§ 3.50 p.m.
§ Consideration on Report resumed.
§ Schedule 1 [The data protection principles]:
§
Lord Elton moved Amendment No. 3:
Page 31, line 39, at end insert (", used or disclosed.")
§ The noble Lord said: My Lords, if I may. I shall, with your agreement, speak to Amendments Nos. 39 and 42 together with Amendment No. 3.
§ Amendment No. 39: Page 23, line 10, after ("not") insert ("used for any purpose other than that for which they are held or").
§ Amendment No. 42: Page 24, line 10, after ("not") insert ("used or").
§ Although the three are in somewhat different form, they all address the same central point and all represent a similar slight tightening up of the controls in the three parts of the Bill. All three amendments can be explained by reference to the distinction that the Bill draws between the purposes for which data are held—that is, the very reason that the user has the data—and the subsidiary uses and the disclosures which may be made of data. This is evident in the second and third principles, which deal separately with holding, use and disclosure, and in the registration requirements for data users under Clause 4. The three amendments relate to three areas of the Bill where it appears desirable to take proper account of the distinction between holding, using and disclosing in order to ensure that there is no loophole in the controls established by the Bill.
§ First, paragraph 1(1) of Part II of Schedule 1 provides that, in considering the first principle and fairness of collection, regard shall be had in particular to whether the source was deceived or misled as to the purposes for which the data are to be held. As your Lordships will appreciate from what I have said, against the background of the Bill as a whole, the reference to the purposes for which the data are to be held may not embrace subsidiary uses or disclosures of the data. But deceiving or misleading a person as to such uses or disclosures can obviously be equally important when considering fairness, and therefore Amendment No. 3 inserts a reference to use or disclosure.
§ A similar point arises on Clauses 31 and 32(4), to which Amendments Nos. 39 and 42 relate. As cast, 24 the exemptions provided in these clauses apply where the data concerned are held only for payroll and accounting purposes under Clause 31 or for preparing statistics or carrying out research under Clause 32(4) and where the data are not disclosed other than as permitted by those clauses. There is at present, however, no express restriction on the subsidiary use which may be made of these data. The amendments will remedy this situation and will make it clear that, in addition to meeting the requirements which I have already mentioned, the data user must ensure that the data are not used for purposes other than payroll and accounting or preparing statistics or carrying out research if he wishes to benefit from the relevant exemptions.
§ These are relatively small amendments, but they represent, I think, a useful extra degree of precision and clarification in the safeguards for the data subject under the various provisions concerned, and I therefore commend them to your Lordships. I beg to move.
§ On Question, amendment agreed to.
§ Lord EltonMy Lords. I was counting on loquacity to give me a moment.
§ Lord Elwyn-JonesMy Lords, discretion is the better part of more than valour.
§
Lord Elton moved Amendment No. 4:
After Clause 3, page 32, line 24, at end insert ("but, in the case of such data as are mentioned in subsection (1A) of that section, this principle shall not be regarded as having been contravened by reason of any inaccuracy in the information there mentioned if the requirements specified in that subsection have been complied with.").
§ The noble Lord said: My Lords, I think it may be for the convenience of the House if, with this amendment, I speak also to Amendments Nos. 13, 22 to 24, 28, 44 and 45.
§
Amendment No. 13: Page 9, line 36, at end insert—
("( ) An enforcement notice in respect of a contravention of the fifth data protection principle may require the data user to take any steps that could be required by an order of the court under section 24(1) or (2) below.").
§
Amendment No. 22: Page 18, line 35, at end insert—
(1A) In the case of data which accurately record information received or obtained by the data user from the data subject or a third party, subsection (1) above does not apply if the following requirements have been complied with—
§ Amendment No. 23: Page 18, line 40, leave out ("Subject to subsection (4) below").
§ Amendment No. 24: Page 19, line 1, leave out subsection (4).
§ Amendment No. 28: Leave out Clause 24 and insert the following new Clause—
§ Rectification and erasure.
§ (24.—(1) Subject to subsection (2) below, if a court is satisfied on the application of a data subject that personal data held by a data user of which the applicant is the subject are inaccurate within the meaning of section 22 above, the court may order the rectification or erasure of the data and of any data held by the data user and containing an expression of opinion which appears to the court to be based on the inaccurate data.
25§ (2) Where data accurately record information received or obtained by the data user from the data subject or a third party—
- (a) no order shall be made under subsection (1) in respect of the data if the requirements mentioned in section 22(1A) above have been complied with; but
- (b) if all or any of those requirements have not been complied with the court may either—
- (i) make an order under subsection (1) above; or
- (ii) make such order as it thinks fit for securing compliance with those requirements, with or without a further order requiring the data to be supplemented by such statement of the true facts relating to the matters dealt with by the data as the court may approve.
§ (3) If a court is satisfied on the application of a data subject—
- (a) that he has suffered damage by reason of the disclosure of personal data, or of access having been obtained to personal data, in circumstances entitling him to compensation under section 23 above; and
- (b) that there is a substantial risk of further disclosure of or access to the data without such authority as is mentioned in that section,
§ Amendment No. 44: Page 30, line 9, leave out ("24(b)") and insert ("24(3)").
§ Amendment No. 45: Page 30, line 12, leave out ("24(a)") and insert ("24(1) and (2)").
§ These amendments result from an undertaking which my noble and learned friend the Lord Chancellor gave to the noble Lord, Lord Mishcon, in Committee when he moved amendments to Clauses 22 and 24. My noble and learned friend said then that he thought that the noble Lord's amendments, which were, I must admit, a good deal simpler than those now before us, raised some valid points and that he would see whether they could be accommodated. The result of that undertaking is this lengthy and complex series of amendments which the noble Lord may have difficulty in recognising as the fruits of the small seed sown by him only a few months ago. His seed clearly fell upon fertile ground and has produced a plant the tendrils of which have spread well beyond the little plot in which it was sown, stretching as far as Clause 10 in one direction and Schedule 1 in the other.
§ The original plot, however, was Clause 22, to which Amendments Nos. 22 to 24 relate. That clause provides the data subject with a right to compensation if he suffers damage as a result of inaccurate data held about him. Clause 22(4), however, provides that, where the data have been received either from the data subject or from a third party and the user has marked them as having been so received, no liability to compensation arises. The noble Lord argued, with some force, that this did not go far enough to protect the data subject who applied for access to the data, discovered they were inaccurate and so informed the data user, who nevertheless retained the disputed data. On reflection, we think that the noble Lord is right. The amendment to Clause 22, from which all these other amendments stem, therefore provides that, where the subject does dispute the accuracy of received data, the data user will only be protected from a claim for compensation if he has marked the data not only to indicate their "received" status, but also to indicate that the subject has disputed their accuracy.
§ Moving on to Clause 24 to which Amendment No. 28 relates, the noble Lord will recall that, in response to another of his amendments, my noble and learned friend said that he thought that, where a subject had satisfied a court that received data were inaccurate, there might well be a case for giving the subject the 26 right to insist, through the court, that the data be amended to include a statement to that effect. On further reflection, however, it appeared that there were a number of different situations which ought to be catered for, and which might call for different responses from the court. What we have done, therefore, is to try to provide the court with sufficiently flexible powers to enable it to respond in the most appropriate way in order to protect the interests of the data subject. This has involved a recasting of Clause 24—hence Amendment No. 28.
§ The new clause provides that, where received data carry an appropriate indication, and, if appropriate, a dispute notice is also shown, the court cannot intervene. Where, however, "received" data are not so marked or where the subject has disputed their accuracy and the user has failed to record the dispute, the court is given the power to do a number of things. It may, for example, order the rectification or the erasure of the data: this is no doubt what it will do in most circumstances. Alternatively, however, it may decide to order that the missing indications should be included in the data or that a statement of the true facts should be included; or it may make both orders: that is, it may order, for example, the inclusion of a "received" status marker along with a statement that the received information has been shown to be inaccurate.
§ I hope that that makes clear to your Lordships the way in which the new Clause 24 is intended to work and explains what lies behind the changes. The remainder of the amendments may, I hope, be disposed of more quickly. The Amendments to Clause 40, which are Amendments Nos. 44 and 45, are of course purely consequential on the recasting of Clause 24. The more significant consequentials are the amendments to Clause 10 and Schedule 1, Amendments Nos. 4 and 13. It is part of the general scheme of the Bill that the registrar's powers should be consistent with those of the court. The amendment to Clause 10 is needed to ensure that, as well as being able to order the rectification of "received" data, the registrar is able, like the court, to order its erasure or the addition of appropriate markers, with or without a corrective statement.
§ This brings us at last to Amendment No. 4 to Schedule 1, which I originally rose to move. The effect of this amendment is to add a further gloss to the interpretation of the fifth data protection principle concerning accuracy, so as to provide that data shall not be regarded as inaccurate if they have been properly marked as "received" and any necessary dispute notice has been included. As a result, the registrar, like the court, is precluded from interfering with properly marked data. Although what we are seeking to do is relatively simple, the means of doing it proved to be rather complex. I hope that I have made them clear and I beg to move.
§ Lord Elwyn-JonesMy Lords, the noble Lord, Lord Elton, has indeed cut a great swathe through a lot of amendments and paid due regard—for which we are grateful—to many of the matters raised by my noble friend Lord Mishcon.The only matter to which I wish to refer expressly at this stage is that Amendment No. 28 is, as the noble Lord will see, subject to an 27 amendment in my name and in that of my noble colleagues, but it may be convenient to discuss that matter when in the fullness of time we arrive at it. Otherwise, in so far as the amendments are by way of concession—if that is the right word—or agreement to what has been raised in different parts of the House, we are grateful.
§ Lord AveburyMy Lords, the noble Lord the Minister obviously has been employing his time to very good effect during the Recess. We warmly welcome what he has done here in the recasting of the clauses, and particularly Clause 24, which was necessary as a result of what had been put to him by the noble Lord, Lord Mishcon, so briefly in Committee. I want to ask him just one question and that is in relation to Clause 24, where the data subject can ask for rectification and erasure; and the noble Lord has described what happens if the data user fails to record the fact that he has received notice from the data subject that data is inaccurate in respect of him although it has been received in that form from a third party or from himself.
I wonder whether Clause 24 as recast prevents the data subject from going, first of all, to the registrar and asking for an enforcement notice to be issued under Clause 10—which allows the registrar, if he is satisfied that there is a contravention of any of the data protection principles, to issue such a notice to the data user.
The noble Lord the Minister has mentioned that what he has done here is to put a gloss on the fifth data protection principle which tells the data subject and user how that is to be interpreted. Presumably it also tells the registrar. Therefore, if the registrar is satisfied that the fifth data protection principle within the meaning now given to it by Clause 24 has been contravened he could issue an enforcement notice. This would be a cheaper and simpler procedure for the data subject who discovers that his correction has not been noted on the file than taking action through the courts. One presumes that that data subject would like, first of all, to go to the registrar and then, only if that is unsuccessful, to use the court procedures laid down in Amendment No. 24. If I am wrong in my recollection of how the system was supposed to work—which, of course, has not been altered by this amendment—I should be grateful if the noble Lord were to correct me.
§ Lord MishconMy Lords, I wonder if the House will accept my apology for not being in my place when the noble Lord the Minister—and I ask him to accept my apology—was good enough, I understand, to refer to me in not too uncomplimentary terms. I am most grateful for the remarks which I know I shall read with pleasure in Hansard tomorrow. The only observation that, with the permission of the House, I want to make now is that there is something which I should rather like to raise on Clause 22 when we come then to his amendment. It is really no more than a question as to the meaning of the clause and the fullness of it. I wonder if the Minister and the House will allow me to refer to that matter when we reach Amendment No. 22.
§ Lord EltonYes, my Lords, I am perfectly content with that. The noble Lord, Lord Mishcon, will find that I was just as friendly to him in his absence as I was to my noble friend Lord Mottistone in his absence. I wonder whether, after the next little break, I shall be saying the same thing again. Finally, I can reassure the noble Lord, Lord Avebury, that the data subject can go to the registrar in the circumstances which he foresees. Therefore, I hope that these amendments achieve in every respect what your Lordships wish, although the noble Lord, Lord Mishcon, and his noble and learned friend Lord Elwyn-Jones wish to discuss the matter when they reach their appropriate places.
§ On Question, amendment agreed to.