HL Deb 16 March 1998 vol 587 cc465-87

3.28 p.m.

Report received.

Clause 1 [Basic interpretative provisions]:

Baroness Turner of Camden moved Amendment No. 1: Page 2, line 9, at end insert— ("provided that this definition shall not he construed as applying to any operation performed only for the purpose of preparing the text of documents:).

The noble Baroness said: My Lords, as I believe my noble friend the Minister may know, I have for some years been a lay member of the Professional Standards Committee of the General Council of the Bar. I have been alerted to a problem about the Bill by one of my fellow members, a barrister, who tells me that the present Bill omits a provision which existed in the previous Data Protection Act. It is a provision the effect of which is that individuals using the computer as a word processor—virtually as a typewriter—do not have to register.

I gather the provision was originally intended to protect the position of those—and there must be many—who are in the process of making the transition from typewriters to computers. Letters to individuals processed in this way could therefore contain names, addresses and personal data. Of course, those data are capable of being stored if a computer is used, although very few people bother to do this. Under the new Bill, however, I gather that that provision is lost. Does that mean that someone using a computer in that way would be required to register? Is that omission an oversight or is there some particular purpose in it?

That has been brought to my attention by a barrister who uses a computer in that way. But it can affect a large number of people who are not barristers. Surely it is not intended to make people register who, a few years ago, would simply be using a typewriter. In my case, I have not yet made the transition to a computer but I use an electronic typewriter on which, if I wanted to, I could store text. If I switched to a computer with a much greater storage capacity, would that mean registration?

I must apologise to the Minister for not raising this issue in Committee. It is a matter which would have been better ventilated in Committee but, as he will know, people with concerns about legislation rarely tell you of them in time. Because I thought that my colleague had an issue which should be ventilated, I have tabled this amendment on Report. I beg to move.

Viscount Astor

My Lords, I have tabled Amendment No. 2, which is grouped with this amendment, because in Committee, there was some difference between the Government and the registrar as regards the definition of manual records. However, I notice that the noble Lord, Lord Williams of Mostyn, has tabled government Amendment No. 3, which I believe solves the problem. Therefore, it may be for the convenience of the House if I let the Minister speak first and thereafter I may or may not have to speak again.

Lord Williams of Mostyn

My Lords, I am obliged to the noble Viscount. His Amendment No. 4 is also within this group and I am entirely in his hands as to when he wishes to speak to that amendment, if at all.

I accept entirely what my noble friend said. This matter has come to light, as sometimes happens, during the course of the Bill. I do not reproach her in the slightest way.

My noble friend is quite right to say that the 1984 Act provides an exclusion from the definition of processing for operations performed only for text preparation which may include simple word processing. Therefore, this amendment seeks to replicate that exclusion—in other words, the 1984 exclusion—in this Bill.

In the White Paper of July last year, we said that the directive does not allow a continuation of that exclusion. The definition of "processing" in the directive is much wider than that in the Act and we are therefore obliged to follow it. There is no scope for us to make the definition in the Bill more restricted in the way my noble friend suggests.

We wonder whether there is a problem in practice. Text preparation in the form of word processing will be, to a considerable extent—possibly almost always—done as an adjustment to other processing which itself is likely to be caught by the Bill. Therefore, the application of the Bill to word processing is unlikely to bring any additional significant burdens.

However, I understand that my noble friend and others are concerned about additional burdens flowing from the notification requirements in the Bill. The same White Paper, to which I referred, said that the Government would exempt word processing from the notification arrangements if such an exemption proved necessary. I hope that on the basis of what I have said, my noble friend will feel able to withdraw his amendment.

I deal now with the linked amendments referred to by the noble Viscount. As he rightly said, this matter flows from the discussions that we had in Committee. The noble Viscount's amendment seeks to leave out the word "particular" and we seek to leave out the word "particular" and to include the word "specific".

These two amendments are quite small. They tend to go in different directions. We believe that the noble Viscount's amendment would widen the scope of the definition quite considerably and bring in more manual records. As I said in Committee, I do not believe that his amendment would be welcome to all those who currently hold large collections of manual records. On the other hand, our amendment makes it clear, and is intended to make clear, that the definition is one of limited scope.

This is a difficult area. We believe that the definition as it stands in the Bill gives full and proper effect to the directive's requirements. We believe that the directive applies to a limited category of manual records. Essentially, they are those which meet three criteria: first, that they form part of a structured set; secondly, that the structuring is done by reference to individuals or criteria relating to individuals—for example, a unique personal identification number; and, thirdly, that the structuring is done in such a way that particular information about individuals is readily available. It is that final criterion that is the subject of the two amendments.

Our intentions are clear. We do not wish the definition to apply to miscellaneous collections of paper about individuals, even if the collections are assembled in a file with the individual's name or other unique identifer on the front, if specific data about the individual cannot be readily extracted from that collection.

An example might be a personnel file with my name on the front. Let us assume that the file contains every piece of paper or other document about me which the personnel section has collected over the course of my career; and those papers are held in the file in date order, with no means of readily identifying specific information about me except by looking at every document. The Government's clear intention is that such files should not be caught. We want to catch only those records from which specific information about individuals can be readily extracted.

Let us take the case of a personnel file consisting only of information about my sickness record during my career. If that file has my name on the front and is part of a structured set, that file will be caught because the specific information about me, my sickness record, is readily available.

The Data Protection Registrar has said that she does not believe that the current definition of "relevant filing system", achieves the Government's intention of distinguishing between those two sorts of files. She suggests that an unindexed general personnel file is itself capable of counting as "particular information" about an individual. That information is particular only in the sense that it is limited to a rather unspecific category of personnel information. I can see that the word "particular" is ambiguous to the extent that it has the potential to yield that somewhat attenuated meaning. That is not what we intend.

We intend that "particular" information should mean "specific" information. That is what our amendment provides. The search for unambiguous language can sometimes be exhausting. I do not say that "specific" admits of no shades of meaning; it does. Information may be more or less specific in different degrees of detail. Very much may depend on context. But if there is any significant ambiguity in the introduction of "specific" into the definition of "relevant filing system", it is not capable of admitting into that definition the sort of general, unindexed personnel files that we have been talking about. All the information in those files may conceivably be thought "particular" but not "specific". "Specific" information is intended to mean and does mean distinct information within the file which can be distinguished from other information in the file and separately accessed. It means information of a distinct identity which sets it apart from the rest of the generality of personal information held. That is what our amendment intends to pin down. I hope that the noble Viscount will agree that our amendment is an improvement because we were looking for the same outcome.

We have paid careful attention to what the noble Viscount said and to what those in business and industry have expressed as concerns and we wish to address those concerns.

Baroness Nicholson of Winterbourne

My Lords, I oppose the noble Viscount's amendment and seek reassurance from Her Majesty's Government. I am concerned lest paper files which hold potentially damaging information about individuals without their knowledge may not be covered even by the government amendment. I wish it to be possible for those paper files to be accessed by the individuals concerned.

I do not wish to name any specific organisation, but there is one which I have in mind. I shall not name it but I shall define it. That organisation has been investigated by the police. I am sorry to say that one particular major political party has used it on a regular basis in order to target political opponents.

Given that the police investigation disclosed, I believe, nothing improper, I had understood that that organisation was no longer targeting people who were political opponents of one political party. I am sorry to say that that is not so. There are people who may be shop stewards, who may belong to unions and who may disagree with management, whose personal files are still being held by that organisation and whose job prospects are still being harmed.

I met a person involved in such a case on Friday. His job prospects have been harmed during the past two weeks. That man has had his name on a file of that organisation for eight years, and he can give a record of jobs for which he has been blacklisted because of the situation. If he had access to that information, he could at least tell whether the information that the organisation holds on him, or purports to hold on him, is accurate. He could then raise the matter with the personnel officers of the companies to which he has applied for jobs. I am concerned about this; I want to make absolutely sure that ordinary working men and women do not have their job prospects harmed through invisible mechanisms which this Bill is surely designed to stop.

Lord Skelmersdale

My Lords, before my noble friend responds, perhaps I might point out that, although this is the Report stage, we seem to be getting into a slight muddle because of this particular grouping. However, leaving that issue aside, I should very much like to comment on the Government's amendment, Amendment No. 3.

In Committee I declared an interest as the holder of a manual records set. As such, I think I am grateful to the Minister for the Government's amendment. As I understand it, any collection of paper documents which cannot be accessed by a particular subject would be covered by that amendment. However, I am not so sure as regards the position on a manual address list, where it involves purely the person's name, his address and a continuing set of order numbers.

Clearly, if one is given the order number over the telephone one has to look up the invoice and then refer to the reference. However, if one is given the name, one can then do the operation the other way round. I am not sure whether this is "specific". I gain the impression from what the Minister said that it almost certainly is not. Perhaps the Minister would care to confirm that either today or in writing before the Third Reading debate. I should be most grateful.

Viscount Astor

My Lords, before the noble Baroness replies, I should like to express my thanks to the Minister for Amendment No. 3, which I believe actually deals with all the questions that I put forward in Committee. Indeed, it also appears to deal largely with the content of Amendment No. 4, which is tabled in my name. Obviously I shall have to read carefully what the noble Lord said because his introduction was somewhat complicated. However, I have one brief question. Does the result of his amendment mean that the Government and the registrar are now agreed on the definition of what are and what are not relevant manual records?

Lord Williams of Mostyn

My Lords, as I believe I set out in my introduction, I cannot say that there is perfect agreement on the matter. There are shades of meaning here and much will depend on good sense in practice. We have taken on board the legitimate concerns raised by the noble Viscount and others, especially as regards large organisations—some of them governmental—which may have carried an intolerable burden over many years when dealing with manual records. I should like to research the point raised by the noble Lord, Lord Skelmersdale, and write to him extremely promptly on the matter.

I take note of the concerns expressed by the noble Baroness, but I do not believe that they relate to the amendment for which I was contending. We are looking for a word which expresses the concept that we are all trying to find; namely, that one should have access to specific material which is readily accessible. I believe that what I have said deals with the questions put forward. I trust that I dealt earlier with the troubles which worried my noble friend Lady Turner of Camden.

Baroness Turner of Camden

My Lords, I thank my noble friend the Minister for his explanation. I had not appreciated that the directive gave the Government so little scope to do what was proposed in my amendment. However, I am grateful for my noble friend's assurance that it is not the Government's intention to impose additional burdens on individuals. On that basis, and with thanks again to my noble friend for his explanation, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 2 not moved.]

Lord Williams of Mostyn moved Amendment No. 3: Page 2, line 19, leave out ("particular") and insert ("specific").

On Question, amendment agreed to.

[Amendment No. 4 not moved.]

3.45 p.m.

Schedule 1 [The data protection principles]:

Lord Williams of Mostyn moved Amendment No. 5: Page 41, line 2, leave out ("in writing") and insert—

  1. ("(i) which is made or evidenced in writing, and
  2. (ii)")

The noble Lord said: My Lords, this amendment relates to contracts between data processors and data controllers and picks up a point raised by my noble and learned friend the Solicitor-General when responding to Amendment No. 26 in Committee.

Paragraph 13 in Part II of Schedule 1 provides that processing by a data processor on behalf of a data controller shall not be regarded as complying with the seventh data protection principle, which relates to security measures to prevent unauthorised processing or accidental loss, unless it is carried out under a contract which requires the processor to meet the necessary obligations. That is a requirement of the directive. The amendment responds to a point that was raised and allows that such a contract may be made or evidenced in writing. The explicit point of the director's requirement for writing is, for the purposes of keeping proof". That may equally well be done by a contract made in writing or a contract evidenced in writing.

Amendments Nos. 6 and 7 are grouped with this amendment. They are tabled in the name of the noble Viscount, Lord Astor, and perhaps I might, therefore, allow him to take what course he thinks appropriate in that respect. In the meantime, I must point out that I have spoken only Amendment No. 5. I beg to move.

Viscount Astor

My Lords, it may be convenient for me to speak now to Amendments Nos. 6 and 7, which are included in this group. We find ourselves in a complicated area which deals with transfers of data between this and other countries, especially as regards the United States. I am grateful to the Minister for the meetings that have taken place between the Committee and Report stages. We do not seem to have reached a conclusion on the matter, although I believe that there are some pointers.

We are dealing with an extremely important area because it particularly affects American countries with operations in this country, or, indeed, British companies with substantial dealings in the USA. One of the difficulties is that the United States does not have a federal data protection Act of general application, although a number of states do have such protection. However, there is a wide range of codes of conduct and also contractual restrictions and individual business requirements which provide many of the protections provided for in the new data protection legislation. It was presumably for that reason that the registrar came out so firmly for allowing the broadening of paragraph 14 of Schedule 1.

There is a large number of cases where it is essential for American and British companies—for example, airline companies, pharmaceutical companies and software companies—to transmit massive amounts of data which are entirely appropriately protected in the United States. As one of the largest trading partners of the United Kingdom, the United States cannot be cut off from the flow of data from this country. If that were to happen, there would be serious disruption in day-to-day business and in the legitimate exchange of information.

Obviously, those whose data are transferred have to be protected. I read again, with care, the argument proposed by the noble and learned Lord the Solicitor-General in Committee that it can all be brought within Schedule 4. However, paragraph 2 of Schedule 4 deals only with the transfer of information between the data subject and the data controller which typically is not the subject of cross-border data flows. An American or British airline needs to be able to transfer information about bookings and seats, flight schedules and pilot and cabin staff rotas. If it has to get permission from the data subject to make any transfer, it will become exceedingly difficult to do business in the United States.

At Committee stage the Minister also relied for his argument on paragraph 3 of Schedule 4. This initially seems to suggest that contracts between a data controller and a person other than the data subject can be enforced, but only if it is possible to prove that they were entered into at the request of the data subject or are in the interests of the data subject. Once again I believe this could impede any reasonable day-to-day handling of the kinds of business data that I have mentioned and would make it extraordinarily difficult for a British pharmaceutical company, for instance, to transfer information to obtain FDA permission for its drugs to be sold in the United States. The Minister did not point out in connection with paragraph 3 of Schedule 4 that contractual provisions are insufficient unless the contract is entered into at the request of the data subject or they are, in the interests of the data subject". This provision would in reality make it possible to hold up any transfer of information to the United States indefinitely.

Paragraph 8 of Schedule 4 allows the transfer to be made on terms approved by the commissioner. If these were made in general terms it would be possible to handle some of the issues that I have raised. However, the effect of globalisation of trade means that the nature of contracts that are needed is constantly changing. American financial institutions have to transfer data constantly about accounts and various other matters to their head offices in New York or any other American city. British banks and financial institutions which hope to continue trading in the American market will also experience difficulties in having to clear every new arrangement—the nature of derivatives, for example, changes daily—with the registrar.

The principal problem with the Schedule 4 approach is that it assumes that countries such as the United States will have inadequate data protection in virtually every case, and that data can be transferred to the United States only in the "force majeure" situations listed in the schedule. My amendment recognised that contractual protections may be one factor of many listed in Schedule 1 in determining that in appropriate cases data transferred to the United States may have the adequate protections that the law requires.

This is a complicated area. I have mentioned the United States because institutions in this country, particularly financial institutions, do so much business with that country. However, the matter could apply equally to other countries. I moved this amendment in Committee. While we have made progress in some of the discussions which have taken place as regards explaining the problem, I do not think we have made any progress in finding an answer. That is why I have spoken to this amendment again today. I look forward to the Minister's reply to determine whether he can help me in this difficulty.

Lord Williams of Mostyn

My Lords, I am grateful for the exposition which has been given. I was most pleased to hear that the discussions which have taken place with officials have been helpful if not entirely productive of an outcome that everyone can accept. The proposition which is being put is that contracts in appropriate cases should be able to make a contribution to a finding of adequacy for the purposes of Schedule 1. We believe that that is already the case as the Bill is drafted. Paragraph 14 of Part II of Schedule 1 states that, An adequate level of protection is one which is adequate in all the circumstances of the case". I emphasise that. It is the full situation in individual cases—both legal and practical—which must be considered. The ensuing list of matters in paragraph 14 is not exhaustive. If the person to whom data are exported is under relevant contractual obligations and the country or territory in question is one with an effective contractual enforcement system, that may well contribute to a finding of adequacy.

There may be, for instance, a relevant code of conduct in force in the territory in question which the recipient of the data is contractually bound to comply with. The fact of that contractual obligation is clearly relevant to the question of whether the overall level of protection offered by that territory is, adequate in all the circumstances", as paragraph 14 requires. Similar considerations would of course apply vis-à-vis security measures, to which this amendment specifically relates.

We are not persuaded that there is a gap in the scheme which this amendment could usefully fill. The list of mandatory considerations is designed to highlight the most important issues. It follows clearly the words of Article 25.2 of the directive. However, other factors will be relevant. That is the reason for the phrase, all the circumstances of the case". There is no end to the circumstances which could be listed. We have highlighted the major factors indicated by the directive.

The noble Viscount said that this was a difficult area. We understand that. I shall reflect further on what the noble Viscount has said today. I cannot accept his amendment today but we shall look carefully at the points he has raised this afternoon. I hope that in respect of Amendment No. 6 the noble Viscount will accept those comments and will not press the amendment.

Viscount Astor

My Lords, I am grateful to the Minister for those comments. I shall not press the amendment, but this is a matter that we must try to make clear before the Third Reading of the Bill.

On Question, amendment agreed to.

[Amendment No. 6 not moved]

Schedule 3 [Conditions relevant for purposes of the first principle: processing of sensitive personal data]:

[Amendment No. 7 not moved.]

Lord Dholakia moved Amendment No. 8: Page 43, line 21, at end insert— (" . The processing is—

  1. (a) undertaken only for the purpose of promoting, ensuring or monitoring equality of opportunity or treatment between persons of different racial or ethnic origins, and
  2. (b) carried out with appropriate safeguards for the rights and freedoms of data subjects.").

The noble Lord said: My Lords, let me first declare an interest in this amendment. At one time I worked at the Commission for Racial Equality and made my maiden speech in this House on the subject of equal opportunity in a debate proposed by the noble Baroness, Lady Turner of Camden, some time ago. It should therefore come as no surprise to your Lordships' House that I move the amendment in my name on the Marshalled List.

I express my concern and also the concern of the Commission for Racial Equality, which is a body set up by the Government to promote equality of opportunity and good relations among our various communities. It has the full backing of the Home Office in this important task. Equal opportunity has no meaning unless this process is adequately monitored. Needless to say the commission is concerned about the impact of the Data Protection Bill on ethnic monitoring. I believe the amendment I propose will address this deficiency.

The Data Protection Bill as drafted imposes a general prohibition on the processing of sensitive personal data, which includes data on racial and ethnic origin. This causes a major problem. The recording or analysis of the ethnic origins of employees or service users will not be lawful unless one or more of a number of specified conditions set out in Schedule 3 to the Bill are met or unless the purpose is one within any of Clauses 27, 28 or 31. Let me remind your Lordships that these relate to national security, prevention and detection of crime, assessment or collection of taxes etc.

The conditions in Schedule 3 do not include any reference to processing for the purpose of ethnic monitoring and none can be reasonably interpreted as permitting it. The Bill in its present form will therefore permit ethnic monitoring by employers and service providers only if data subjects give their explicit consent as stated in paragraph 1 of Schedule 3.

Paragraph 9 of Schedule 3 confers on the Secretary of State a general power to stipulate by order further conditions in which sensitive personal data may be processed. I am well aware from my discussions with the Commission for Racial Equality that it has been in touch both with the Home Secretary and the noble Lord, Lord Williams of Mostyn. The Minister has indicated that it is the Government's intention to use the power in paragraph 9 of Schedule 3 to permit ethnic monitoring. Let me say straight away that this approach is not equivalent to the inclusion of such an exception in primary legislation. The Minister must therefore accept that this is highly damaging to the work of the Commission for Racial Equality and others working to promote ethnic monitoring.

The amendment, which has the support of my noble friend Lady Nicholson, has the clear objective of including in the Bill a specific exception relating to ethnic monitoring. It will make clear to all employers and service providers that the Data Protection Bill will permit ethnic monitoring. I believe that that is crucial.

It has been a hard struggle to get where we are on the important subject of ethnic monitoring. The uncertainty as to what the law will permit will increase reluctance and may lead some to abandon the issue altogether. I do not believe that the Government's explicit commitment to equality of opportunity in their manifesto ever envisaged the placing of such a restriction.

Let me take the example of the CBI's equal opportunities forum. It shares the view that the Bill should be amended. It shares the view that this provision should be made evident on the face of the Bill rather than being dealt with in subordinate legislation. The TUC agrees that the Bill needs amendment for this purpose. If the Bill is not amended, the message will be clear. It will suggest that racial equality and the means of achieving it are not a priority. It strikes at the heart of all government policies because they frequently refer to the centrality of equal opportunity to their work.

In all the years that I have known the Minister I have never doubted his total commitment to racial equality and the means of achieving it. I believe that, on reflection, he will accept that the amendment gives weight to the CRE's code of practice issued under Section 47 of the Race Relations Act. This is vital to the promotion of the objectives of all those who work to build a decent society free from any improper discrimination. Ethnic monitoring should be in the mainstream of legislation rather than delegated to its margins. If the Government decline to accept this reasonable amendment, they risk being seen as failing to take positive action to promote equal opportunity when there is an easy and available opportunity to do so. The amendment has all the necessary safeguards for the data subject. I commend it to your Lordships.

4 p.m.

Baroness Nicholson of Winterbourne

My Lords, I support the excellent amendment of my noble colleague and urge the Minister to support it or to investigate the subject most seriously. As my noble friend so rightly says, ethnic monitoring should be in the mainstream and forefront of the Government's policies. I feel confident that with this Government it is. I remind the Minister that the last government opposed this legislation. The new Government give matters such as ethnic monitoring the importance that I believe is obligatory in a multicultural and multifaith society.

I also draw the Minister's attention to the second part of the amendment. It provides carefully for the rights of subjects, ensuring that that part of the amendment is also taken into account. It is of vital importance that employers should not misuse this information if, as we hope, our amendment, or some provision close to our amendment, is placed on the face of the Bill.

Lord Williams of Mostyn

My Lords, the noble Baroness puts forward the most powerful of arguments; namely, that the last government opposed the provision. It is deeply seductive!

I sympathise and understand, I hope, the reasoning underlying the speeches of the noble Lord and noble Baroness. As they rightly say, ethnic monitoring is not on the face of the Bill. That is partly because our Schedule 3 follows closely the relevant provisions in Article 8 of the Data Protection Directive which does not mention ethnic monitoring.

Originally we thought that we would go by way of order under paragraph 9 of Schedule 3. We could have had the necessary measure of detail and flexibility so that we captured all necessary angles properly. That would have given us the benefit, in due time, of easier amendment power, because this Bill will be an Act which has to last for a long time and needs to be sufficiently flexible.

I understand the persuasive force of the noble Lord's argument. The Home Secretary had a meeting with Sir Herman Ouseley recently. I had the benefit of further conversations with him with officials as recently as Friday. We have said throughout that we are perfectly willing to have an open mind. I hope that I can demonstrate that on this occasion by saying that the Government are content in principle for the Bill to be amended along the lines suggested.

While paragraph (b) is well intentioned, we believe that it may not hit the target, but that is a matter of drafting, not of principle. Therefore we do not think that the amendment is perfect. I do not think that even the parental joy of the noble Lord, Lord Dholakia, would necessarily pretend that his offspring was perfect. We shall put matters in hand for the Government to bring forward their own amendment to deal with the point. I accept that it is in many ways a point of principle and an extremely important indicator of how seriously the Government deal with these matters. They are matters of great sensitivity but equally of great principled importance.

We shall try to do that by Third Reading. We are very tight on time. I think that the noble Lord and the noble Baroness know how extremely stretched officials are at present because they have been in continuing discussions, not only on drafting but also other matters, with noble Lords who are interested. We shall do our very best. It is possible that we shall not be ready for Third Reading. If we are not ready for Third Reading in this House, we shall be looking to bring forward an amendment in another place.

Viscount Astor

My Lords, before the Minister sits down, perhaps I might briefly interject. The noble Baroness says that the previous government were against her amendment. I find that rather surprising. It was the previous government who negotiated the directive with Europe in the first place. If it had not been for our part in that, we would not have a Data Protection Bill now.

Lord Williams of Mostyn

My Lords, I do not wish to intrude into private grief.

Lord Dholakia

My Lords, I am grateful to the Minister. Once in a while when amendments of this nature are accepted it restores one's faith in this House. Perhaps I may press the noble Lord a little further about the timescale so that we are aware of the progress being made.

Lord Williams of Mostyn

My Lords, I can do no more than say that we hope to have the provision ready for Third Reading. However, Third Reading is almost upon us. If it is humanly possible to achieve a properly workable amendment, we shall do so before the Bill leaves your Lordships' House. If not, I undertake that the measure will be brought forward in another place so that it will form part of the Bill in due time.

Lord Dholakia

My Lords, I am grateful to the Minister. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Schedule 5 [The Data Protection Commissioner and the Data Protection Tribunal]:

The Solicitor-General (Lord Falconer of Thoroton) moved Amendment No. 9: Page 46, line 13, after ("Act") insert ("or section 158 of the Consumer Credit Act 1974").

The noble and learned Lord said: My Lords, in this group, I beg to move Amendment No. 9, and speak to Amendments Nos. 12, 13, 16 and 70. This set of government amendments effectively brings the rights which data subjects have under the Consumer Credit Act 1974 to obtain access to their data under the same roof as those of the Bill.

As it presently stands, Clause 8(8) of the Bill takes a first step towards streamlining the two access rights. It imposes an order of priority on unspecific access requests. But it leaves the dual regime intact; namely, data protection and consumer credit. As such, it can be seen only as an interim measure. The new government amendments complete the task. They replace the present Clause 8(8) with a unitary system of access under the Bill. They therefore ensure that all requests for general access have the benefit of the more comprehensive rights and remedies provided by the Bill.

But we have gone a step further. These amendments introduce in Clause 7 of the Bill a new right of access to specific data. Your Lordships will be aware that the subject access right under the Bill is a right of access to the generality of data held. It is not a right to insist on partial access. But the new amendments will now provide that a data subject making a subject access request to a credit reference agency may specify that his request is limited to personal data consisting of information as to his financial standing. This new limited right is supported by representatives of consumer bodies, trading standards authorities and the credit reference agencies themselves. Very often, this is the only information in which data subjects are interested in this context. We intend to use the powers in Clause 7 to make regulations to prescribe terms for the new limited access rights which are more favourable to consumers than the general subject access conditions may be. The new right is intended to be a cheap and fast means of acquiring access to the key financial information held by credit reference agencies.

We think, therefore, that we have given data subjects the best of both worlds. General access rights are given the benefit of the Bill's more extensive protections. And the new, optional, limited right preserves the advantages of speed and cheapness from the 1974 Act.

Those of your Lordships with an eye for detail will note that we have as a consequence removed rights of access to personal data from the scope of the 1974 Act. We have left other access rights (for partnerships and unincorporated bodies) under that Act intact. They are not the business of this particular Bill.

We have also preserved the rights of individuals who consider their consumer credit files to be incorrect, which are found in Section 159 of the 1974 Act. But where those rights relate to personal data, we have provided for their enforcement to be the responsibility of the data protection commissioner rather than, as now, of the Director General of Fair Trading. This is also part of the policy of bringing all of the 1974 Act's rights in respect of personal data into the Bill's fold. The rights in Section 159 are of course without prejudice to data subjects' rights under Clause 12 of the Bill, and the fourth data protection principle, in respect of inaccurate data.

These amendments therefore represent a clear shift of emphasis. That brings with it an increase in the commissioner's responsibilities. We are looking into the matter of an appropriate transfer of resources accordingly. I hope your Lordships will be able to welcome these amendments as an improvement to both data protection and consumer credit law.

Perhaps I may use this opportunity to mention a subject not specifically dealt with by this group of amendments; namely, enforced subject access. At Second Reading, I mentioned two important omissions from the Bill. One was the transitional provisions in relation to which the Government have now brought forward amendments to be discussed later in the course of Report stage. The second was provisions to meet the Government's commitment to outlaw the practice of enforced subject access.

I very much regret that the Government have still not yet been able to bring proposals on that second matter before this House. It is proving to be an extremely difficult issue. We still, however, intend to do something about the problem and will try to bring forward proposals at Third Reading. If we cannot manage to do so, we shall be looking to return to the matter in another place.

I now turn to Amendments Nos. 10 and 11 in this grouping. These are technical amendments. They ensure consistency in the terminology used within Clause 7. That is what the directive says. Subsection (1)(c) refers to the "communication" of information. Subsection (5), which relates to the same information, inadvertently uses the verb "supply", which is the language of the 1984 Act. These amendments substitute "communicate" for "supply" in subsection (5).

In Committee, the noble Lord, Lord Teviot, proposed an amendment to Clause 7(1)(c) to add the words, "or made available", to the word "communicated". The noble Lord thought that the addition of "or made available" would deal with the situation where people were given the opportunity to find for themselves information that it might be wearisome for somebody else to find. We said that we did not believe that "communicated" constrained the means by which information was provided. Because of what the noble Lord said, we consulted parliamentary counsel as to whether our view was correct. She confirmed that view. Under Clause 8(2) the controller, by agreement with the subject, may make information available to the data subject otherwise than by providing him with a copy. We therefore thought that the assurances we gave to the noble Lord were met, and hoped that by checking with parliamentary counsel we could give him further reassurance as to the concerns he raised in Committee.

Amendment No. 14 is, again, a rather technical amendment. It changes the definition of "relevant day" in Clause 7. Noble Lords may recall that we amended this definition in Committee to improve its drafting. I am afraid that even with those improvements, the definition as it stands is not quite right.

The Bill sets a time period within which data controllers must respond to subject access requests. As the Bill stands, the period may in some cases not start until the data controller has also obtained the consent of any third party who can be identified from the information in question. This could have the effect of delaying a data subject's access to the rest of this information unnecessarily. That is not what we want. The amendment, read with the existing Clause 7(5), addresses the point.

There is one other amendment in this group standing in the name of the noble Viscount, Lord Astor. Subject to the views of other noble Lords, I thought that I would leave the noble Viscount to develop that amendment. I beg to move.

4.15 p.m.

The Earl of Northesk

My Lords, as the noble and learned Lord has indicated, a number of these amendments bring an individual's rights of access to his credit reference agency files under the data protection regime. On the surface there is nothing wrong with that, albeit that the access has been satisfactorily regulated for 25 years under the Consumer Credit Act—which, incidentally, gave the first subject access rights available in the UK.

This is a major change being introduced at short notice, to all intents and purposes without consultation with the consumer credit industry. The potential knock-on effects are considerable. It could be argued that the primary function of the Consumer Credit Act is to ensure responsible lending, whereas the primary function of the Data Protection Act is to ensure confidentiality. The tension between those two very laudable aims has already led to enforcement action from the Data Protection Registrar in this area. The Data Protection Tribunal, seeking to balance the need for both responsible lending and confidentiality, gave a ruling. When lenders check the existing commitments of an applicant for a loan, credit reference agencies supply information about members of the applicant's family at the same address to avoid financial over-commitment in a family. The Director General of Fair Trading adjudged that an individual searching his or her credit reference agency file should be given all the information with which a lender might be supplied. Thus, so-called "third party" information may be included in an individual's file. That is a relatively small price to pay to avoid over-indebtedness and fraud.

However, Amendments Nos. 12 and 16—relating to the effective removal of subsection (8) of Clause 10—run against the grain of that ruling.

The provisions relating to disclosure in the current Data Protection Act and this Bill would appear to have two possible effects on the present situation. Either a data subject would not see all the information that might be given to a lender; or the credit industry would effectively no longer be able to see information about other persons with the same surname at the same address as the applicant. The consequences of either scenario would be very grave for the industry. The Bill is all about striking the right balance. While the credit reference industry may not be particularly popular, it is nonetheless an important contributor to personal and national prosperity. These amendments put it, and the safeguards to ensure its continuing viability and responsibility, at risk.

I should like to take this opportunity to make a more general point, which may become something of a refrain as we progress through the Bill. The noble Lord, Lord Williams of Mostyn, began his contribution to the Grand Committee with a mild chiding: I would gently ask that amendments are put down in a reasonable time".—[Official Report, 23/2/98: col. CWH 4.] I do not wish to carp, but the Government tabled a number of amendments on Thursday and Friday of last week which, taken in toto, could fundamentally alter the balance of the Bill to date. Moreover, the substance of many of them concerns matters which have not been widely trailed and which, as a result, were not well rehearsed in Grand Committee. The amendments to which I have referred are a case in point. I hope, therefore, that the Government will give careful consideration to whether it is appropriate to press ahead with these amendments and others at this stage. In the circumstances, it might be more appropriate to think in terms of bringing them back at Third Reading when we have had the opportunity to reflect more adequately on their likely impact and effect.

Turning to Amendment No. 70, which is also in this grouping, I have considerable reservations about this new clause. As the noble and learned Lord explained, the amendment to Section 158(1) of the Consumer Credit Act 1974 substitutes a new meaning to the defined expression "the consumer" by extending it to partnerships and unincorporated bodies. Whatever the merits of so doing in a data protection sense, this revision is not repeated by way of amendment to the provisions of Section 158(5), which still talks about files in relation to an individual, an expression which will be removed from Section 158(1)(a). This is compounded by the amendment now proposed to Section 159(1), which will remove the expression "consumer" and substitute the expressions "individual" and "objector", the latter being defined in relation to the former—that is, individuals—but no longer being relevant to the definition of "consumer" in Section 158(5). These amendments show an alarming lack of clarity and consistency of thought. As drafted, they are highly likely to create a muddle and lead to inconsistencies of interpretation.

Equally disturbing is the amendment proposed in relation to the new subsection (8)(b) to Clause 159. This appears to have the effect of giving the data protection commissioner exclusive jurisdiction in relation to correction of information relating to individuals—that is to say, objectors other than partnerships or other unincorporated bodies or persons. I contend that such exclusivity runs against the grain of the Bill's intent to strike an adequate and appropriate balance in data protection terms. Perhaps inevitably, I find myself repeating my counsel to the noble and learned Lord that here again is an instance where our interests might best be served if we can return to the matter at Third Reading, particularly bearing in mind the apparent absence of any proper and/or effective consultation with credit reference agencies on these matters.

Lord Teviot

My Lords, at this stage I am grateful to the noble and learned Lord the Solicitor-General for referring to my earlier amendment at Committee stage with regard to the word "communicated" and for having taken the matter further. I fully accept what the noble and learned Lord says.

Viscount Astor

My Lords, I had been going to suggest that my Amendment No. 15 be degrouped from this group of amendments, as it concerns a different subject. However, being a helpful kind of person, I will speak to it now in order to give the Minister a chance to think about how he will respond to my noble friend.

At Committee stage I moved an amendment to delete "trade secret" and insert "intellectual property". The noble and learned Lord the Solicitor-General said: that is a very legalistic way of dealing with the issue".—[Official Report, 23/2/98; col. CWH 44.] I was not entirely sure whether, from a lawyer, that was a compliment or a criticism. However, being a modest person, I took it as a criticism and have therefore come up with a new amendment to insert "or intellectual property" and leave in "trade secret".

I am told, on wise and learned advice, that the law of trade secrets and confidential information is very much a subset of general intellectual property law. As I understand it, the noble and learned Lord said at Committee stage that that was not necessarily the case and that "trade secret" could cover the matter. My advice is that there is a different view, which is shared by industry. I believe there are many who believe that there should be a specific provision allowing information involving intellectual property in addition to trade secrets—if indeed it is additional, which the noble and learned Lord does not yet agree, though I hope he will do so—to be exempt from the data subject's right to be informed of the logic involved in certain automated decision-making. As I have indicated, this is consistent with paragraph 41 of the directive, which states that this right, must not adversely affect trade secrets or intellectual property". My amendment is thus taken straight from the directive.

The Minister said that "trade secret" includes intellectual property. I accept that there seems to be a difference of legal advice on this matter. However, I think it would be unwise if we allowed that to be the case. Including my words in the Bill would remove any question about the matter. I therefore hope that the noble and learned Lord will be able to accept my amendment.

Lord Falconer of Thoroton

My Lords, perhaps I may deal first with the points raised by the noble Earl, Lord Northesk, relating to the Consumer Credit Act aspects of the amendments proposed. I believe he was right to point out that these amendments were only put down last Thursday. There has therefore perhaps not been sufficient time for noble Lords to consider them as they would have liked. Many of the points made by the noble Earl merit further consideration.

He is wrong to say that credit reference agencies were not consulted before these proposals were put down; they were. The way forward seems to me to be that the amendments should proceed at this stage but arrangements should be made for the noble Earl and those whom he thinks appropriate to meet with officials from the department of my noble friend Lord Williams of Mostyn so that the matters which he raises, which were well put and have considerable importance, can be properly discussed and the matter returned to at Third Reading if that proves necessary following those discussions. I hope that that deals with the legitimate concerns that the noble Earl raised.

Lord Skelmersdale

My Lords, there is a procedural difficulty here, is there not? This is Report stage; the next stage will be Third Reading, when amendments are prohibited if the matter has been agreed to at a previous stage, which will be the case under the arrangements proposed by the noble and learned Lord. The only way I can see out of this difficulty is that, should the noble and learned Lord advise that amendments are necessary, those amendments would have to be made in another place and return to your Lordships' House as amendments to the Bill as passed here. I do not consider that a very satisfactory arrangement. My noble friend certainly has a point.

4.30 p.m.

Lord Falconer of Thoroton

My Lords, I am advised that it is possible at Third Reading to make amendments even on matters which have been agreed to, so I do not believe that the procedural point to which the noble Lord refers exists. In any event, after discussion with the noble Earl, if there are matters that the Government consider should be amended, we can obviously bring forward amendments. I do not believe that the procedural difficulty is as described and is a reason for not pursuing the eminently sensible course that I have proposed.

I turn to the amendment of the noble Viscount, Lord Astor. He suggested that it was a new amendment. Obviously so many amendments were tabled in Committee that he forgot this one. In fact, he tabled a similar amendment in Committee.

I listened carefully to his further explanation of why it is necessary to insert a reference to "intellectual property" to sit alongside the reference to "trade secrets". Despite the genuinely persuasive way he put it, I remain firmly of the view that the addition is both unnecessary and inappropriate.

The noble Viscount referred to Recital 41 of the directive, which says that the right to information about the logic involved in automatic processing of personal data, must not adversely affect trade secrets or intellectual property and in particular the copyright protecting the software". Recital 41 is a comment on the third indent of Article 12(a) of the directive. Although Article 12(a) is in general terms, it allows the provision of information about the logic involved in automatic processing to be confined to fully automated decisions of the kind dealt with in Clause 13 of the Bill. Clause 7(l)(d) takes that more limited option. So we are already narrowing right down the scope for the provision of information about the logic underlying automated processing as far as the directive allows us.

I should say in the first place that Recital 41 refers in particular to the "copyright protecting the software." That has no application to the limited right conferred by Clause 7(1)(d). That right is limited to information about the logic involved in decision taking. That does not include details of the software which may be instrumental in the application of the logic to the decision-taking process itself.

In the context of the limited right established by Clause 7(1)(d), Clause 8(5) gives full effect to the purpose of Recital 41. Clause 8(5) limits the right provided by Clause 7(1)(d). Clause 7(1)(d) creates a right to be given information by a data controller. It confers no rights whatever to obtain copies of anything that the data controller has. Nor does it confer any new rights on the data subject to use the information he receives. It simply requires the data controller to produce some description of the factors and weightings involved in the decision taking. It therefore leaves intact the law of copyright and other issues of intellectual property. As Recital 41 says, the right we have created does not adversely affect intellectual property rights per se.

In effect, Clause 7(l)(d) is giving the right to be told the information behind the logic of the decision-taking process. All it gives is a right to information, not to copies of anything, and therefore all that one is concerned about is trade secrets.

The only legitimate concern that data controllers can have about this right is that it could force them to disclose information which is not generally known and which has some commercial or other value by virtue of that fact. That is what we understand to be the essence of a "trade secret" whether or not that information is in copyright form or the subject of other intellectual property rights. It is information which needs protection from disclosure. Clause 8(5) gives it that protection from the requirement to disclose in accordance with Clause 7(1).

"Trade secret" is a term with a clear pedigree in statutory use and, as I observed in Grand Committee, in case law. If the House wishes, I can recite a rather long list of statutes in which the term is used. I suspect that that might weary the House. I would, though, just mention Section 39 of the Radioactive Substances Act 1993. That imposes a requirement to give public access to certain documents, except in so far as the disclosure of any such document would involve the disclosure of, for example, a trade secret. The House will see the similarity between that provision and Clause 8(5) in this Bill.

We have had the same anxieties as the noble Viscount, Lord Astor. We carefully considered the matter but, having regard to the fact that the right is only to information and the only danger in relation to that is disclosure of trade secrets, we believe that the route that we have adopted provides adequate protection and that the words, "or intellectual property", which the noble Viscount suggests should be put in, would simply confuse the matter and be inappropriate in the circumstances.

Baroness Nicholson of Winterbourne

My Lords, before the noble and learned Lord concludes his response on Amendment No. 15, will he reassert that the reason for not supporting that amendment is that the intellectual property to which the noble Viscount is inadvertently referring is the software, which is fully protected already by the copyright Act 1988 and its subsequent amendments? Am I correct in that?

Lord Falconer of Thoroton

My Lords, I am grateful to the noble Baroness for that intervention. I am sure that the noble Viscount had that in mind in part, although I suspect that he had concerns about other intellectual property rights apart from copyright.

The noble Baroness, Lady Nicholson, is absolutely right. There is no problem about the copyright of software, for the reasons I indicated, nor about any other legal right apart from trade secrets. That is specifically dealt with in the context of the Act. I am sorry that it was such a lengthy explanation. I hope that it gives the noble Viscount some comfort, in the light of which he will withdraw his amendment.

Lord Campbell of Alloway

My Lords, perhaps I can ask for clarification. Can the Minister say whether there is any other statute of which he is aware, where "intellectual property" is used as a defined term of art?

Lord Falconer of Thoroton

My Lords, I am not aware of such a statute, though there may be one. Perhaps I can make inquiries and write to the noble Lord if I find a statute where that phrase is used.

Lord Campbell of Alloway

My Lords, if the term "intellectual property" were to go on the face of the Bill, it could create a precedent.

Lord Falconer of Thoroton

My Lords, it may well do. I am obliged to the noble Lord for raising the point.

Baroness Nicholson of Winterbourne

My Lords, the noble and learned Lord will be aware that we are bound by our signature to the Berne Convention and to WIPO as well, which I imagine feed into statutory legislation somehow, though I do not know precisely how.

Lord Falconer of Thoroton

My Lords, that is correct. I believe I had concluded my remarks.

Viscount Astor

My Lords, as the noble and learned Lord said and as I remarked earlier, I moved this amendment at Committee stage. I took note of what the noble and learned Lord said then, which is the reason I came back to it. There is an anxiety about what is and what is not a "trade secret" and how intellectual property and copyright fall under it. I shall certainly study carefully what the noble and learned Lord said in his response and consider whether this is an area to which we will need to return on Third Reading.

The Earl of Northesk

My Lords, before the noble and learned Lord sits down and with apologies for returning to the subject of credit reference agencies, perhaps I can say that I am grateful for his generous offer. However, in conceding that I raised one or two legitimate concerns, I am bound to ask whether the amendments to which I spoke, if they are accepted today, are amendable subsequently in a way which will address my concerns. Does the noble and learned Lord have any suggestion as to how, procedurally, he may seek to resolve that difficulty?

The Deputy Speaker (Lord Brougham and Vaux)

My Lords, perhaps your Lordships will permit me to put the House in order. We will move on from Amendment No. 9 to Amendment No. 10, at which time the noble and learned Lord will be able to speak again. The Question is that Amendment No. 9 be agreed to. As many as are of that opinion will say "Content"; to the contrary "Not-Content". The Contents have it.

On Question, amendment agreed to.

Clause 7 [Right of access to personal data]:

Lord Falconer of Thoroton moved Amendment No. 10: Page 5, line 39, leave out ("supplying") and insert ("communicating").

The noble and learned Lord said: My Lords, I have formally spoken to this amendment. The standing order rules state that, The principal purposes of amendments on Third Reading arc to clarify any remaining uncertainties, to improve the drafting and to enable the Government to fulfil undertakings given at earlier stages of the bill. It is undesirable that an issue which has been fully debated and decided upon at a previous stage of a bill should be re-opened by an amendment on Third Reading". I should have thought that that is more than enough to deal with the procedural difficulties.

Lord Skelmersdale

My Lords, I am grateful for that clarification. Nonetheless, should a Member of your Lordships' House wish to remove part or all of one of the amendments proposed by the noble and learned Lord, he could not do so.

Lord Falconer of Thoroton

My Lords, the relevant words seem to me to be: It is undesirable that an issue which has been fully debated and decided upon at a previous stage of a bill should be re-opened by an amendment on Third Reading". One can simply read this debate and see where we stand in relation to Third Reading. Speaking for myself, I should have thought that, procedurally, there is no bar.

Lord Skelmersdale

My Lords, with the leave of the House, does the noble and learned Lord therefore agree with me that these subjects are not being fully debated now?

Lord Falconer of Thoroton

My Lords, the amendments were tabled on Thursday of last week and the noble Earl, Lord Northesk, has raised certain points that need further discussion. If those cannot be resolved, speaking for myself—though it is not a matter for me, it is a matter for the House—there could then be a proper debate on those issues that have not been fully aired during the course of this debate. At the moment, and speaking from a position of immense lack of experience, it does not seem to me that it gives rise to procedural difficulties, because the detail of what the noble Earl, Lord Northesk, has said has not been fully debated today.

Lord Campbell of Alloway

My Lords, nothing has been decided—I have not been here the whole time but I am interested in this matter—and neither has anything been fully debated. So how, procedurally, is the House put in balk for Third Reading? Nothing has been decided except a sensible meeting to seek to decide.

Lord Falconer of Thoroton

My Lords, I entirely understand what has been said. In formal terms, the amendments will go though at this stage and then we will come back to them at Third Reading, when there can be, as I understand it, such necessary full debate on those matters not fully ventilated at this stage.

On Question, amendment agreed to.

Lord Falconer of Thoroton moved Amendments Nos. 11 to 14: Page 5, line 40, leave out ("supplied") and insert ("communicated"). Page 6, line 4, at end insert— ("(6A) An individual making a request under this section to a credit reference agency may specify that his request is limited to personal data consisting of information as to his financial standing."). Page 6, line 12, at end insert— (""credit reference agency" has the same meaning as in the Consumer Credit Act 1974;"). Page 6, line 24, leave out from ("has") to end of line 29 and insert ("both the required fee and the information referred to in subsection (3)").

The noble and learned Lord said: My Lords, I have already spoken to these amendments. I beg to move.

On Question, amendments agreed to.

Clause 8 [Provisions supplementary to section 7]:

[Amendment No. 15 not moved.]

Lord Falconer of Thoroton moved Amendment No. 16: Page 7, line 24, leave out subsection (8).

The noble and learned Lord said: My Lords, I have already spoken to this amendment. I beg to move.

On Question, amendment agreed to.

Forward to