HL Deb 24 October 1983 vol 444 cc53-71

5.45 p.m.

Consideration on Report resumed.

Lord Mishcon moved Amendment No. 6:

Insert the following new Clause:

Codes of Practice for Data Users.

  1. (".—(1) The Registrar may make and publish advisory Codes of Practice for use by data users in order to give effect to the data protection principles.
  2. (2) Any person or body may make representations to the Registrar that a Code of Practice should be made.
  3. (3) Before any such Code of Practice is made the Registrar shall:—
    1. (i) consult with any person or bodies which appear to him to be affected and thereafter make a draft Code of Practice,
    2. (ii) give public notice of any such draft Code of Practice by inviting objections and representations,
    3. (iii) give consideration to any such objections and representations received by him.")

The noble Lord said: My Lords, by arrangement with my noble and learned friend, I beg to move Amendment No. 6 which stands in the names of the noble Lords, Lord Digby, Lord Donaldson of Kingsbridge, Lord Avebury, and my noble and learned friend Lord Elwyn-Jones. I do not want to harp on words that were used in the last intervention. It almost seems as though, in dealing with an amendment on codes of practice, we ought to have a look at some of our own codes of practice. However, I merely hope that what apparently is a very new mood of emphasis and attitude has, in the wind of change, blown from the Department of Transport also to the Home Office when it comes to the question of consideration of codes of practice.

We have been through what I believe my noble and learned friend said in an earlier amendment was an evolution in regard to the specific amendment he was moving, and we have certainly had an evolution in the amendments moved in regard to recommending to the House that there should be codes of practice. This was of course a suggestion that was also made by the Lindop Committee, and I trust that yet again we shall not be throwing out a recommendation of the Lindop Committee. Where we appear to the Minister to have gone wrong in the past—and certainly to the noble Lord, Lord Mottistone, who intervened so helpfully at the Committee stage; indeed, I might almost quote his speech as being my speech on this occasion, and it might be more effective if I did—in regard to codes of practice was that in our amendments we were giving them legalistic clothing which the Minister felt was wrong. If we gave them no legalistic clothing at all, in his view that would also be wrong because according to the wording of our amendment, it either could or could not be used as evidence when matters came before a tribunal.

We have sufficiently heeded the advice given by the noble Lord the Minister to come forward with an amendment which does not talk about any certificates, which does not talk about its being capable of being used as evidence before a tribunal. It merely seeks to help the industry and the nation when (if I may repeat a phrase I used before when addressing your Lordships on this particularly difficult technological area) it is difficult to see the future from your Lordships' Benches. This amendment merely seeks to make it permissive—not mandatory—for the registrar to make and publish advisory codes of practice. It also deals with the consultations that the registrar should have, and the publication that he ought to make, before these codes of practice are in fact introduced. They are to have no binding legal effect at all.

The Minister may answer this amendment by saying: "Of course the registrar could, if he wanted, introduce codes of practice, or encourage them. He does not have to have statutory backing for that. Of course people could make representations that there should be codes of practice. You do not have to have that incorporated in the statute". But those of us who support this amendment say that there ought to be codes of practice.Various industries need codes of practice for guidance, especially where you have a desire by industry, and a genuine desire, to see that what is meant in this Bill, and the principles set out in the schedule to it, arc in fact guided and advised on by the means of codes. You encourage that sort of thing by saying in an Act of Parliament that these matters are looked upon with favour. They are not made mandatory, but it is hoped that if this procedure is gone through codes of practice will see the light of day.

I end my submission on this amendment by saying that this is a completely non-political amendment which I hope all your Lordships will deal with on a completely non-political basis. The need in regard to this Bill is that we do the best job we can, and do not just adhere to a political mandate when we vote.

Lastly, may I say that during the Committee stage on 19th July the Minister himself, at column 1130 of the Official Report for that date, said this: There is nothing wrong with voluntary codes of practice. There is nothing wrong with the data protection register"— the word is "register" in the Official Report, but it should obviously be "registrar"— assisting or advising in them. What I sought to point out was that this amendment"— and that, I say in parenthesis, is the amendment we were then dealing with— gave the imprimatur of the data protection registrar which might lead to a tribunal's being asked to consider it as an indication that probably no infringement of a principle had taken place". In my respectful submission that criticism does not apply to this amendment. I ask that the House support what Lindop recommended, and an amendment which now deals with all the objections which the Home Office has so far brought forward to the House in order to resist the statutory incorporation of a provision for codes of practice. I beg to move.

Lord Digby

My Lords, here again we have general agreement that there will be codes of practice. The issue is who will formulate them, and what will their status be in law. I had all sides of the Chamber against me—although I am not sure that Lindop was—when at Committee stage I suggested that the codes should supersede their principles. I entirely accept this, and this amendment makes the codes advisory.

Subsection (1) gives the registrar the right, not the duty, to publish these advisory codes, and makes it clear that the codes give effect to the protection principles and do not supersede them. Lindop said: The flexibility which we consider essential should be achieved by codes of practice. They also said: We believe the best way, perhaps the only way, to achieve flexibility would be by codes of practice. I cannot understand why the registrar cannot be given this power by statute. We are all agreed that these codes are going to be needed. Although codes of practice will provide extra work for the registrar at first, they will quite certainly save the registrar and data users much worry and work later.

Lord Avebury

My Lords, with regard to codes of practice I hope that in reply to this amendment the noble Lord the Minister will not do what he did last time, and that is to ask a series of questions which he knew could not be answered because of the rules of Report stage. It was inconvenient to have the noble Lord fire off a barrage of interrogatives, as he did, knowing that none of us who had already spoken was going to have the opportunity of replying, although there was a perfectly good answer, which was that the case that the Minister was constructing was one against the advisory committees as a whole. I hope that he will not construct a case against codes of practice as a whole by asking a similar series of questions on this amendment, because in other fields codes of practice have been extremely useful. I mention as one example the Health and Safety at Work Act, with which the noble Lord is no doubt familiar.

There is not any dispute between us that codes of practice are desirable. On the face of the White Paper we find at paragraph 8: The Government sees some value in codes of practice in this field and expects that some professional bodies, trade associations, and other organisations may wish to prepare such codes as a guide to their members. What happens when a trade association prepares such a code of practice? Is it simply to be left to the members to decide whether it helps them to comply with the data protection principles, or is there going to be any independent evaluation of those codes of practice such as would be bound to occur if the registrar took them on board himself under this amendment?

I suggest that if you are going to have codes of practice at all—and the Minister obviously thinks that there should be some—then it is not enough to let the professional organisations and the trade bodies decide on what these codes of practice should be of their own volition. They should submit them to the experience of the registrar, who, after all, knows more than anybody else (or he will do by the time he has finished) about the way that the data protection principles apply.

The objection has been mentioned—it was raised by the Minister on a previous occasion—that when it came to a case a data user would be able to establish that he had complied with such a code of practice and therefore that he was not in violation of any of the data protection principles. I suggest that the Minister was putting it too strongly. Of course such a code of practice would be adduced as evidence in such a case. There is no doubt of that at all. I think that the noble Lord, Lord Mishcon, would agree that the data user would be bound to say that he had complied with the code of practice. But it certainly would not be the kind of conclusive evidence that the Minister was attempting to suggest on the previous occasion.

If the code of practice was found to be wrong, then of course the registrar would have to amend it as a result of that case. That is precisely what would happen. I suppose it happens from time to time in the case of the Health and Safety at Work Act, and the noble Lord will no doubt be able to inform us of the experience—

Lord Mishcon

And with the Inland Revenue.

Lord Avebury

The noble Lord, Lord Mishcon, is saying that it does in fact happen. I think the codes of practice would not be irrevocable; they could be changed as a result of experience and as a result of cases that were brought before the courts. But they would certainly be of enormous assistance to data users in enabling them to comply in detail with the data protection principles. If that is what the Government think, then let us give the status they would have by putting into the Bill that the registrar shall be responsible as set out here for making and publishing those advisory codes of practice, instead of leaving it as it would be if the White Paper were followed to the letter, that the trade associations, professional bodies and so on produced codes of practice in vacuo.

Lord Mottistone

My Lords, if I might briefly comment before my noble friend answers, I think we have now come, as the noble Lord. Lord Mishcon, was saying, very much closer together. The previous Amendment, No. 14, in Committee stage referred to the committee which we have just voted down for the second time. We now refer to the "registrar". I am intervening because if one looks at Clause 34 one finds in subsections (1) and (2) that we are nearly there. Subsection (1) says: It shall be the duty of the Registrar so to perform his functions …. as to promote the observance of the data protection principles and subsection (2), among others, says—to paraphrase—that he may give advice to any person as to any of the matters within the scope of his functions under the Bill. That is very nearly there. The only things that are not mentioned is the phrase "codes of practice" and the part about consultation in subsection (3) of the proposed new clause.

Knowing that my noble friend the Minister fully accepts that there is a place for voluntary codes of practice, and that he has given authority to the registrar to give advice to anybody on any matter which relates to him. I should have thought, without necessarily accepting this amendment, that it does not take much to narrow the gap down to his being able to give advice on voluntary codes of practice produced by individual bodies; whether they be companies or trade associations, I would not make that point. What we really want to encourage is major data users having codes of practice that they evolve for themselves, on which they seek advice from the registrar on whether the codes are appropriate and comply fully with the data protection principles. That is as far as we need to go. I do not think that this amendment is in part necessary because Clause 34 covers much of what it tries to say. Perhaps at a later stage or in another place we might go the whole way on the substance of what most of us in this House are agreed upon.

Lord Donaldson of Kingsbridge

My Lords, I agree with the noble Lord, Lord Mottistone, that what one wants to see is various branches of the industry getting together, drawing up a code, going to the registrar and asking whether such a code would do. The registrar would then vet it. Everyone has been in favour of that from the word go, and it is clearly the most flexible way of handling anything as complicated and as constantly changing and developing as this industry.

We are asking that approval of this should be put into the Bill. If the noble Lord tells us that that power exists already, we all know that; that will tell us nothing new. We want it in the Bill so that people will realise that it is something of which the Government approve—the Government have said so; so I hope that the amendment in its present rather anodyne form will be approved.

6.4 p.m.

Lord Elton

My Lords, may I start by apologising if I caused offence or confusion by uttering rhetorical questions during the process of discussing the last amendment. They were indeed rhetorical. I thought I had answered them, but possibly not to the satisfaction of noble Lords opposite, though at least they had an answer. I shall try to avoid doing that further. We all know that we are on familiar ground here again. Indeed, my noble friend moved an amendment in Committee on this subject, as did noble Lords opposite. I should like to take this opportunity of acknowledging the great care taken by the movers of the amendment to take note of the objections that I voiced on that occasion.

By now the Government's position is fairly well known. Nevertheless, let me repeat that we are in favour of codes of practice, so let me explain in detail how we see them working in a useful, sensible and flexible way. We foresee users who have interests, requirements and operating procedures broadly in common with one another coming together perhaps under the auspices of a professional society, representative body or trade association, as my noble friend has suggested to produce a code of practice applying to them, as my noble friends Lord Mottistone and Lord Swinfen both said at an earlier stage. If codes are to fit the requirements of users they must he initiated by those users. So codes will be drawn up indicating how users might best be advised to go about their use of data in such a way as to avoid breaching the data protection principles. Codes cannot guarantee against breaches but they can obviously help to avoid them. That is welcome and will reduce the eventual workload on the registrar, as my noble friend Lord Digby said.

Once the codes are drawn up the users might simply promulgate them and indicate what domestic arrangements are to be made to promote compliance with them. Alternatively, some users may wish to get a view on their codes from the registrar. They may ask him his view on whether the code adequately and reasonably covers the ground or should be improved in any way. The data protection registrar could give such advice without prejudice to any future action he might wish to take in respect of a contravention of the principles. The users would then issue their code and if it is a good code it will reduce the occasions when the principles are breached. The users themselves will encourage compliance and may even agree on internal disciplinary measures in the event of contravention. The registrar will continue to supervise observance of the principles. They are the criteria he will use regardless of the details of any code which will be a matter for users in their own internal actions to promote good data protection practice.

The noble Lord, Lord Mishcon, correctly anticipated our reaction to all this, and it is something that Lord Donaldson of Kingsbridge already knows about because he has said so. I have to observe that all of this can happen under the Bill as it now exists. It does not call for any additional statutory expression. Users can produce codes already. Some already have codes in existence. If they so wish they will be at perfect liberty to seek the registrar's views on them.

Noble Lords will remember that the registrar has a duty under Clause 34, as my noble friend Lord Mottistone reminded us, to promote observance of the principles and to disseminate information. He also has a power there, futhermore, to give advice. The registrar is, therefore, specifically equipped to respond positively wherever he can. In other words, the Bill already allows users to draw up sectoral codes of practice, but it does not equate observance of such codes with the observance of the principles that the registrar must supervise.

That, then, is what we want to see; but what would be the position under the Bill as amended by the noble Lords opposite and by my noble friend? Their amendment is clearly designed to meet a number of objections that I have raised in the past, but, as a result, it appears to impose certain restrictions on the registrar without adding usefully to the powers he already has. I criticised my noble friend's earlier proposals in this area because they had the effect of elevating codes of practice above the principles. Noble Lords will recall that the crucial test was to have been not whether a user had complied with the principles, but whether he had complied with the code.

This new amendment cannot be criticised on those grounds. My noble friend and noble Lords opposite propose now that the codes should be merely advisory and should have no legal force whatsoever. That certainly meets my previous objection, but it seens also to bear out my view that there is no need for an amendment to the Bill to achieve this result. If codes of practice are to have legal status, provision needs to be made in the Bill. If they are not, then it does not.

It might be argued that if this is the case, the amendment does no harm. It could be added that stating the obvious does is no bad thing if it encourages the production of the codes of practice which all or us want to see. But I think the amendment may be harmful because it creates expectations which the registrar may be hard put to or, indeed, unable to live up to. In particular, it seems to vest in him either the initiative or a leading indispensable role for getting codes of practice under way and then seeks to place additional restrictions upon him regarding the discharge of that initiative. My noble friend Lord Digby referred to the extra work which would be involved in setting this up.

I should like your Lordships to be mindful of the enormous and rapidly growing number of computers and data users in this country already. The number of groupings that might wish, appropriately, for codes of practice cannot be clearly foreseen now but one thing is certain. It is likely to be extremely large. Another thing is certain. The process of devising a code of practice is going to be long and is going to be complex; and I am not at all sure that placing an arbitrary bottleneck of the process by suggesting in statute that the whole thing ought to be taken on board even without being forced to do it by the registrar, will not have exactly the opposite effect to that which the supporters of this amendment (and the very important and influential bodies which advise them) are seeking.

The day when workable codes of conduct are in effective use could, I fear, be considerably delayed by the process. The amendment is careful to say only that the registrar "may" make codes of practice and not "shall". It can be argued therefore that if the registrar finds that his resources are overstretched at any time and may be better used in other ways, he is under no obligation to spend time drawing up codes of practice. But by specifically drawing attention to codes of practice in the Bill we would be creating expectations and I think, as I said earlier, a bottleneck. By producing the expectation that it is the registrar who is to set about getting groups of users together and initiating the drawing up of codes of practice requiring a certain procedure to be followed, the amendment would discourage from doing so some users who wanted to take a different approach to drawing up codes of practice.

I have little more to say, but, from what I have said already, it will be clear that, while we are in favour of codes of practice, we remain of the view that they are best left outside the Bill. We do not doubt that some users will wish to consult the registrar about advisory codes of practice, and I hope that many of them will. This they can already do under the Bill and the registrar has an actual duty and power in Clause 34 to meet that. May I suggest therefore that to give statutory expression to the role of codes of practice and to how the registrar shall respond to them may work against the best interests of all those concerned? The more we seek in the Bill to dictate particular procedures for codes, the more we risk unnecessarily fettering registrar and data users alike.

We are, of course, aware—and here I respond to the noble Lord, Lord Avebury—of codes of practice that are given legal status under other legislation. There is the Highway Code, for instance. There is the provision for codes under the Health and Safety at Work Act, to which he referred. There are codes allowed for under the Race Relations Act. But none of these offers a direct and satisfactory parallel. None of them envisages separate codes for a great mass of different persons, as would be the case in data protection. The Highway Code applies to all drivers, the code on racial discrimination in employment applies to all employers.

Then, these other codes address rather different and generally more specific issues. It is one thing to draw up a code on the safety standards for equipment or clothing or good practice in advertising job vacancies, but quite another to devise something meaningful to ensure that, in all the myriad circumstances that will occur, data are collected fairly. As we found elsewhere, what may be sensible and reasonable in one place cannot necessarily be transplanted satisfactorily to the field of data protection, which is a very large and very complex one.

In the process of the Report stage of this Bill. I hope to continue revealing a conciliatory and attentive approach to what is said by people on the other side of the House. I am sorry that where, as on this occasion, they are joined by my noble friend on this side of the House, I am unable to be more conciliatory and friendly than I have been.I cannot advise your Lordships to accept the amendment.

Lord McIntosh of Haringey

My Lords, the noble Lord the Minister will not be surprised to learn how much I disagree with what he has just said. But I do not intend to rehearse it. There was one thing,however, which really surprised me. It was when he said that there was a large and rapidly increasing number of computers and data banks. That is undoubtedly true but the question I have to ask is this. Can it be true that the number of codes of practice can exceed the number of computers and data banks? The whole purpose of codes of practice is to reduce the burden upon the registrar of individual computers and data banks having to be reported separately.

I should have thought that this was something which was very akin to Conservative philosophy. I should have thought that the Government would actually wish the various parts of the business community to do this work themselves in advance of full registration and make the life of Government agencies simpler and, therefore, reduce Government bureaucracy and demands on public expenditure. It is that business aspect of codes of practice to which the noble Lord the Minister has not referred and it weakens his argument, I think.

Lord Swinfen

My Lords, I agree with my noble friend that the amount of work that would be required if the registrar was to make the codes of practice would be prohibitive. Would he, however, consider allowing codes of practice produced by data users (who, after all, know where they can be misused) to be authorised or approved in some way by the registrar so that the onus is on the data users to produce codes of practice that then have to be approved by the registrar as fitting in with the data protection principles?

Lord Elton

My Lords, by leave of your Lordships and contrary to normal convention here, because this is Report stage, may I respond to those two points? In answer to the noble Lord, Lord McIntosh of Haringey, I would say that certainly we do not expect one code per machine. That would be nave. We expect as many users of machines as possible to come together to create the minimum number of viable codes. That, I hope, will be the result. But the number of genuses of user is enormous because there is almost no public or private function which is not in the future going to be aided by machines capable of using personal data. Therefore, there are going to be very many codes of practice; that was all I wished to say.

We are entirely in favour of business getting on and organising its own code of practice. That is what I spent, I fear, perhaps seven to 12 minutes trying to say to your Lordships a moment ago. What we do not want to do is to put it into statute, for reasons which I will not repeat.

To my noble friend Lord Swinfen, may I say that I welcome his support but I would remind him that the onus is already on the users under the Bill to come forward with codes if they wish to do so. But what we cannot place upon the unfortunate data protection registrar is the duty to place an imprimatur on any code of conduct and then say that whatever goes amiss, whatever damage is suffered by private individuals as a result of some loophole in this code which he did not foresee until, regrettably, that damage was done and could not be repaired or compensated, will not be without the law and, therefore, will not be compensatable. That is not in the amendment but it was in what my noble friend asked me. I should not have spoken twice. I apologise.

Lord Mishcon

My Lords, I do not think that a further lengthy speech is called for; nor would it be welcome. I want to make only one or two very brief observations. For the first one, I am indebted to the noble Lord, Lord Avebury, who handed me (since he himself has to be silent having spoken once) a copy of the Government's White Paper. The relevant paragraph when one deals with the question of the number of codes of practice that might be involved is Paragraph 8. I quote: The Lindop Committee recommended that the data protection authority should produce codes of practice which would be laid before Parliament and have the force of law. Some 50 or more codes would apply the general principles to the wide variety of situations in which personal data are processed automatically". I end the quotation there, the quotation being relevant only from the point of view of the numbers that we are dealing with—which is not in thousands or in millions but, on this estimate, about 50 or more.

Having said that, the argument is one that is very simple. We dealt with the codes of practice previously. The points are known to all your Lordships. The Government had an objection and it was, if I may say so, reasonably argued. The amendment, the Minister recognises, meets the main objection and now there are further objections which are limited purely and simply to the question: why have it in an Act of Parliament when it can be done anyway? The arguments for its being done anyway have been advanced and I hope that your Lordships, in this completely non-political matter, will see fit to support the amendment.

6.18 p.m.

On Question, Whether the said Amendment (No. 6) shall be agreed to?

Their Lordships divided: Contents, 65; Not-Contents, 97.

DIVISION NO. 2
CONTENTS
Airedale, L. Houghton of Sowerby, L.
Ampthill, L. Howie of Troon, L.
Avebury, L. Jacques, L.
Aylestone, L. Jeger, B.
Beaumont of Whitley, L. Jenkins of Putney, L.
Bernstein, L. John-Mackie, L. [Teller.]
Bishopston, L. Kilmarnock, L.
Boston of Faversham, L. Kirkhill, L.
Brooks of Tremorfa, L. Llewelyn-Davies of Hastoe, B.
Bruce of Donington, L. Lockwood, B.
Byers, L. Longford, E.
Chitnis, L. McIntosh of Haringey, L.
Cledwyn of Penrhos, L. Milner of Leeds, L.
Collison, L. Mishcon, L.
Craigavon. V. Molloy, L.
David, B. Ogmore, L.
Diamond, L. Oram, L.
Digby, L. Phillips, B.
Donaldson of Kingsbridge, L. Ponsonby of Shulbrede, L.
Elwyn-Jones, L. [Teller.]
Fisher of Rednal, B. Rhodes, L.
Flowers, L. Seear, B.
Gaitskell, B. Shannon, E.
Gallacher, L. Simon, V.
Gladwyn, L. Stewart of Alvechurch, B.
Glenamara, L. Stewart of Fulham, L.
Gregson, L. Stone, L.
Hale, L. Strabolgi, L.
Hampton, L. Taylor of Mansfield, L.
Hanworth, V, Tordoff, L.
Harrris of Greenwich, L. Underhill, L.
Hatch of Lusby, L. Whaddon, L.
Hooson, L. Winstanley, L.
NOT-CONTENTS
Airey of Abingdon, B. Carrington, L.
Alport, L. Cockfield, L.
Avon, E. Coleraine, L.
Bath, M. Colwyn, L.
Belhaven and Stenton, L. Constantine of Stanmore, L.
Belstead, L. Cork and Orrery, E.
Boardman, L. Croft, L.
Brabazon of Tara, L. Cullen of Ashbourne, L.
Broadbridge, L. Daventry, V.
Caccia, L. Denham, L. [Teller.]
Caithness, E. Dilhorne, V.
Campbell of Croy, L. Drumalbyn, L.
Carnegy of Lour, B. Elliot of Harwood, B.
Elton, L. Malmesbury, E.
Enniskillen, E. Mancroft, L.
Fortescue, E. Mansfield, E.
Fraser of Kilmorack, L. Marley, L.
Gainford, L. Marshall of Leeds, L.
Gisborough, L. Merrivale, L.
Glanusk, L. Mersey, V.
Glenarthur, L. Morris, L.
Gowrie, E. Mottistone, L.
Gridley, L. Mowbray and Stourton, L.
Hailsham of Saint Orkney, E.
Marylebone, L. Portland, D.
Harmar-Nicholls, L. Redesdale, L.
Hayter, L. Reigate, L.
Headfort, M. Romney, E.
Henley, L. Runciman of Doxford, V.
Holderness, L. St. Aldwyn, E.
Home of the Hirsel, L. St. Davids, V.
Hylton-Foster, B. Sandford, L.
Inglewood, L. Seebohm, L.
Ingrow, L. Skelmersdale, L.
Kemsley, V. Spens, L.
Killeam. L. Stamp, L.
Kimberley, E. Strathcarron, L.
Kinnaird, L. Strathclyde, L.
Lane-Fox, B. Strathspey, L.
Lauderdale, E. Teviot, L.
Lawrence, L. Teynham, L.
Lindsev and Abingdon, E. Tranmire, L.
Long, V. [Teller.] Trumpington, B.
Lonsdale, E. Vaux of Harrowden, L.
Lucas of Chilworth, L. Vickers, B.
Lyell, L. Vivian, L.
McAlpine of Moffat, L. Westbury, L.
Mackay of Clashfern, L. Whitelaw, V.
MacLeod of Fuinary, L. Young, B.

Resolved in the negative, and amendment disagreed to accordingly.

Clause 4 [Registration of data users and computer bureaux]:

6.28 p.m.

Baroness Trumpington moved Amendment No. 7: Page 4, line 14, leave out from first ("user") to ("shall") in line 15.

The noble Baroness said: My Lords, the series of amendments to Clause 4, of which No. 7 is one, is designed to clear up any misunderstanding which may have existed about the registration requirements for data users who also carry on computer bureaux. It has been put to us in the past that the effect of Clause 4 (3), as presently drafted, is to require any user who also operates a computer bureau to register not only the details of the data he holds as a data user but also the details of any data which he processes as a bureau on behalf of others. Indeed, we debated this very point in Committee stage when my noble friend LordMottistone tabled a number of amendments aimed at clarifying the situation. My noble friend Lord Elton explained then that the clause imposed no such requirement, and indeed it would be a nonsense to require people who operate computer bureaux to predict what data their customers are likely to want processed.

Nevertheless, in view of the confusion which clearly existed, the noble Lord, Lord Elton, promised to consider with great care what the noble Lord had said. I am bound to say that even after careful reexamination of this issue, we have still arrived at the conclusion that an amendment was not strictly necessary and that the clause as drafted achieved the right result.

Nevertheless, my noble friend succeeded in demonstrating that it was possible to be misled by the clause, and in all the circumstances we believe it would be churlish to refuse to clarify the situation. I hope therefore that these amendments which follow will put the matter beyond doubt and make it clear that, while a data user is required to provide all the information referred to in Clause 4 (3), the only information which is required in relation to bureau operations is the name and address of the person who carries on the bureau. I commend these amendments to the House.

Lord Mottistone

My Lords, I should like very much to thank my noble friend Lady Trumpington, and of course my noble friend Lord Elton, for having taken on board what I proposed at Committee stage, and indeed for improving on the third of my amendments and repeating my first two. I am sure that they are right about the interpretation of the English over which we argued earlier. But I think it is most civil of them to agree that there might be room for error and for having therefore adopted what I proposed at an earlier stage. I am sure that the British Bankers' Association, who advised me on this point, will be equally delighted. I thank my noble friends very much.

Lord Elwyn-Jones

My Lords, it is hard to resist the temptation—therefore, I shall not resist it—to note the greater readiness to meet suggestions of the noble Lord. Lord Mottistone, than to meet equally valid and valuable suggestions from this side of the House.

On Question, amendment agreed to.

Baroness Trumpington moved Amendments Nos. 8 to 11 en bloc: Page 4, line 32, leave out from ("bureau") to ("shall") in line 33.line 34, at end insert— ("(4A) Subject to the provisions of this section, an entry in respect of a data user who also carries on a computer bureau shall consist of his name and address and, as respects the personal data to be held by him, the particulars specified in subsection (3)(b) to (f) above.") line 36, leave out ("and 4") and insert (", (4) and (4A)") line 41, leave out ("and (4)") and insert (, (4) and (4A)").

On Question, amendments agreed to.

Clause 6 [Applications for registration and for amendment of registered particulars]:

Lord Elton moved Amendment No. 12: Page 6, line 16, leave out from ("registration") to end of line 18 and insert ("shall be accompanied by the prescribed fee, and every application for the alteration of registered particulars shall be accompanied by such fee, if any, as may be prescribed.").

The noble Lord said: My Lords, I hope that this is what we might safely call a minor amendment which need not detain us unduly. In its present form, Clause 6(7) has the effect that both applications for registration and applications for the alteration of registered particulars must be accompanied by a fee. That rules out the possibility, which we might wish to consider, of charging no fee where alterations to registered particulars are concerned. The purpose of this amendment is to preserve that option. The existence of an alteration fee might make some users just a little reluctant to notify any changes, or to save them up until they considered it was worth their while to seek an amendment to their registered particulars. That is clearly understandable since the register should be as accurate a reflection, and as up-to-date a reflection, of users' activities as possible. Further,it is possible that the level of the alteration fee might be so low as to make it uneconomic to collect and we would not wish to require the registrar to indulge in uneconomic practices. We therefore think it wise at least to allow for the possibility of waiving fees for alterations of particulars. That is the purpose of the amendment which I commend to your Lordships. My Lords, I beg to move.

On Question, amendment agreed to.

Clause 10 [Enforcement notices]:

Lord Elton moved Amendment No. 13:

[Printed earlier].

The noble Lord said: My Lords, I spoke to this amendment with Amendment No. 4. My Lords, I beg to move.

On Question, amendment agreed to.

Clause 17 [Disclosure of information]

Lord Elton moved Amendment No. 14: Page 15, line 12, leave out subsections (3) and (4) and insert— ("(3) The said section 2 shall not be construed as precluding the disclosure of information by any person mentioned in subsection (2)(a) or (b) above or by any officer or servant of the Tribunal where the disclosure is made for the purpose of discharging his duties under this Act or for the purpose of proceedings under or arising out of this Act, including proceedings before the Tribunal.").

The noble Lord said: My Lords, this amendment stems—and I asked him to wait for it—from a point raised by the noble Lord, Lord Mishcon, in Committee. He was concerned that application of the Official Secrets Act to the registrar might prejudice his independence. In particular, he feared that it would, at least in theory, be possible for a Minister to prohibit the registrar from disclosing, as part of his duties, certain information he had obtained, thus preventing him from taking effective action against Government departments. I sought, unsuccessfully I fear, to allay his fears and undertook to consider the point further. And I am grateful to the noble Lord for raising the point, because in discharging that undertaking we have come to realise that Clause 17 could be better cast than it is.

It clearly is important to ensure that information obtained by the registrar is properly protected; otherwise data users would be 'reluctant to give him information for fear that it might be passed on to others with no right to see it. But our desire to meet this point led us, we now acknowledge, to duplicate the effect of Section 2 of the Official Secrets Act 1911 by creating a new offence in subsections (3) and (4) of Clause 17 which covered the same ground. Subsections (3) and (4) are designed to protect information obtained by the registrar from private, as opposed to Government, sources: but Section 2 already does this because it applies to all information obtained in the course of official duty, regardless of its source.

This amendment therefore deletes the separate offence in subsections (3) and (4) which we now see to be unnecessary. At the same time, however, it seeks to clarify the position of the registrar under the Official Secrets Act—in a way that I hope will meet with the approval of the noble Lord, Lord Mishcon. It provides that application of that Act shall not preclude the registrar from disclosing information, if it is necessary for him to do so for the purpose of discharging his duties under the Bill or for the purpose of proceedings arising out of the Bill. This brings us back to the point originally raised by the noble Lord, since the effect of this provision is to rule out any possibility, however remote it might have been, of interference by Ministers wishing to prevent the registrar from using information obtained by him from their departments to take action against them. As the amendment achieves the result desired by the noble Lord, Lord Mishcon, and indeed by the noble and learned Lord, Lord Elwyn-Jones, and the noble Lord, Lord McIntosh of Haringey, I hope that they will be glad to see it. I beg to move.

Lord Mishcon

My Lords, I am grateful to the noble Lord, Lord Elton, for the gracious words he used in accepting this amendment and concession.

Lord Mottistone

My Lords. I am delighted to see that an amendment from the noble Lords opposite has also been accepted by my noble friend on the Front Bench.

On Question, amendment agreed to.

Clause 21 [Right of access to personal data]:

6.40 p.m.

Lord Elton moved Amendment No. 15: Page 17, line 8, leave out ("in writing")

The noble Lord said: My Lords, as it appears on the Marshalled List this amendment may give a slightly misleading impression. It may suggest that no longer do we see any need for subjects to have a written copy of their data when given subject access and that we are therefore reducing subjects' access rights. That is not the case. The effect of the amendment in fact is to extend those rights. Let me explain how.

Clause 21(1)(b) at present provides the data subject with the right to be supplied by the data user with a copy in writing of any information held about him on computer. The reference to a copy "in writing" was designed in the Bill as originally drafted as a safeguard for the data subject to ensure that the data user could not discharge his duty to give subject access by simply handing over a copy of an unintelligible computer tape. In the original Bill, therefore, these two words served an important purpose. However, thanks to an amendment made last Session to Clause 21(1), following representations made, as I recall, by the noble Viscount, Lord Craigavon, and the noble Lord, Lord Mishcon, the Bill now takes care of this point by another means. Thanks to their intervention Clause 21(1)(b) provides that where the information is expressed in terms which are not intelligible without an explanation, it must he accompanied by an explanation, thus ensuring that the impulses on a magnetic tape must be rendered into meaningful form.

The words "in writing" have therefore become strictly unnecessary. But what is more, it has now been brought home to us that they are in fact too restrictive. Computers may be used to hold information not presently in written form at all—copies of fingerprints, for instance, or pictures. A set of fingerprints, or a picture of an individual, could undoubtedly constitute personal data of a kind to which the subject should have a right of access and a copy of which he should be entitled to receive. He may wish to check that it is indeed his picture that is held and not a case of mistaken identity. But Clause 21(1)(b) as presently cast fails to deal with this situation since neither the picture nor the fingerprints can be reduced, despite what art critics may say, to writing.

The simple deletion of the words "in writing"should however be sufficient to ensure a subject's right to receive a copy of his fingerprints or picture if they are held on computer. And the rest of the Bill works satisfactorily without amendment in its application to this particular type of information. I therefore beg to move.

Lord Mishcon

My Lords, I am sure the House will be most grateful to the noble Lord the Minister for the very clear explanation he has given to the House of the reason for this amendment, which is obviously desirable.

On Question, amendment agreed to.

Lord Donaldson of Kingsbridge moved Amendment No. 16: Page 17, line 29, leave out ("this section") and insert ("subsection (1)(b) of this section").

The noble Lord said: My Lords, this is a point which has not been raised before. It seems to me to be rather an important one and I am quite prepared to be told that I misunderstood it. Here, with the leave of the House, I wish also to speak to Amendment No. 36 to Clause 29:

Amendment No. 36: Clause 29, page 22, line 11, leave out from ("from") to ("or") in line 12 and insert ("only that part of the subject access provisions described in subsection (1)(b) of section 21 above")

As the Bill stands, the Secretary of State's powers in Clause 29 to grant exemption to the subject access provisions include exemption from the seventh data protection principle, and I do not think that they should—that is, the principle of disclosure. If they did indeed, would they not be in breach of Article 8 of the European Convention? Surely the point of Clause 29 is to exempt the data user from the obligation of disclosure of matter held as personal data but not from the obligation under the seventh principle to disclose that personal data are in fact held without disclosing what they are. It is rather a complicated sentence but I hope it is clear. It is therefore necessary to exclude the individual's right to be told that personal data are in fact held about him from the Secretary of State's powers of exemption in Clause 29. If anybody is unclear exactly what this means, I shall try to expand, but what I have said is in fact exactly the point. I shall be interested in what the noble Lord has to say. I beg to move.

Lord Elton

My Lords, Amendments Nos. 16 and 36 are, I think, alternative means of achieving the same end—that is, to ensure that where social work records are concerned individuals are always told whether data are held about them, even though there may be an exemption from the requirement to give access to the actual data. I had no difficulty in understanding that: but perhaps I ought courteously to thank the noble Lord, Lord Donaldson of Kingsbridge, for a rough idea of his approach to this problem which may have helped me in my interpretation.

The amendment to Clause 21 would be appropriate only if the noble Lord's major amendments, removing the social work exemption from Clause 29 to Clause 21, which we shall come to in a moment, are accepted. The amendment to Clause 29, on the other hand, would be appropriate—indeed, can only be made—if those other amendments do not apply. The principle behind the amendments is simple. The intention is, as I have said, that where social work records are exempted from subject access, the subject should still be told that the data exist.

The noble Lord has suggested that there is a distinction to be drawn here between Clause 21 and the seventh principle. In fact, this is not so, because both contain the entitlement to be told whether data are held and the right to be given a copy of any data which are held. Any exemptions must therefore relate to both Clause 21 and the seventh principle, as they parallel one another. Inasmuch as the amendments make no reference to the seventh principle they are flawed, but I make nothing of that because the noble Lord is in search of information.

It is the overall concept behind the amendments to which I want to address myself, and on that I have to ask whether it is really wise to take decisions of this kind at this stage—the noble Lord, Lord Avebury, will forgive another rhetorical question because I am asking it of myself— rather than act in the full light of the consultation that is now going on with those involved in all aspects of social work. I shall have more to say about those consultations when we come to the next series of amendments tabled in the names of the noble Lords opposite. Suffice it to say for the moment that the Department of Health and Social Security is consulting fully with the interested parties as to the form and extent of any subject access exemptions for social work data to be made under a Clause 29(2) order.

At this stage I suggest it would be rash to assume that we know what they will reveal, because not all the opinions are in. Although the deadline is passed, about a third of them are to come, some of them from influential bodies. In particular, I do not think it is at all safe to assume that we shall emerge from the consultations convinced that we need never provide for circumstances in which for his own good the data subject ought not to be told that data exist but are being withheld. There may quite likely be circumstances in which if data are being withheld from the subject because access would be harmful to him, it could be equally harmful to tell him that such data were being withheld for that reason. Certainly we should think very hard before amending the Bill itself now to provide that even where exemption from actual access applies the user still has to say, "We do hold personal data about you but we are not going to tell you what it is". That could in itself have serious and regrettable consequences, so we should maintain the maximum flexibility in the order-making power under Clause 29(2) at least until we have the results of the consultation.

But I do not suggest that your Lordships should abandon your interest in this matter. Your Lordships will remember that the power is itself subject to the affirmative resolution procedure. I am not suggesting therefore that your Lordships should let the issue out of your sight entirely. I am saying that neither your Lordships nor the Government have yet sufficient knowledge to make that decision with confidence. It ought to be made in due time with the full benefit of consultation, and that means making it using the order-making power as drafted in the Bill. Those considerations apply equally to both amendments.

In conclusion therefore I suggest that it is too early for us to reach final decisions on the nature of the exemptions for social work or to tie the Secretary of State's hands in the way proposed by the noble Lord. I hope I have made it clear why that is.

Lord Donaldson of Kingsbridge

My Lords, I am grateful to the noble Lord for what he has said. I do not propose to divide the House at this stage because it is a difficult point. However, it seems to me that a data subject who will be being advised, by definition, more or less, by professionals will from time to time want to know whether there is anything held about him. I think it would upset him very much indeed not to be answered. To say that there is a file on him but that he is not going to be told why, for the reasons dealt with in the next amendment, seems to me to he an impossible position, hut that is the position in which we are left at the moment.

The next question I want to ask the noble Lord is this. He says this can be dealt with later. How, when and where? Does he mean in another place, when the Bill goes there? How is it going to be dealt with? It seems to me there is something wrong here, and I want to know how it is going to be dealt with later. I am sure the noble Lord may answer with the leave of the House.

Lord Elton

My Lords, with your Lordships' leave, the noble Lord has asked me two questions. First, he asked for an illustration of a case where it might be beneficial to hold back such information. I do not speak from a brief, but the case that occurs to me immediately is this. Suppose there is a computerised national list of people suffering from a dangerous, noninfectious but incurable disease. Is it right that such a person should be told that his name is on the list but no more is to be revealed? Is it not better in some circumstances, with the advice of the medical practitioner in charge, to withhold the information that that person is on the list at all? It may be a bad example, but there are others, which need not be medical, where one can see the difficulty. We recently had a debate about adoption and establishing parenthood, in which we decided in the opposite sense. I do think there might be occasions when there would be advantage in preserving this power.

The extent to which I am right in saying that we should pay tribute to it by our legislative arrangements is something which will be easier to ascertain when we have received all the consultation papers and have digested them. It was apparent when the Bill was drafted that there would be this difficulty of timing. It seemed wrong to hold up the Bill in order to get this one issue out of the way. That is why there is an order making power which will enable the Secretary of State to make an order setting up the exemption as appropriate in the light of the advice when it is received.

The noble Lord is, I think, tempting me to say that the advice will be received and considered before this Bill has got beyond the premises next door, as it were. I really do not know the answer to that, but I am certain that the noble Lord's friends in another place will be quite competent to take up the issue if the information is available in time for them to do so with profit in another place.

Lord Avebury

My Lords, I only want to say this because I think my noble friend may not have an opportunity to cover all the ground. The adoption problem which the noble Lord mentioned is really not relevant to the amendment under consideration because that is covered, speaking from memory, by Clause 33(2)(a), where there is exemption for disclosure of information which is otherwise prohibited by statute. That is dealt with, I think I am right in saying, under the Adoption Act.

The example the noble Lord gave was one in the medical field. We are not discussing that; we are discussing social work records. All my noble friend is asking is whether the Minister does not feel that there will be serious problems if, when a person comes to the notice of a social work agency and deals with the professionals, he then wishes to inquire whether there is information on him held on the computer under the control of that social work agency. He inquires and he is told that he is not permitted to know whether or not they hold information. My noble friend was seeking to suggest to the Minister, I think quite rightly, that if that is the sort of answer the client is given it will open up all sorts of serious problems of relationships between the client and the social worker. It is one thing to say that disclosure is prohibited for certain reasons which can he explained to the client: it is quite another thing to tell him that he is not permitted to know whether or not information is there. I think we are storing up serious problems for ourselves and making unnecessary difficulties between client and social worker if we are not to give him the bare information that my noble friend has suggested.

Lord Mishcon

My Lords, my contribution will be a short one. I think it is extremely dangerous that we are dealing, not for the first time, with the question of social workers and the right of the data subject who is being assisted by social workers to information, first of all as to whether there are data and then what those data are. With great respect to the noble Lord the Minister, it is very difficult indeed to swallow the fact that at this stage, Report stage of the second time that the Bill has been before Parliament, the situation has not yet been reached on this vital matter where evidence has been collated and the Minister has had a chance to consider it. It seems to me that this is one of the difficulties, both in the medical field and in the social work field, which became apparent the first time this Bill saw the light of day in the last Parliament.

For us to be told that we cannot make up our minds, and indeed that another place may not be able to make up their minds in time and that this will be left to an Order in Council—and we all know what happens to Orders in Council, with the negative procedure and the affirmative procedure—seems to me to be lamentable. Somebody is to blame, whether it is the Home Office or the Department of Social Security. There is not the slightest doubt that more information and evidence should have been available before we were asked at Report stage to deal with vital amendments of this kind moved by the noble Lord, Lord Avebury, and others.

Lord Donaldson of Kingsbridge

My Lords, with the leave of the House, I would speak again only to say that in view of what has been said I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

The Deputy Speaker (Viscount Simon)

My Lords, the next amendment on the Marshalled List is No. 17.

Lord Donaldson of Kingsbridge

My Lords, this is a long and complicated amendment and I propose to make quite a long speech. Would it not be better to dine first?

Lord Denham

My Lords, I am most grateful to the noble Lord, Lord Donaldson. I think that that probably would be the right answer, if that is for the convenience of the House. I do not quite know how long the dinner Business will take, but to be fair to the House sitting on the Report stage I think that perhaps we should agree that, even if the dinner Business does not last that long, we will not resume the Report stage before 8 o'clock. I beg to move that the Report stage be adjourned until 8 o'clock.

Moved accordingly, and, on Question, Motion agreed to.