully indeed and either accept the amendment or put down an amendment which satisfies him more than this one does. My noble friend was followed by the noble Lord, Lord Mottistone, who said that he had the same misgivings as my noble friend; and the noble Lord, Lord Mottistone, hoped that the Minister would give careful thought to it with a view to putting it right before the Bill was passed.

He was followed by the noble Lord, Lord Glenarthur—who is always willing to assist us in these matters—who said that he had listened carefully and with considerable interest to the arguments of my noble friend and those in support of the noble Lord, Lord Mottistone, and he was willing to consider the matter further. He then hoped that the noble Lord would withdraw his amendment. That was duly done, and no doubt my noble friend Lord Mishcon and the noble Lord, Lord Mottistone, turned happily to bed. But alas! nothing has been done. The mischief remains in all its nakedness, and it ought not to remain a minute longer. I beg to move.

Lord Elton

My Lords, I am much obliged to the noble and learned Lord for his summary of what occurred when discussing the two-year period during which powers should be compulsorily dormant. After certain things said by my noble friend, certain of his noble friends retired to bed, doubtless also to be compulsorily dormant until the following morning!

In moving his amendment, the noble and learned Lord has expressed some degree of surprise at the fact that the registrar will not come into full exercise of his powers until the second anniversary of the appointed day which starts the transitional period. I, in turn, must confess to being a little surprised that he should have been in any doubt on the point. There has never been any secret made of the fact that time would be needed to bring the scheme fully into effect. The White Paper made perfectly plain that the registration process would take a considerable time—we thought at that stage that two years might be needed for it—and that some users might need a substantial period in which to bring themselves into line with the requirements of the legislation. And you cannot accept the need for that and be prepared to allow the registrar to exercise his notice powers, with immediate effect, from a much earlier date. You cannot have it both ways, and I believe the case for allowing users—in the public and private sectors—time to adjust their systems to the demands of the new era, is one which my noble friend Lord Glenarthur argued convincingly earlier on.

This does not mean that the registrar will be without influence during this interim period. He is indeed likely to use this breathing-space between the initial rush of applications for registration, and the coming into full force of his powers, to survey the broad field of his reponsibilities, and to decide where most effectively he can direct his attention.

The noble Lord, Lord Mishcon, who has often been publicly aghast at the scope of the burdens and the complexity of the duties of the registrar, will I am sure sympathise with his need to survey the field before he embarks fully upon it. This may lead him to look in some detail at the activities of particular users, and though he would be unable to order immediate compliance with the principles, he will be able to direct compliance from the end of the two-year period. I suspect where this happens that users may often decide to come into conformity as soon as they can, even though they would be immune from the registrar's powers until the two-year point.

So we were, in effect, faced at the outset with two alternatives. We could have said that there would be a delay of two years or more after the Bill was passed to allow users to bring their systems up to scratch—and then the Bill would come into effect with a bang. But that would have meant an uncomfortably long gap between the passing of the legislation and anything being seen to happen. People might well have become impatient—particularly abroad.

On the subject of people abroad, I should mention that other countries with experience of this have given themselves quite comfortable periods in which to bring their legislation into full effect. So we chose the other alternative that allowed an early start to registration, but transitional arrangements thereafter that permitted registered users the necessary time to reach a position of compliance with the principles while not facing demands from the registrar for immediate action.

Lord Avebury

My Lords, not immediate. Under Clause 10(1), the registrar, when he issues a notice, may require the data user to take, within such time as is specified in the notice, such steps as are so specified for complying with the principles in question". So, if you did not have this subsection which is now being deleted, the registrar would have power, if he wished to do so, to give the person two years to comply with the principles.

Lord Elton

My Lords, he would have elastic ability, and I suppose he might just rubber-stamp two years on each and meet it that way. It is necessary for Parliament to visualise the way in which legislation is implemented and not to place upon an individual the necessity of deciding when its wishes shall become effective.

I was saying that we chose the alternative which allowed an early start to registration but transitional arrangements thereafter that allowed registered users the necessary time to reach a position of compliance with the principles while not facing demands from the registrar for action, and I used the word "immediate" and the noble Lord intervened to show that it could have a delayed effect. Time is necessary here. Computer systems cannot change overnight. We always have to recognise that. I hope that the noble Lord will too. The approach in the Bill, on reflection, ensures that users are given the necessary time but without delaying the start of the process of constructing a data protection scheme. That is preferable to a lengthy hiatus after Royal Assent with people finding the apparent lack of activity incomprehensible and even quite possibly sinister.

Lord Mottistone

My Lords, I find it encouraging that my noble friend has thought about it, which is what I had in mind when I intervened last time this amendment came forward. I find myself pretty nearly convinced by the argument. There are a lot of Bills where it is not laid down specifically that it is two years. Two years seems an awfully long time. There are quite a lot of Bills where the Minister can introduce certain stages when it seems to be the appropriate moment. Perhaps two years is right, and of course it has the great advantage that everybody knows where they stand, and it would be confusing for data users not to know where they stood.

Supposing everything goes reasonably smoothly, it should be possible to introduce the full provisions earlier. A year would seem a more reasonable time to me. I do not know whether it would not be a good plan if the Government had flexibility for the Secretary of State to introduce the effect of this subsection at a certain time with six months' notice, shall we say, if it appeared sensible to do so. I suggest that to my noble friend, because two years seems a long time before the data subject can get the full benefit of what this Bill is all about.

Lord Elton

My Lords, if the House permits, may I say to my noble friend that of course it is an interesting thesis he has advanced, but it is necessary for users to have some fixed point in time at which they have to be ready? The Government cannot really go on surveying the scene until they see that everybody is up to the starting tape, and then say, "Right, now the thing is going to work". I have the point on board.

Lord Mishcon

My Lords, would the noble Lord the Minister forgive me if I charge him, in all sincerity, with the gravest inconsistency? We have been told in answer to earlier amendments that one really ought not to spell everything out in a Bill. The registrar is an intelligent person, and the registrar, we were told, will know what his duties are without having to be told them in the Bill. The registrar will obviously know what his powers are without them necessarily being spelled out.

Now, extraordinarily enough, the noble Lord the Minister, when it comes to the question of the registrar exercising his powers, ties his hands completely. He tells him that, whatever he may feel like, whatever leisure he happens to have on a Friday—because indeed on that day the applications are not flooding in, or by staying overtime with his staff he has brought everything up to date—even should he encounter the most glaring contravention of the principles to which we are bound by the convention and come across the most terrible case within two years of the appointed day, his hands are tied. The registrar finds that Parliament, instead of allowing him the discretion—which, he will be delighted to read, the noble Lord the Minister was insisting upon giving him in every other provision in the Bill—has used not the words "may at his discretion". He just will not have the power. He will not have the power to serve the enforcement notice to do anything about a contravention, whatever the situation may be.

If the point is that the data user needs time within which to bring his system up to date, can we not trust the registrar to be reasonable about that? Is it really necessary to write into the Bill that the registrar is powerless, in spite of the fact that he has seen that the data user has had every possible reasonable chance of doing things properly and has ignored the registrar's telephone call, or courteous communication, and said. "Well, I am not going to do anything about this. I have another 18 months. Why should I?" That cannot be right.

We suggested last time putting down a period of six months. The noble Lord, Lord Mottistone, says, "Let us have some sort of reasonable period. Two years seems awfully long." But the point of any amendment surely should be either a very short period if this is mandatory, or a discretionary power. Because of the circumstances of the user not having an opportunity of putting his house in order, for a certain period from the appointed day the registrar has the discretion not to use his powers under this Bill.

I repeat as my final sentence that to tie his hands in this way is to do the very thing that the noble Lord the Minister said one should not do, which is to spell out everything for the registrar. We are now spelling out everything against the registrar and his ability to use properly the powers given under this Bill. The clause as it at present stands is a nonsense. I hope that your Lordships, with impartiality, since there is not a scrap of politics in this, will not make your Lordships' House look foolish by allowing this provision to stand—for foolish we shall look in the other place.

Lord Elwyn-Jones

My Lords, I would only wish to add one cautionary word. In my opinion the inclusion of this in the Bill would be a serious breach of the convention. One of the principal purposes of the Bill is to secure compliance with the convention for the benefit of the commerce and industry of this country, and it would be disastrous if on this point the convention was deemed not to have been complied with.

Lord Elton

My Lords, before the noble and learned Lord sits down, I must put that right on the record. As I say, it is what everybody else is doing. It is not a breach of the convention. It is perfectly in order with our international undertakings. I cannot see that data users would be happy at the prospect of possible but not certain deregistration because of non-compliance with the principles when the user had not had time to get things right. There must be a fixed point in time for which large users of data can get themselves ready.

Lord Elwyn-Jones

My Lords, the point that has been stressed is that the registrar should have the discretion to deal with a scandalous situation which could arise in the interim period instead of being prevented by the terms of this clause from acting within his discretion. For that reason, this is important enough a matter, even at this hour, to seek the views of the House.

6.40 p.m.

On Question, Whether the said amendment (No. 1 7) shall be agreed to?

Their Lordships divided: Contents, 46; Not-Contents, 74.

DIVISION NO. 4
CONTENTS
Ailesbury, M.	Kearton, L.
Airedale, L.	Kilmarnock, L.
Avebury, L.	Kings Norton, L.
Beswick, L.	Kirkhill, L.
Bishopston, L.	Lawrence, L.
Boston of Faversham, L.	Lloyd of Kilgerran, L.
Briginshaw, L.	Lovell-Davis, L.
Brockway, L.	McIntosh of Haringey, L.
Collison, L.	Mishcon, L.
Craigavon, V.	Nicol, B.
David, B. [Teller.]	Ogmore, L.
Donaldson of Kingsbridge, L.	Peart, L.
Elwyn-Jones, L.	Perry of Walton, L.
Ewart-Biggs, B.	Pitt of Hampstead, L.
Fisher of Rednal, B.	Ponsonby of Shulbrede, L. [Teller.]
Gardiner, L.
Hanworth, V.	Stewart of Alvechurch, B.
Harris of Greenwich, L.	Stewart of Fulham, L.
Houghton of Sowerby, L.	Stone, L.
Hylton-Foster, B.	Tanlaw, L.
Irving of Dartford, L.	Tordoff, L.
Jeger, B.	Underhill, L.
Jenkins of Putney, L.	Wallace of Coslany, L.
John-Mackie, L.

NOT-CONTENTS
Abinger, L.	Brougham and Vaux, L.
Airey of Abingdon, B.	Carnegy of Lour, B.
Auckland, L.	Cathcart, E.
Avon, E.	Colville of Culross, V.
Bathurst, E.	Cottesloe, L.
Bauer, L.	Cullen of Ashbourne, L.
Beloff, L.	Davidson, V.
Belstead, L.	Denham, L. [Teller.]
Bessborough, E.	Donegall, M.
Birdwood, L.	Elliot of Harwood, B.

Elton, L.	Mottistone, L.
Ferrers, E.	Mowbray and Stourton, L.
Fraser of Kilmorack, L.	Nelson of Stafford, L.
Gardner of Parkes, B.	Newall, L.
Glasgow, E.	Northesk, E.
Glenarthur, L.	Orkney, E.
Greenway, L.	Rankeillour, L.
Hailsham of Saint Marylebone, L.	St. Aldwyn, E.
	St. Davids, V.
Hatherton, L.	Skelmersdale, L.
Henley, L.	Southwell, Bp.
Hives, L.	Strathclyde, L.
Holderness, L.	Strathspey, L.
Hornsby-Smith, B.	Sudeley, L.
Ingrow, L.	Swansea, L.
Killearn, L.	Swinfen, L.
Lane-Fox, B.	Swinton, E. [Teller.]
Lauderdale, E.	Teviot, L.
Long, V.	Teynham, L.
Lucas of Chilworth, L.	Torrington, V.
Lyell, L.	Trefgarne, L.
McAlpine of Moffat, L.	Trumpington, B.
Macleod of Borve, B.	Vaux of Harrowden, L.
Marley, L.	Vickers, B.
Massereene and Ferrard, V.	Vivian, L.
Merrivale, L.	Wakefield of Kendal, L.
Mersey, V.	Ward of Witley, V.
Merris, L.

Resolved in the negative, and amendment disagreed to accordingly.

[Amendment No. 18 not moved.]

An amendment (privilege) made.

6.48 p.m.

Lord Elton: My Lords, I beg to move that the Bill do now pass.

Moved, That the Bill do now pass.—(Lord Elton.)

Viscount Massereene and Ferrard

My Lords, having read the Bill, I can find no reference in it—although it is called the Data Protection Bill—to the protection of data. I am talking about the actual tape which contains the data; there is plenty of protection for data subjects and data users. I appreciate that in raising this point I may be entering an unchartered area of legal liability, but having been present all afternoon and having heard the discussion so far, I am anxious to point out something that I do not think has been raised before, and that is how easy it is for data to he erased from tape. America is rather ahead of us in these—

Lord Elton

My Lords, we have already discussed these matters.

Viscount Massereene and Ferrard

My Lords, consider what has happened in large corporations where damage has been caused to computers carrying data. The majority of them have had to cease trading, having lost all their vital trading records and other details.

I should just like to make a point, but if your Lordships do not want me to go on, I shall sit down. I really believe that the Bill is George Orwell's 1984 come to life. Personally, I deplore it. iIt is the world dominance of the future by the silicon chip. The computer revolution will have far more influence on our society than did the industrial revolution. I shall say no more, other than to repeat that I deplore the necessity for the Bill.

The Lord Chancellor

My Lords, I think that I should point out to my noble friend that if he will look at the eighth principle in Schedule 1, and the related clauses, he will find that his point is answered.

Lord Elton

My Lords, this is indeed a difficult Bill, and I commend my noble friend Lord Massereene and Ferrard for his evening reading the Second Reading speech that I made and the speeches which other noble Lords made. He will find in fact that what we are guarding against is the arrival of George Orwell's world of 1984. But, as I say, this is a difficult Bill. It deals with a subject that is new, complicated, and, on occasions, abstruse. It brings with it a new language of subject access and computer bureaux, of data subjects and data users—and there are few of us who on occasions have not got them muddled. It requires us to bear in mind constantly the needs of a technology with which many of us are far from familiar, and to guard against imposing, in all innocence, burdens that could cripple an industry of increasingly crucial importance to this country. It is also a very wide ranging Bill, with implications for everything from medicine to national security, from tax collection to genealogy, from home computing to statistics and research.

In those circumstances I am particularly grateful to your Lordships for the patience and care with which you have handled the Bill, your individual and collective experience, and the forbearance which you have shown towards me.

Over the recent weeks we have all become familiar with the difficulty and delicacy involved in seeking to look after the interests of both data subject and data user at the same time. A proper balance has not been easy to find. But I think that the Bill leaves your Lordships' House a better measure than it was when I tabled it.

We have improved Clause 16 with additional safeguards for users, by ensuring that the powers shall be exercised only on very senior judicial authority. We have clarified the provisions concerning the information to which the subject has access. We have distinguished clearly between the circumstances in which an enforcement notice and a deregistration notice shall be served on users. We have given valuable emphasis to the role of the registrar in advising individual users and subjects; and we have made many other improvements, not least in the provisions concerning the delicate area of national security.

On a number of points we have not been able to come to a conclusion. This is a quite remarkably complex subject, and it would be rash to hurry into decisions without full consideration of the implications. But we have hunted the unicorn of totally harmless data through much difficult country.

I shall not recapitulate further. I want merely to thank your Lordships for your patience, indulgence, and wisdom. In what could have been a hotly contested field we have but rarely had words that verged anywhere beyond the absolutely considerate, reflective, and polite. Some of those words have been uttered by me, and that I regret. But I thank your Lordships for sending to another place a measure that is better than when I brought it here.

Lord Elwyn-Jones

My Lords, I should be less than gracious if, for my part, I did not thank the Minister for his own courtesy, patience, and forbearance during our long debates. On the other hand, I should be less than frank if I did not indicate our grave disappointment at the obduracy of the Government on so many of the issues which we have raised. In regard to the participation of noble Lords, I would say that there have been efforts from all sides of the House to secure relief from the obduracy, and the unfortunate consequence is that what seems to emerge from the discussions and the shape of the Bill itself is that while there was an intention to comply with the convention, there was also a determination that the compliance should be minimal rather than generous.

We concede that there have been improvements to the Bill on some of the matters that the noble Lord has mentioned. I felt that he had more sympathy in making those concessions than in asserting obduracy; though that may be an error of judgment on my part. But, as things stand, the serious complaints that we had about the Bill remain. Outstandingly, Clause 28 remains as the most grave fault in the Bill. It was intended to be a Bill for the better protection of privacy. By reason of its present form it may well mean—and Clause 28 we think could mean—that highly confidential and sensitive information could be secretly disclosed to the police, the Inland Revenue, the Customs and Excise, and the immigration authorities, without any indication at all on the data protection register that anything of this kind was even possible. I must again remind the House of the comment of the Lindop Committee, which called it a fraud on the public—a grave allegation indeed.

This is no time to recapitulate other matters of complaint. The debate has been conducted with the usual courtesy of this House, but I must draw attention to our grave disappointment that more and better use of the occasion was not made by the Government in order to secure the better protection of the privacy of the subject.

Lord Avebury

My Lords, the noble Lord the Minister is so charming and affable that one occasionally loses sight of the fact that he is kept on a very short rein by the mandarins of Queen Anne's Gate, not least while we have been passing through the stages of this Bill. If I may say so, it is a pity that many noble Lords imagined that the Data Protection Bill required a knowledge of computing, whereas what in fact we have been concerned with throughout most of the debates have been fundamental issues of civil liberty, in which every single Member of your Lordships' House ought to have taken an interest. I believe that the noble Lord has had an easy passage due to the false assumption made by some noble Lords who are not at present in the Chamber that they needed to know something about technology in order to take part in these proceedings.

However, as the noble and learned Lord said, the primary object was to protect the data user, and in this we have been only partially successful, because while we may technically be in a position to sign the convention—which is of course important in itself—all the pleadings that we have made in Committee, on Report and on Third Reading to secure improvements to the iniquitous provisions of Clause 28 have been unavailing. I think that the noble Lord will find that in another place the passage of the Bill will be a little more arduous than it has been here, when as I have said, the professions outside wake up to the fact that many of the matters that we have allowed to pass in the Bill are just as evil and wicked as what the noble Lord has in the Police and Criminal Evidence Bill, which has excited so much antipathy in another place.

So while it has been extremely pleasant to argue with the noble Lord the Minister, as it always is, thanks to his charming and affable manner, I think that his colleagues in another place might not have quite so easy a time. However, we have enjoyed our disputes here. We hope that we have pointed the way to our colleagues in another place to take on the Government with a little more determination.

Lord Mottistone

My Lords, I should like to thank my noble and learned friend who sits on the Woolsack and both of my noble friends on the Front Bench for their great courtesies to me. I should also like to thank them for having accepted so very many amendments—if not in their original form—especially at the Report stage, for passing on various amendments which they have not been able to resolve for consideration in another place, and for continuing the dialogue on several of the amendments with the bodies concerned which are most interested in them.

I would not entirely agree with the noble Lords opposite in their rather gloomy prognostications about certain parts of the Bill. I am concerned, as are they, to make sure that officialdom does not have on us an extra grip, rather than a lesser grip. But I would not go any further than that, and I should have thought that that applies to all officialdom—not just the bits that are picked out in Clause 28(1). So to that extent I would not agree with noble Lords opposite. On the whole in tackling the various stages, the Government have been as considerate and as thoughtful as they could possibly have been and to that degree I believe that we have done a good job on the Bill. I hope that in another place Members find that they do not have to work as hard on the Bill as they might otherwise have had to do, and I trust that it will receive a very good passage before it returns to us again.

7 p.m.

Lord Perry of Walton

My Lords, having listened to most of the debates at all stages of the Bill, I very much regret that I find little reason to change my view that despite the changes made, the Bill is not only difficult, but also essentially bad. The Government have steadfastly maintained that the main objective of the Bill is the protection of the privacy of the individual, but throughout the debates they have resisted almost all attempts so to amend the Bill as to more adequately achieve that objective.

The real objective of the Government in promoting the Bill was to bring domestic legislation into harmony with the European convention so as to facilitate commercial links with Europe, and to do so with the minimum possible change to existing practices of Government departments in handling data. There has been little sign that the protection of the individual is regarded as of sufficient importance to demand such changes. The result is paradoxical in that, at least in some respects, invididuals may be at greater risk if the Bill becomes an Act than they are at present with no legislation at all. People—

Lord Mishcon

My Lords, will the noble Lord give way? It is interesting to hear him at this stage on the Motion that the Bill do now pass. It would have been a great pleasure to have heard him and his noble friends moving their amendments in regard to the Bill and participating in the debates. A voice at this stage is not all that useful.

Lord Perry of Walton

My Lords, may I continue or am I out of order?

Lord Mottistone

My Lords, I would suggest that the noble Lord might draw his comments to a close.

Lord Perry of Walton

My Lords, I find it difficult to do so. In the circumstances, I think that I had better sit down.

On Question, Bill passed, and sent to the Commons.