Data Protection Bill [H.L.]

HL Deb 16 March 1998 vol 587 cc495-543

5.15 p.m.

Consideration of amendments on Report resumed.

Clause 9 [Right to prevent processing likely to cause damage or distress]:

Lord Williams of Mostyn moved Amendment No. 17: Page 7, line 36, after second ("controller") insert ("at the end of such period as is reasonable in the circumstances").

The noble Lord said: My Lords, I beg to move Amendment No. 17. Amendments Nos. 17, 18, 22 and 23 are grouped with Amendments Nos. 24 to 28 and 72.

I refer first to Amendments Nos. 17, 18, 22 and 23. At the moment Clauses 9 and 10 provide for data subjects to be able to give data controllers written notice requiring them to cease within a reasonable time or not to begin certain processing activities. The idea of "within a reasonable time" is simple enough. There should be a reasonable margin of time for the controller to put his affairs in order as soon as necessary to comply with the notice. It would be unreasonable in every case to expect him to respond instantly. As drafted, however, these clauses give that measure of latitude only in respect of the requirement to cease processing. There is no such qualification in respect of requirements not to begin. Having thought about it, we believe that that is not right.

If a data controller's plans to begin processing are very far advanced it may be very onerous to expect him to bring those plans to an instant halt in every case where he receives a notice of objection. These amendments in effect introduce a requirement for reasonable notice in such circumstances. The amendments, however, do not say that it will never be right to expect a data controller to bring his plans to an instant halt. In some cases it may well be reasonable to expect a data controller not to begin at very short notice, but not always. Much will depend on individual circumstances. These amendments are designed to introduce the necessary flexibility.

Amendment No. 19 in this group is in the name of the noble Lord, Lord Norton, and therefore I pass over it. I turn to Amendment No. 20. This amendment amends an amendment that we made in Committee. We have re-scrutinised it with some care. We did not get it quite right technically, for which I apologise. Subsection (1)(a) of Clause 9 starts at the wrong place so that subsection (1)(b) does not read intelligibly. This amendment is designed to sort that out. Amendments Nos. 21 and 24 are further government amendments and are designed to address points made by the noble Lord, Lord Norton, in Committee. He pointed out that in Clauses 9 and 10 there was no requirement for the data controller to respond to a written notice from an individual objecting to processing. Without such a response the individual would have no means of knowing whether his objection had been successful or, if unsuccessful, why it had been rejected. A requirement to respond in writing to a notice of objection would provide a link between the data controller and the data subject and hence the opportunity for dialogue before the data subject needed to consider involving the commissioner or referring the matter to the courts.

I explained in Committee that a written reply to a notice under Clause 9 or 10 is not essential to ensure compliance with the notice, in contrast to subject access requests made under Clause 7 where the only satisfactory way to comply is to reply in writing. I stressed nonetheless that I saw some force in the noble Lord's points and undertook to consider them further. We have indeed given further thought to the matter and have concluded that amendments in this regard would be helpful. I understand that they would also be welcomed by the registrar.

The amendments would oblige data controllers to respond in writing within 21 days to written notices from individuals seeking to prevent or stop processing likely to cause substantial damage or distress to themselves or others; or the processing of their data for direct marketing purposes. In the first of these instances, Clause 9 cases, controllers would either have to confirm that they had complied or intended to comply with the notice of objection or explain why they thought it unjustified and say to what extent, if any, they had complied or intended to comply with it. In the second instance, Clause 10 cases, where the issue is more straightforward, controllers would simply be required to explain how they had complied or intended to comply. A data subject receiving such a written response would thereby know in a straightforward way whether his request had been complied with and, if it had not, whether there was any basis for further dialogue before involving the commissioner or resorting to litigation.

Amendments Nos. 25 to 28 and 72 are also within this extensive list of amendments. At the moment, Clause 13 imposes a general prohibition on certain forms of automated decision taking which significantly affects data subjects. There are exceptions to the prohibition. But the practice is effectively otherwise banned. It has been put to us that this in fact goes further than the directive actually requires. We think on reflection that that is right. The directive is not expressed in terms of a ban but in terms of giving everyone the right not to be subject to these decisions, which is not the same. We do not wish to impose more restrictions on data controllers than are necessary to safeguard the rights required by the directive, so the amendments remove the ban and confer rights instead.

The difference in practice is that with a ban, no one can take these decisions—except in the exempted circumstances—without running the gauntlet of the entire regulatory mechanism which the Bill sets up. That is too heavy handed. We are therefore giving a right of objection. So, until someone objects, the matter is essentially one for the judgment of the data controller. This is therefore very much on the model of the right to object to direct marketing, set out in Clause 10. We have taken care to ensure that the new right to object properly safeguards the individual's position.

First, there is a general right by notice to require any data controller to refrain from taking these decisions, enforceable by the commissioner or through the courts.

Secondly, data controllers are required to inform data subjects who have not given such notice that a decision has been taken solely by automatic processing. The data subject can then exercise his right to serve a notice within 21 days on the data controller to have the decision reconsidered or taken on a different basis. The data controller must then respond within 21 days to that notice by giving the data subject details of how he intends to comply with the notice.

This revised clause aligns the right not to be subject to automated decision taking more closely with the directive and with the two other key rights in Clauses 9 and 10. I commend these amendments to your Lordships. I beg to move.

On Question, amendment agreed to.

Lord Williams of Mostyn moved Amendment No. 18: Page 7, line 37, leave out ("within a reasonable time").

On Question, amendment agreed to.

The Deputy Speaker

My Lords, I advise the House that if Amendment No. 19 is agreed to, I cannot call Amendment No. 20.

Lord Norton moved Amendment No. 19: Page 7, line 39, leave out from ("subject") to ("would") in line 44 and insert ("where there are compelling legitimate grounds for believing that the processing of those data or their processing for that purpose or in that manner").

The noble Lord said: My Lords, the amendment relates to Clause 9: Right to prevent processing likely to cause damage or distress". The amendment seeks to replace the words "substantial damage" and "substantial distress" with the words appearing in Article 14 of the directive: "compelling legitimate grounds".

As the clause is drafted, the information which is being processed legally may not be processed if it is likely to cause the data subject substantial damage or substantial distress, together with a further test that the damage is unwarranted. Presumably, if the data controller dislikes the data subject and acknowledges that substantial damage or distress is going to be caused, but considers that the processing is warranted, then the data processing is permissible. After all, the criteria are all subjective judgments.

I have been informed by officials at the Home Office that there is no hidden agenda behind the wording of the clause and that the words "substantial damage" and "substantial distress" are their interpretation of the meaning of "compelling legitimate grounds".

I disagree, which is why I have tabled the amendment. I should be grateful to hear the Minister's reasons as to why the damage should be unwarranted. A further complication appears to present itself in that the data subject appears to have no rights to object to data processing, whether or not it causes damage, once the data subject has given consent under paragraph 1 of Schedule 2. That is contained in subsection (2)(a) of the clause. That seems to be a little harsh. I should he grateful to hear the Minister's explanation for that point. I beg to move.

The Earl of Northesk

My Lords, I apologise. I missed the opportunity to speak to Amendment No. 17 when the Minister spoke to the whole group of amendments. I shall intervene here and speak to my concerns relating to Amendments Nos. 24 and 25.

Amendment No. 24 mirrors the requirement that we shall presumably pass in Clause 9 that the data controller should have a duty to advise data subjects of those steps being taken to ensure that the processing of their data has ceased or will not even begin.

Of course, Clause 9 seeks to prevent processing that is unwarranted, as causing or being likely to cause substantial damage or substantial distress. For such data the additional protection of the data subject being advised of how the data controller intends to prevent processing is eminently sensible. There is nothing wrong with that. I am less certain that that is an appropriate approach to Clause 10, which relates to direct marketing.

As the Minister will be aware, a widely used practice in the direct marketing industry is that of offering the customer the opportunity of indicating his wish not to have his data further processed by means of an opt-out tick box. That methodology has distinct advantages. It is simple, concise and clear to both the customer and the business concerned. At issue here is whether it is intended that such tick boxes should be interpreted as being data subject notices. Legal advice obtained by the British Retail Consortium indicates that they should be. If that is the case, it will have the inevitable effect of adding considerably to the administrative costs of, for instance, the mail order catalogue industry.

The isolation of negative option ticks from the volume of orders processed within the specified time frame of 21 days would involve extensive extra work and cost. Moreover, on the basis that that system has operated well enough to date, it is highly unlikely that any real benefit would accrue to the data subject in those circumstances. In fact, he could be severely inconvenienced in the event that, on strict interpretation, he may be required to send any written objection to further processing separately from his having ticked the opt-out box.

In effect, the amendment's application to that practice will do little to enhance consumer protection or human rights. It may even work actively against them. I hope that the Minister will be able to tell me that, as with the slightly related amendment in Grand Committee, I am worrying unnecessarily although, as I have said, the BRC's legal advice is that I am not.

That said, if my interpretation is correct, it strikes me that Amendment No. 24, notwithstanding the Bill's avowed intent to strike an appropriate balance, will work disproportionately against the direct marketing industry. It may be worth adding that, on my interpretation, that industry would, in any event, be subject to the similar provision in Clause 9, albeit only in severe cases, and that that could he interpreted as being adequate to afford data subjects the protection intended by the amendment.

On that basis, I wonder whether Amendment No. 24 is strictly necessary, especially bearing in mind that the directive gives no indication that the procedure arising from it is required. Inevitably, I return to my refrain. It seems to me that this is another instance of a substantive matter, not widely trailed, which will alter the balance on the face of the Bill.

I move to Amendment No. 25. Clause 13 as it stands complies with the directive. On my interpretation, Amendment No. 25 will widen the effects of the Bill into areas not effectively allowed for in the directive. As I understand it, Amendment No. 25 envisages that an individual, writing in advance to a series of companies with which he does not necessarily have any contract, would be entitled to assert his right to ensure that the data controller in question would make no decisions about him based solely on the processing of his personal data by automated means.

On the surface, that seems to be a case of creating work when no work is necessary. I am bound to ask what purpose such a procedure is intended to serve. How often do the Government envisage that data subjects will exercise their rights in that regard? So far as concerns data controllers, it will mean inevitably that they will have to introduce systems and train personnel to accommodate such requests from data subjects, even though they may not have had any dealings with them.

Experience has shown that training staff to perform functions that are seldom put to use, or serve no useful apparent purpose, is not only wasted but debilitating to the morale of the staff concerned. What is important is that it has the adverse effect of diluting the effectiveness of training. On a more general level, it could be interpreted as having the effect of imposing unnecessary burdens upon business rather than retaining the proportionate balance that the Bill is intended to serve. I question whether that is the Government's intention.

I return to my refrain, although I suspect that it is unlikely to be heeded, that, surely, this is another occasion when further reflection between now and Third Reading would be desirable.

5.30 p.m.

Lord Skelmersdale

My Lords, I welcome Amendment No. 24 because it gives me an opportunity to make three points. First, I thank the Minister for fulfilling his promise in Grand Committee to write to me about direct advertising by the tobacco trade.

Secondly, over many years, and most recently in a joint EC sub-committee and the Statutory Instruments Joint Committee on which I had the honour to serve, I have been interested in the processes by which European law is translated into British law. Indeed, on occasions I have identified the temptation, to put it mildly, of officials, in the deliberations between Brussels and Parliament, to add little twiddles to miscellaneous European legislation. It occurs to me that this might be one such case and if so it is perhaps desirable.

The Liberal Democrat Benches gave an example of "gold plating", as it is known, receiving public approval and the Minister accepted an amendment in principle on that basis. It is pertinent to the operation of the directive in this country, with our particular and peculiar circumstances. However, it is not acceptable when the "gold plating" is hidden and I believe that this might well be such a case.

Amendment No. 24 defines a data subject notice. References to all other definitions in the Bill are found under Clause 62. Therefore, I believe that reference to the notice could, with some degree of use and therefore clarity to those reading the Bill, be included in Clause 62. I hope that the Minister will consider that.

Lord Williams of Mostyn

My Lords, I certainly can and if it is an appropriate course to take we will take it. I shall take advice on the matter.

I am grateful for the welcome given in part by the noble Lord, Lord Skelmersdale, and for the comments made by other noble Lords. Specific questions have been raised; for instance, whether under Clause 9(2)(a) any consent given under paragraph 1 of Schedule 2 is not capable of being withdrawn? Any consent given in any part of the Bill may be withdrawn at any time and there is nothing to prevent that.

The noble Earl, Lord Northesk, asked about the problem of the tick box. We believe that a tick box is capable of being a written notice for the purposes of Clause 10(1). The noble Earl indicated that there had been discussions with various trade organisations and officials. We remain of the view that if further discussions are thought to be appropriate officials are always ready to consider improvements. I stress that these are difficult technical areas and we welcome informed criticism and scrutiny. I hope that we have demonstrated that throughout the passage of the Bill.

As regards the amendment tabled by the noble Lord, Lord Norton, the directive uses the words "compelling legitimate grounds relating to his particular situation". In our judgment, that is not satisfactory statutory language. I take the point that if at all possible one ought not to twiddle. Perhaps one ought to try to use the spirit and language of the directive and translate it into what is apt for our particular legislative and constructive tradition. We do not believe that the phrase "compelling legitimate grounds relating to his particular situation" is satisfactory in terms of statutory language. It does not mean much, except that the data subject must make a strong case.

We do not see that the courts will be able to give a reliable interpretation of that. How is the data controller, going about his lawful business, to know when he must yield to the interests of a data subject? We believe that this is one of the instances, referred to earlier, where there is a need to bring the words of the directive into sharper focus in order to obtain clarity and consistency. We have taken the view that for a data subject to make out compelling legitimate grounds he must make a case that the processing would damage him or someone else in some way; physically, in monetary terms or by way of distress. Because the presumption is that the data controller must be able to go about his lawful business, we have said that to be a compelling case the harm must be substantial and unwarranted.

That is a high threshold and is intended to be such. The directive indicates that. I do not wish to sound brutal, but some loss and distress are the small change, the regular consequences, of competition. One man's success in business may be his competitor's disappointment. That is not what the legislation is supposed to be about. We need to define matters with care and we believe that the literal words of the directive will not do. The directive's job, in Article 14, is to state terms of policy. The Bill's job is to work that policy carefully into the existing framework of enforceable rights and freedoms laid down elsewhere in the directive. It is not simple, but we believe that we have got it about right, giving effect to the intentions of the directive, in essential guidance on which everyone involved can confidently rely.

Finally, we must come to a judgment about where we draw the balance. I hope that your Lordships will believe that we have done so properly. Perhaps I may refer again to the issue of objection which was raised in a more general context by the noble Earl, Lord Northesk, as opposed to his specific question about tick boxes. We are trying to safeguard the interests of business. Instead of expecting someone in business, running any form of organisation, to have to run the gauntlet of the entire regulatory mechanism which the Bill sets up, we say that until someone objects it is a matter for the judgment of the data controller.

I take the noble Earl's point that one might be setting up systems and having employees trained for the rather and task of doing nothing—quite unlike any experience on the Front Bench in your Lordships' House! We have taken the model which most people believe is capable of working sensibly and reasonably in practice; the right to object to direct marketing as set out in Clause 10. It is true that one might have the extreme circumstance of the excessive individual who will write objecting to companies which have no sensible connection with his or her activities. However, we believe that that will be most unusual. Most people exercise their rights sensibly and we must construct a legislative framework which will deal with that.

I hope that with those comments I have satisfied your Lordships of the merits of the Government's amendment and I ask the noble Lord, Lord Norton, to withdraw his.

Lord Norton

My Lords, I beg leave to withdraw my amendment.

Amendment, by leave, withdrawn.

Lord Williams of Mostyn moved Amendments Nos. 20 and 21: Page 7, line 39, leave out from ("reasons") to first ("is") in line 42 and insert— ("(a) the processing of those data or their processing for that purpose or in that manner"). Page 8, line 2, at end insert— ("(2A) The data controller must within 21 days of receiving a notice under subsection (1) ("the data subject notice") give the individual who gave it a written notice—

1. (a) stating that he has complied or intends to comply with the data subject notice, or
2. (b) stating his reasons for regarding the data subject notice as to any extent unjustified and the extent (if any) to which he has complied or intends to comply with it.").

The noble Lord said: My Lords, I have already spoken to Amendments Nos. 20 to 28. I beg to move.

On Question, amendments agreed to.

Clause 10 [Right to prevent processing for purposes of direct marketing]:

Lord Williams of Mostyn moved Amendments Nos. 22 to 24: Page 8, line 13, after second ("controller") insert ("at the end of such period as is reasonable in the circumstances"). Page 8, line 13, leave out ("within a reasonable time"). Page 8, line 15, at end insert— ("(1A) The data controller must within 21 days of receiving a notice under subsection (1) ("the data subject notice") give the individual who gave it a written notice specifying the steps that he has taken or intends to take to comply with the data subject notice.").

On Question, amendments agreed to.

Clause 13 [Automated decision-making]:

Lord Williams of Mostyn moved Amendments Nos. 25 to 28: Page 9, line 28, leave out subsection (1) and insert— ("(1) An individual is entitled at any time, by notice in writing to any data controller, to require the data controller to ensure that no decision taken by or on behalf of the data controller which significantly affects that individual is based solely on the processing by automatic means of personal data in respect of which that individual is the data subject for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct. (1A) Where, in a case where no notice under subsection (1) has effect, a decision which significantly affects an individual is based solely on such processing as is mentioned in subsection (1)—

1. (a) the data controller must as soon as reasonably practicable notify the individual that the decision was taken on that basis, and
2. (b)) the individual is entitled, within 21 days of receiving that notification from the data controller, by notice in writing to require the data controller to reconsider the decision or to take a new decision otherwise than on that basis.

(1B) The data controller must, within 21 days of receiving a notice under subsection (1) or (1 A)(b) ("the data subject notice") give the individual a written notice specifying the steps that he intends to take to comply with the data subject notice."). Page 9, line 33, leave out subsection (2) and insert— ("(2) A notice under subsection (1) does not have effect in relation to an exempt decision: and nothing in subsection (1A) applies to an exempt decision. (2A) In subsection (2) "exempt decision" means any decision—

1. (a) in respect of which the condition in subsection (3) and the condition in subsection (4) are met, or
2. (b) which is made in such other circumstances as may be prescribed by the Secretary of State by order.").

Page 10, line 1, leave out subsection (5). Page 10, line 5, after ("(1)") insert ("or (1 A)(b)").

On Question, amendments agreed to.

Clause 28 [Crime and taxation]:

The Deputy Speaker (Lord Dean of Harptree)

My Lords, if this amendment is agreed to, I cannot call Amendment No. 30.

Baroness Nicholson of Winterbourne moved Amendment No. 29:

Page 17, line 33, leave out subsection (4).

The noble Baroness said: My Lords, Amendment No. 29 seems appropriately draconian in that I have the support of the noble Viscount, Lord Astor, whose tenacity in this matter I now welcome, and I am most grateful to him for his support.

I remind noble Lords why we believe this amendment should be properly assessed. While the current Act of 1984 provides what has seemed to be an acceptable balance between providing proper respect for personal information and the needs of law enforcement and tax collection officials, Clause 28 of this Bill includes provisions which largely replicate those in the 1984 Act but with one additional subsection; namely, Clause 28(4).

I raised my concerns about that subsection in Committee and the Minister was kind enough to reassure me with a government amendment. That amendment deletes the exemption with regard to the first principle, and I warmly welcome that. But I am sorry to see, on careful examination, that it leaves intact the exemption with regard to subject access and disclosure. Therefore, in my view and that of noble Lords on this side of the House, this amendment fails to address satisfactorily the point of principle that, lacking evidence to the contrary, the exemption cannot be justified; in other words, the government amendment fails to deal with the fundamental problem with Clause 28(4) that the blanket exemption is disproportionate.

In order to justify Clause 28(4) there needs to be clear evidence that the absence of the clause would have an adverse effect on important government functions. Those functions which are not enlarged upon in the government amendment must be a department such as the Inland Revenue.

Therefore, I have moved on from the draconian amendment and have suggested in Amendment No. 30 that if we cannot persuade the Government to delete Clause 28(4) entirely, which would be wonderful, we should assist the Government by asking that clear evidence of the necessity of Clause 28(4) is given to us by a specific amendment or deletion followed by a new clause.

Noble Lords will see that Amendment No. 30 refers specifically to the collection of taxes, duties and similar impositions. In other words, Clause 28(1)(c) has been strengthened and enlarged upon. This amendment is a probing amendment and I ask the Government to take it away and examine it. If they are able to do so and will discuss the matter with me outside the Chamber in order to put forward something more appropriate in terms of wording for Third Reading, they would be able to quote Gilbert and Sullivan satisfactorily and suggest that Clause 28(4) "never will be missed".

It is too large a power to give to a modern government. It may be that in the old days of paper records my arguments on Clause 28(4) would not carry the weight which I believe they now carry. But in the days of information technology when powers can be summoned and used so swiftly in terms of access to information and personal data, I believe that Clause 28(4) as it stands is inappropriate and that something more modest, along the lines of my probing amendment, would be more suitable.

The amendment is supported by the noble Viscount, Lord Astor. Therefore, this side of the House is showing its concerns to the Government and asking them to reconsider. I know that the Government have thought carefully about it and that time is short. But I am confident that if we meet to discuss the matter, which is what I request the Minister to do, an answer could be found. I beg to move.

Viscount Astor

My Lords, I put my name alongside that of the noble Baroness to the amendment moved in Committee and I have done so again because I am concerned about the powers. In doing so, I realise that the amendment probably goes too far and a middle way should be found. Amendment No. 30 offers an interesting way forward. Therefore, I look forward to hearing the Minister's response.

5.45 p.m.

Lord Falconer of Thoroton

My Lords, we agreed during Committee stage that Clause 28 is an important part of the Bill, going directly to the balance which has to be struck between individuals' rights in respect of processing of personal data and the need in some circumstances to limit those rights in the general public interest.

The noble Baroness, supported by the noble Viscount, previously moved the first amendment during the Committee stage of the Bill. Subsection (4) allows the Secretary of State, by order subject to affirmative resolution, to specify categories of information for exemption which are generally relevant to tackling crime, apprehending offenders or assessing taxes but which may not prove relevant in every individual case. To the extent that Parliament itself approved—there would have to be a debate on the matter—a selective exemption could be made for particular categories of data. The exemption could only be for crime, offenders or taxation purposes, and as the clause now stands it could only apply to the information to data subjects provision in Schedule 1 of Part II, to the subject access provision in Clause 7 or to the non-disclosure provisions built into the principles of Schedule 1.

As the noble Baroness pointed out, the scope of subsection (4) has already been reduced by government amendment in Committee. We removed the reference to the first data protection principle—fairness and lawfulness. This was in response to general concern about the breadth of the provision, and fully met the specific concern about fairness and lawfulness expressed by the House of Lords' Delegated Powers and Deregulation Committee.

As was said in Committee, the immediate reason for including the non-disclosure exemption was to enable people to pass information to the Inland Revenue in the public interest. I do not detect any dissent from the validity of that particular exemption. The subsection (4) power takes account of the benefits of outsiders assisting the Inland Revenue's enforcement activities, without subjecting them to a test of case-by-case justification which would be completely destructive in these particular circumstances.

As to the subject information exemption, the Inland Revenue's recently introduced self-assessment system uses a range of indicators to identify individual tax returns which justify further inquiries. Subsection (4) will allow an exemption to be made for withholding this critical risk assessment information from data subjects. If it was not withheld, tax experts, if not the individuals concerned, could soon start to compare cases and deduce the revenue's criteria for further inquiry.

Together the exemptions would not only help compliance with the law but also save honest taxpayers many millions of pounds. So for the Inland Revenue, if for no other purpose, we need Clause 28(4). The complete abolition of Clause 28(4), which the noble Baroness and the noble Viscount both propose in their first amendment, does not seem a practical or sensible alternative.

I turn to the second amendment. This would retain but amend subsection (4), first, by applying it only to processing for the purposes of subsection (1)(c) —namely, the assessment or collection of taxes, duties and similar impositions—and, secondly, by replacing the order-making power with specification on the face of the Bill of the types of data to which the exemption applies. There are plainly benefits to that approach. It limits the exemption to an area of processing for which a clear need has already been identified. It would remove the concern expressed in debate about further orders, as yet unknown, coming forward in due course.

We appreciate those concerns. Indeed, we have no more desire than the noble Baroness to allow hole-in-the-corner restrictions on rights that individuals would otherwise enjoy under the Bill. But there are a number of considerations upon which I believe the noble Baroness should reflect in relation to the proposal that she makes.

First, we—and in that I include not just the Government but also Parliament—would lose the flexibility to deal with new developments. At present, I should make it clear that the Government have no other particular purposes in mind for subsection (4) than tax collection. However, circumstances change both within public administration and in the community. The Inland Revenue provision is needed now because the world has changed—more and more data controllers now use computers and the Inland Revenue has introduced a new self-assessment system. It is, in a sense, fortunate that the timing of this Bill gives us the opportunity to consider the merits of an exemption for those particular purposes.

However, once enacted, this Data Protection Bill is likely to need to serve us for a decade or more. The original 1984 Act has had to serve for 14 years, and the House will recognise that we cannot—nor would we want to—put through an amendment to primary legislation on data protection in every parliamentary Session. It is quite possible that changing practices and needs might lead to similar cases being put forward by other departments with an interest in crime or offenders as well as taxation. We do not know at this stage, but the world changes and we need some flexibility to respond when it does.

Secondly—and this is a key point—by using the order procedure we can protect the interests of individuals as data subjects by targeting our exemptions much more precisely on the particular circumstances with which they are intended to deal. That should give reassurance to the House. We do not want to be tempted to cast the exemption wider than we have to now just because there might be a shift in circumstances in, say, three years' time. The order-making procedure gives greater flexibility to tailor and re-tailor provisions and thus reduces any temptation to over-exempt in the first instance, which is what Amendment No. 30 would be in danger of doing. I say that because it relates to taxation as a whole and would, therefore, be much less well focused than the approach in the present clause, which does not give an exemption in relation to taxation as a whole but would only give it to the extent allowed by the order that is actually made.

Thirdly, as I have made clear, we are not in any case contemplating future decisions behind closed doors by civil servants or, indeed, Ministers. The requirement to submit any proposed exemption through the affirmative resolution procedure means that there must be a parliamentary debate about the merits of the case; and that no exemption can take effect unless Parliament approves it. I think that that is a considerable safeguard. Proposing the procedure was an instance of the Government's good faith in the matter. It will, in practice, serve as a protection against any unwise decisions by the Executive on a matter which might affect individuals' rights. We shall, of course, consider all the matters raised this afternoon; but, in the light of the reasons that I have set out and the assurances that I have given, I hope that the noble Baroness will feel able to withdraw her amendment.

Baroness Nicholson of Winterbourne

My Lords, I am most grateful to the noble and learned Lord for his clear exposition. I shall, of course, consider everything that he said when I have the opportunity to read Hansard. I accept the noble and learned Lord's point about Amendment No. 29 in relation to Clause 28(4) as being a very tough one. We shall no doubt reconsider the matter next week, but I remind the noble and learned Lord that Clause 28(4) is a novelty; indeed, it did not form part of the 1984 Act. I do not believe that that Act has been deficient with regard to the draconian powers that this subsection gives to government. Nonetheless, I accept the noble and learned Lord's point about Amendment No. 29 and I shall withdraw it.

However, I seek a meeting with the noble and learned Lord about Amendment No. 30 which, as he so rightly said, relates to an amendment to Clause 28(4). The noble and learned Lord argued that new developments may arise and that circumstances change. I should remind him that, if we are too prescriptive, we may fall into the trap that the French Government fell into in 1986 when they put forward such a fine-tuned computer hacking Bill that they have not been able to use it since, despite many incidents of computer hacking. That was because their definition of the computer—cerveau électronique--was so precise that it proved to be unusable the day after the legislation had been passed.

I understand precisely the point that the noble and learned Lord made, but he went on to buttress his argument by suggesting that this legislation would have a decade unchallenged and that it would have to be perfect throughout that time. I suggest to him that that will not be the case. We already know of a raft of EU directives which, one way or another, will impinge upon personal data protection. Indeed, the database legislation which the noble Lord, Lord Haskel, and I debated just before Christmas in a short space of time impacts upon this very Bill. I hesitate to speak for the noble Lord, but I believe that he may have shared my surprise when the Chamber emptied rapidly as he and I began to debate that legislation. People just do not understand the importance of this sort of legislation. Beyond this Bill a raft of possible EU directives looms, not least because, as I understand it, there will be an EU data protection registrar working with all the registrars from EU member states.

In that context, I draw the attention of the noble and learned Lord to the, as yet, undebated Schengen information agreement. That is a dramatic development, which I believe will also impact upon this legislation. Therefore, I believe that this sovereign nation—island though we may be, and despite our background of relatively fragile involvement with the EU over the past two decades—will be far more fully involved in such matters in the years to come. Indeed, I hope that we will be, because Britain has so much to offer in terms of professional knowledge and best practice to our EU partners.

In conclusion, I challenge the noble and learned Lord's argument on the implacability of this legislation, once it has been passed, in terms of other legislation not reflecting upon it. I believe that it will need to be re-examined by this House on a regular basis because of outside forces such as directives. There will be a registrar, the Schengen information agreement is already in place and there are more EU directives on the way. However perfect we make the Bill I suggest that, like the 1988 copyright Act, it will still be subject to incoming EU material which, under the new Government, I hope we will be in a position to influence rather than merely react to. That will be exciting. I ask the noble and learned Lord again for a meeting on the matter. In the meantime, I shall not press the amendment and beg leave to withdraw it.

Amendment, by leave, withdrawn.

[Amendment No. 30 not moved.]

6 p.m.

Lord Norton moved Amendment No. 31: Page 17, line 37, at end insert— ("(5) The Secretary of State may by order provide that a person specified in the order may assess any processing of personal data exempted from any provision of this Act by virtue of this section, under such conditions as may be specified in the order.").

The noble Lord said: My Lords, Amendment No. 31 relates to Clause 28. I shall not repeat the arguments that I made in Committee save to add that it would appear that most countries which have data protection legislation also have audit powers included in the legislation.

The representation that the Solicitor-General made at Committee stage of unnecessary intrusion by data protection authorities interfering in business in an irresponsible way is not a valid criticism to justify the non-use of audit powers. There are many examples in UK legislation where regulatory bodies have statutory powers of entry and inspection without consent. In some cases their powers go much further than anything suggested in the Committee stage amendments. I refer to powers contained in the National Audit Act 1983, the Audit Commission Bill, the Value Added Tax Act 1994, the Health and Safety at Work etc. Act 1974 and the Sea Fisheries Act 1968.

Further to the remarks of the Solicitor-General, a power to walk unannounced into premises and demand access to the data processing under way is unlikely ever to be needed by the commissioner. The nature of data processing is such that by asking the right questions and examining files the commissioner can usually determine whether good practice is not being followed through ignorance or default.

My amendment seeks to introduce audit powers for the specific use of Clause 28, which is a powerful clause, especially when compared with Clause 41—the information notice clause—which is at present weak. The auditors would not necessarily be from the data protection commissioner's office as that body may not have the necessary resources available. The audit bodies would be appointed by the Secretary of State. On grounds of democratic accountability alone there should be an external independent body to supervise compliance on a regular basis. I beg to move.

Viscount Astor

My Lords, my Amendment No. 49 is grouped with this amendment. That is an amendment that I moved at the Committee stage. It concerns the commissioner giving reasons. The noble Lord, Lord Williams, said at Committee stage that he accepted that my amendment applied only to the extent that the commissioner considers appropriate. However, he then added that it would not always be appropriate for her to explain her views. Of course if it is not always appropriate, she may consider that it is not appropriate. If I may say so, I felt that the noble Lord slightly contradicted himself. We want openness in this matter. I believe my amendment encourages that.

I believe that I may be speaking to the wrong amendment. I apologise to your Lordships. I should be talking about informal approaches.

I believe that the commissioner ought to make an informal approach before issuing information notices. In Committee the noble Lord said that, by and large, this happens but that it was not obligatory. I considered carefully the noble Lord's argument. However, I am sure he is aware that the Bank of England is required by the Banking Act 1987 to make such an approach when it is considering revoking a licence. Therefore there is a precedent for my amendment. In the light of that discovery I hope that the Minister will reconsider the issue.

Lord Falconer of Thoroton

My Lords, this group of amendments comprises Amendments Nos. 31, 49, 50, 64 and 75. The amendments concern the powers of the commissioner to ensure that processing is being undertaken in accordance with the provisions of the Bill. We are very much aware, particularly from the views expressed in Committee, that it is important that we should get these powers right and that they should be sufficient but proportionate.

I shall discuss not only the amendment of the noble Lord, Lord Norton, and that of the noble Viscount, Lord Astor, but also the amendment in this group that has not yet been moved by the noble Baroness, Lady Nicholson, and also the Government's Amendment No. 50. As your Lordships will be aware, the commissioner is being provided with some significant new powers in the Bill: to serve information notices and to undertake assessments of good practice, but only with the data controller's consent. It must inevitably be a question of judgment as to whether those powers are sufficient and proportionate. On the one hand, the noble Viscount, Lord Astor, suggests with his amendment that the commissioner's powers are too peremptory; he suggests that she should have to try more informal methods before being permitted to issue an information notice. On the other hand, the noble Lord, Lord Norton, and the noble Baroness press the case for significantly more assertive powers. Clearly a balance must be struck. The commissioner needs effective tools for the job but data controllers need to be able to go about their legitimate business unhindered. These are both important considerations and we have thought about them carefully.

The amendment we propose to Clause 41 would remove the prohibition on the commissioner from making an application for a warrant while an appeal is being brought against an information notice. In bringing forward this amendment we have listened carefully to the case which the registrar has made that it would be unhelpful to fetter her access to the courts to request a warrant as the Bill does at present. We have found that case persuasive. If a circuit judge is persuaded of all the matters set out in Schedule 8, which provides important safeguards against inappropriate use, we agree that an outstanding appeal against an information notice should not be an obstacle to the commissioner's taking action. We are weighing the balance in the commissioner's favour on that issue.

We have framed the commissioner's powers cautiously. We do not think it appropriate to seek to limit the commissioner's powers further and so we cannot accept the noble Viscount's amendment requiring the commissioner before serving an information notice to seek to resolve matters informally. As was emphasised to the Grand Committee, the commissioner must by law exercise her powers reasonably and for the purpose provided. She is not at liberty to exercise the power to issue an information notice unnecessarily or oppressively. I have every expectation that the commissioner will continue her present respected practice of seeking always to resolve matters informally where appropriate. However, we recognise that it may and will not always be appropriate and sensible to do so. In such rare cases she needs to be able to act. We are unwilling to hobble this power with mandatory preliminaries. That does not seem to us either useful or proportionate.

But I have to say that we are not persuaded either that it is right to introduce the non-consensual audit powers soon to be proposed by the noble Baroness, nor the more specific powers to check on exempt processing where Clause 28 is relied on. As we understand the amendment of the noble Baroness, she will propose that the checking to see whether good practice has been complied with can take place without the consent of the data controller. We have listened carefully to the arguments which have been put forward this evening and on other occasions for the desirability both of the powers suggested by the noble Baroness and the power suggested by the noble Lord, Lord Norton. We have also listened carefully to the contrary arguments which have been put to us over time. We think the balance lies in favour of not subjecting data controllers to the prospect of compulsory check-ups. These can be disruptive. Disruption has a cost. We are not convinced that there is a clear justification for asking businesses to bear this cost. We think the possible benefits of compulsory check-ups do not warrant it. We cannot agree to these amendments today.

We are, however, still listening. I said that the question of the powers of the commissioner was one of judgment and balance, of effectiveness and proportionality. I can say to the House today that the registrar is continuing to put ideas to us as to a more rounded-out information notice power which offers her additional scope for appropriate action without unduly limiting data controllers' liberty to go about their business. We shall see whether we cannot go some way further to accommodate these ideas and bring forward suitable amendments as soon as we can.

I hope that the amendment we bring forward today will be seen as an earnest of our intentions and that in the circumstances the other amendments either will be withdrawn or not moved.

Baroness Nicholson of Winterbourne

My Lords, I waited to hear the noble and learned Lord's proposals as regards his amendment before commenting on Amendment No. 64. Perhaps I may comment, first, on Amendment No. 49. I echo the Solicitor-General's comments. Why make an informal approach first? The commissioner should have no such obligation. It would surely give ill-intentioned businesses time to set things right, safely hidden away from everyone, ready to start again with the next case. Such an informal approach would not seem binding and therefore gives all the power to the one in possession of the information.

If the noble and learned Lord agrees with that reasoning—from what he said on his amendment it seems that he did—I suggest that he has weighted too heavily the balance between the Data Protection Registrar and the data controllers, in this case mainly businesses. I suggest that the balance is weighted too heavily against the data protection commissioner.

The noble and learned Lord stated to the House that most businesses will be in line with the 1984 Act and the new legislation. As regards Amendment No. 64, I remind him that, according to polls that have been undertaken officially, 40 per cent. of businesses do not comply with the current Act. Amendment No. 64 takes that into account in allowing the data protection commissioner to make spot checks.

Viscount Astor

My Lords, I understand the noble and learned Lord's argument. However, it must be better for matters to be sorted out by informal approaches. The registrar seems to recognise that. That should be recognised in the Bill. I believe the Government recognise that such an approach is always best.

If, in effect, my amendment fetters the registrar, how is it that the Bank of England has to take that same approach when it considers revoking a licence? I have not heard a representative of the Bank of England or any bank officials say that it is a problem in those cases. Section 13 of the Banking Act 1987 makes provision for such action only after the informal approach has failed to resolve the issue.

6.15 p.m.

Lord Falconer of Thoroton

My Lords, with respect to the noble Viscount, as the Bill stands without amendment, it will be perfectly open to the commissioner to make an informal approach before any information notice is served. As I indicated, it may well not be appropriate to make an informal approach first but to go straight to the information notice phase because the circumstances justify it. It seems to us appropriate that the registrar or commissioner should be able to choose the appropriate course.

The noble Viscount draws an analogy between revoking a banking licence on the one hand and serving an information notice on the other. Merely stating the two powers indicates that they are very different indeed. In relation to a banking licence, one is dealing, first, with someone's livelihood, and, secondly, an issue in respect of which there must be public confidence. So, even having heard the arguments so well put by the noble Viscount, it seems to me clear that there is a substantial difference. With the greatest respect to him, we gain no real support or assistance from the analogy that he seeks to draw.

I replied in advance to the noble Baroness in respect of her amendment. At bottom, the noble Baroness's point is that the balance should be tilted in favour of the data subject in this respect. What underlay all my remarks is that we think a balance has to he struck between the rights of the data controller and of the data subject. There is power to audit a data controller's compliance with good practice. We think it right that it should be only with the consent of the data controller. Otherwise it could give rise to a burden upon a data controller which would be too disruptive and too high a price to pay for the regime.

Baroness Nicholson of Winterbourne

My Lords, the poll—I understand that it was an official poll—stated that 40 per cent. of current businesses do not honour the current legislation. Does the Minister accept that that must be addressed by the authorities and that the Bill should take that knowledge into account? We cannot allow Acts to be passed which are not fulfilled by the broad majority of those whom they address.

Lord Falconer of Thoroton

My Lords, I am not aware of the result of the poll but I do not dispute what the noble Baroness says about it. I am sure that the right way to procure compliance with the law is not to place upon business a burden that we regard as undue. I entirely agree with the noble Baroness that it is appropriate and right that the terms of the law be made known, and that the appropriate steps, which do not involve too much of a burden, be taken to ensure their compliance.

At the end of the day it is a question of where the balance lies. We have taken the view, although I have indicated that we are still listening, that the balance lies in making the audit power consensual. It is for that reason that we do not propose to accept the amendment because we think that the balance is in favour of the data controller in relation to that issue.

Lord Norton

My Lords, before the Minister sits down, he mentioned that it would be too great a burden for data controllers. Audits in general have to be performed to ensure fiscal compliance, and so on. In order to comply with a different form of legislation, I can see no reason why audits should not be performed. They need not be burdensome. They need not be on-the-spot checks. They can be planned. The very nature of data processing is that in many instances it leaves a trail. I wonder what burden the noble and learned Lord is thinking of.

Lord Falconer of Thoroton

My Lords, the proposal made in the name of the noble Lord, Lord Norton, and the noble Baroness, Lady Nicholson, involves giving the commissioner the power, without the consent of the person being investigated, to conduct an assessment or investigation of what that person is doing. That involves a disruption, a cost, and an element of intrusion in relation to their business. We do not think that that element of cost, disruption and intrusion is justified in seeking to balance the interest of the data controller with the data subject.

Lord Norton

My Lords, I have listened to the helpful comments of the noble and learned Lord the Solicitor-General. I shall read his comments in Hansard with great interest. In the meantime, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

Clause 31 [Journalism, literature and art]:

Lord Williams of Mostyn moved Amendment No. 32: Page 18, line 43, leave out ("specified in subsection (2)") and insert ("to which this subsection relates").

The noble Lord said: My Lords, in this group are Amendments Nos. 37, 38, 39, 40, 41, 42, 43 and 44.

Viscount Astor

My Lords, I believe that we are speaking to Amendments Nos. 32, 33, 34, 35 and 36.

Lord Williams of Mostyn

My Lords, I have been led astray by an older man; namely, the Solicitor-General.

Lord Falconer of Thoroton

My Lords, it is entirely my fault for not rising to my feet quickly enough. I am sure that I do not have to remind your Lordships of the importance of Clause 31 in the data protection regime created by the Bill. It is to that section that this group of amendments relates. Perhaps I may speak to Amendments Nos. 32, 33, 34, 35, 36, 73 and 76 in this group.

I turn first to Amendments Nos. 32 to 36. This group of amendments is in effect mainly technical. It brings the terminology of subsection (1) of Clause 31, into line with that of subsection (2) of the clause.

The remaining four amendments to Clause 31 are of a little more substance, but they clarify or complement the provision which is already made in the clause rather than changing it. An essential feature of the mechanism is that it prevents data protection considerations being used to prevent the publication of unpublished journalistic and other material in certain circumstances. Clause 31 (4) provides for civil proceedings under any relevant provisions of the Bill to be stayed where a data controller claims that the processing is undertaken only for the special purposes—that is, journalistic, literary or artistic purposes—and with a view to the publication of previously unpublished material. The stay on proceedings remains until either the claim is withdrawn or a determination of the commissioner under Clause 43 that those criteria are not satisfied takes effect.

It occurs to us that there may be a small ambiguity in these arrangements. This concerns the circumstances in which no explicit claim is made by a data controller, but it appears to the court that the basis for such a claim is there—that is, that the processing is for the special purposes and with a view to the publication of unpublished material. Our expectation would be that in such circumstances a court would not in any event proceed to grant relief—by way of injunction otherwise—to a data subject inappropriately. But these amendments put the matter beyond doubt. They require proceedings to be stayed where a data controller makes a claim or where it appears to the court independently that the criteria in Clause 31(4) are met.

This small change would improve the clarity of the Bill in this respect. I commend the amendments to the House. I beg to move.

On Question, amendment agreed to.

Lord Falconer of Thoroton moved Amendments Nos. 33 to 36: Page 19, line 22, after ("Where") insert ("at any time ("the relevant time")"). Page 19, line 23, leave out from ("claims") to ("that") in line 24 and insert (", or it appears to the court,"). Page 19, leave out line 34. Page 19, line 36, at end insert ("or () in a case where the proceedings were stayed on the making of a claim, that the claim is withdrawn.").

On Question, amendments agreed to.

Clause 32 [Research, history and statistics]:

Lord Teviot moved Amendment No. 37: Page 20, line 7, at end insert ("and for these purposes a data controller may deposit records containing personal data in a record office open to the public which agrees to comply with a code of practice approved by the Secretary of State").

The noble Lord said: My Lords, in moving this amendment I shall also speak to Amendment No. 38. In Committee, I was happy to accept the Minister's assurance that many of the concerns of the archive profession would be addressed by a code of practice issued by the Secretary of State. This amendment attempts to encourage record creators to deposit the records which are to receive further processing, and in particular to make provision for the period between the coming into force of this Act and the issuing of a code of practice. They need a clear statement authorising them to do so in the Act and not merely in the obscurity of a statutory instrument, which may not even appear for some months.

However, I do not know whether I have been pre-emptive or precipitate. Looking at Amendment No. 58, I see that there is to be a new schedule, which the Minister will undoubtedly introduce with the next grouping, to deal with certain exemptions so far as I understand them. I accept that they may go some way towards reassuring the depositories I have in mind. However, I should like an assurance when the Minister replies.

I should point out that these records are not for the most part public records, and therefore do not have the protection that that definition provides. The type of records I have in mind are membership registers of trades unions or co-operative societies, lists of employees and their wages among business records, and records of the recipients of charities. All such records are now protected by long closure periods, which will doubtless be confirmed by a code of practice. But until that code is published there is a real risk that some organisations, realising that their records do not conform to the Act, will be deterred from depositing them, resulting in their eventual loss to posterity.

I turn to Amendment No. 38. Noble Lords will realise that I moved this precise amendment in Committee. The noble and learned Lord the Solicitor-General indicated that the Government were concerned over this particular point and would try to find a compromise within the European directive. Hence, I have been anxiously looking for such an amendment to appear—sadly, in vain. However, I appreciate the Government's difficulties, and perhaps one will see such an amendment next week. That is the reason why I am reintroducing this amendment.

Its purpose is to ensure that research by a third party in the interests of a particular data subject without his prior consent may be allowed to continue. Although Clause 32(5)(b) allows such research on a data subject by a person acting "on his behalf", I am concerned that that provision may be interpreted to mean acting "on his authority". This amendment would cover the relatively few cases where that condition cannot be met.

Furthermore, I have learnt today that the Law Society is eagerly awaiting the Minister's answer to this problem. Its particular concern is for solicitors to be able to continue to trace beneficiaries of wills—an example that I mentioned in Committee. I should be grateful to have an answer to that point today. If the phrase "vital interests", in paragraph 3(a) of Schedule 3 is thought to be too clinical, I should be happy to add "or in his best interests" to Clause 32(5)(b), which would thus allow data to be disclosed "to the data subject or a person acting on his behalf, or in his best interests". I beg to move.

Lord Williams of Mostyn

My Lords, within this group we begin with Amendments Nos. 37 and 38, followed by Amendments Nos. 39, 40, 41, 42, 43 and 44. With his usual courtesy the noble Viscount has indicated that he will not move or speak to Amendments Nos. 45 and 46. That therefore leaves Amendment No. 74 as the final amendment in this group.

I am grateful to the noble Lord, Lord Teviot, for explaining these amendments. Perhaps I may return to Amendment No. 58 in its due place since it deals with a very technical area which will require a rather tedious and lengthy explanation. As I understand the noble Lord's first amendment, he wants to bring about a situation whereby records obtained by one person for a particular person and then passed to a public records office may be made available to the public in accordance with a code of practice approved by the Secretary of State.

Public records offices and public registers do not need to rely on the research exemption in order to disclose material which is statutorily required to be made public. That can be done under Clause 33.

Lord Teviot

My Lords, with respect to the noble Lord, I believe the examples I mentioned were those records not covered by the Public Records Office. They may be covered by a records office, but not the Public Records Office.

6.30 p.m.

Lord Williams of Mostyn

My Lords, that is so. We have made distinct provisions for public records which are not limited by the restrictions in Clause 32. I appreciate that there may be two further concerns. The first relates to contributors to registers. We believe that their position is covered by Clause 34(1). The second is the point on which the noble Lord was good enough to intervene: that records are not always the subject of statutory requirements to be provided.

We do not believe that the noble Lord's amendment is capable of being accepted within the terms of the directive. I think the noble Lord anticipated that that might be our response. It is not a response which is come to lightly; we wish to do our best to be co-operative. As I said in Grand Committee, I recognise these concerns. I am happy to say that officials are more than willing to meet the noble Lord—if he wishes, with colleagues of his or those who have interests in this field—to see whether we can make further progress towards a solution which might be helpful to the interests which he identified.

The amendment would bring about the disclosure of any records collected for any purpose. It would imply that the disclosure of any records collected for any purpose was fair and compatible with the original purpose. That might be the case in some circumstances, but we are unable to advise your Lordships that such disclosure would always meet the relevant tests. I hope that this can be the subject of further useful discussion.

If the record office keeps records for research purposes only, the contributor can himself claim the benefit of Clause 32(5) to protect an exemption on which he himself relies.

What I have said about Clause 33 also applies to Amendment No. 38. In so far as there are other research purposes which do not have the public character to which the noble Lord referred, the limitations in Clause 32(5) acknowledge the fact that we are allowed by the directive to make special exemptions for research purposes on two conditions only. The first is that data subjects are suitably safeguarded and the second that the processing in question is solely for research purposes and no other. Clause 32(5) is therefore for a particular function and no other. It provides that researchers can within those limits which I have identified give voluntary subject access without losing the right to say that they are processing solely for research purposes.

Clause 32(5)(b) provides that researchers can safely disclose to the data subject or a person acting on his behalf. Read with Clause 32(5)(d), we believe that that extends to persons whom the researcher had reasonable grounds for believing are acting on behalf of the data subject. We do not see any need to give that reference to a person acting on behalf of the data subject an artificially narrow construction. The noble Lord raised the question of an executor acting on behalf of a beneficiary. We believe that the executor acting on behalf of a beneficiary is lawfully entitled to continue the researches. That is the specific Law Society question which the noble Lord transmitted earlier. I hope that I have been able to reassure him and, through him, the Law Society.

Casting the net a little wider, it might well extend to a care agency, for instance, seeking to search out and support a missing person, though we should bear in mind that sometimes persons go missing for purposes which they regard as legitimate and reasonable. One again comes up against the difficult balancing which is sometimes easer to identify than to bring perfect harmony to.

I hope that I have been able to reassure the noble Lord that the reference to persons acting on behalf of the data subject can be given a practical interpretation, but I repeat that we are always willing to have discussions on an official or any other basis to see whether anything further ought properly to be done.

The next amendment in this grouping is Amendment No. 39, a government amendment. There is currently an omission in Clause 33. This clause relates to personal data made available to the public by or under enactment. An example might be the Registry of Births, Marriages and Deaths. The clause provides an exemption for such data from the subject information provisions, from Clause 12, which gives data subjects the right to have inaccurate data rectified, and from the non-disclosure provisions.

The exemption from Clause 12 is included because, where the data are required to be maintained and made available to the public by statute, those statutes make detailed special provision as to accuracy and therefore as to amendments and corrections. Any amendments to the data to correct inaccuracies in that class of records should be made under those specific statutory provisions rather than under data protection legislation. But Clause 12 is only a part of the Bill's regime for correcting inaccuracy. It provides individuals with direct civil remedies in the courts. Its counterpart in the regulatory regime is the fourth data protection principle, which requires personal data to be accurate and, where necessary, kept up to date. This principle can be enforced by the commissioner, and breach may give rise to a claim for damages under Clause 11. We do not want that to apply to public registers. They have their own systems for correcting inaccuracies. It would be a confusing duplication to overlay that with the requirements of the fourth data protection principle. That is the purpose of this amendment.

Amendments Nos. 40, 41, 42, 44 and 74 are government amendments. Amendment No. 43 is in the name of the noble Lords, Lord Campbell of Alloway and Lord Burnham. If I understand correctly from the noble Lord, Lord Campbell of Alloway, our amendments meet his requirements.

Lord Burnham

My Lords, I thank the noble Lord for giving way. I can solve this problem very quickly. I am most grateful to the noble Lord for his courtesy in writing to my noble friend Lord Campbell and even more so for incorporating our Amendment No. 43 in his Amendment No. 44. I shall not move our amendment.

Lord Williams of Mostyn

My Lords, I thank the noble Lord for his courtesy. I shall deal with Amendments Nos. 40 to 44 and 74 relatively briefly. This group of amendments extends slightly the subject information exemptions in Schedule 7.

The first three amendments deal with the exemption in paragraph 1 of the schedule for confidential references provided by data controllers. It has been suggested to us that the exemption is too narrow. The references to education and employment may be too restrictive. We have therefore introduced these amendments to meet those concerns.

The next government amendment, Amendment No. 44, creates a new power for the Secretary of State to specify subject information exemptions in relation to employment and the service of the Crown or in relation to offices to which appointments are made by Her Majesty or Ministers. There is already an exemption in paragraph 3(a), which the Solicitor-General dealt with in Grand Committee, in relation to appointments to judicial office or the office of Queen's Counsel. It has been represented to us, not least by the noble Lords, Lord Burnham and Lord Campbell of Alloway, that there may be other positions in the public service which ought to be within that class of exemption. I stress that I am not able to make any commitments, but an example might be the senior military posts to which the noble Lords, Lord Burnham and Lord Campbell of Alloway, referred previously. We accepted this widening in principle; the question was how to bring it about.

I stress to your Lordships that we have in mind here only public positions where there are pressing reasons of public interest to make exemptions from the principle of transparency in subject access provisions. There are some public positions which are sensitive and prominent and which require absolute discretion in the appointments system if it is to work at all. We believe that the public is entitled to expect as much information as possible, subject to the provisos I set out. We have therefore formulated an exemption to allow the greatest possible flexibility so that the Secretary of State may specify exemptions by order. We believe that that is wiser and more prudent than having something inflexible on the face of the Bill. We have set out the scheme. I repeat my gratitude for the approach taken by the noble Lords, Lord Burnham and Lord Campbell of Alloway.

The final amendment, Amendment No. 74, is to ensure that this power is subject to the affirmative resolution procedure. We believe that any detailed proposals brought forward ought to be subject to parliamentary scrutiny in this respect.

On the basis of that explanation, I commend the government amendments.

The Lord Bishop of Ely

My Lords, I do not want to detain the House for too long. The concerns of the Bill relate to the data holding of all the Churches and, in particular, to the Church of England in virtue of Crown appointments. I should like to assure your Lordships of the full support of the Churches—who have discussed the implications of the directives since their publication—for individual rights and their commitment to scrupulous observation of them.

The Churches have a specific concern for the selection of candidates for ordination. That is why we are grateful for the Minister's proposal in Amendment No. 40, and the insertion of the word "training". The addition of the word "office" in Amendment No. 42 is also helpful in that it extends the exemption of confidential references to ecclesiastical offices, which are not employment. I also express my support for Her Majesty's Government's inclusion in Amendment No. 44 relating to Schedule 4 of appointments made by Her Majesty.

Lord Williams of Mostyn

My Lords, I am grateful to the right reverend Prelate for his support. Representations were made by the Church authorities. We gave them every consideration and that is why we tabled the amendments in this form.

Lord Teviot

My Lords, I am grateful to the Minister for responding to my amendment so pleasantly and informatively. I shall take up his invitation to meet with his officials, particularly in relation to Amendment No. 37. With no more ado, I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 38 not moved.]

Clause 33 [Information available to the public by or under enactment]:

Lord Williams of Mostyn moved Amendment No. 39: Page 20, line 28, at beginning insert ("the fourth data protection principle and").

On Question, amendment agreed to.

Schedule 7 [Miscellaneous exemptions]:

Lord Williams of Mostyn moved Amendments Nos. 40 to 42: Page 49, line 20, after second ("education") insert (", training"). Page 49, line 20, after second ("education") insert (", training"). Page 49, line 21, after ("subject") insert— ("() the appointment, or prospective appointment, of the data subject to any office,").

The noble Lord said: My Lords, I have already spoken to Amendments Nos. 40, 41 and 42. With the leave of the House, I shall move them en bloc. I beg to move.

On Question, amendments agreed to.

[Amendment No. 43 not moved.]

Lord Williams of Mostyn moved Amendment No. 44: Page 49, line 32, at end insert— ("Crown employment and Crown or Ministerial appointments 3A. —(1) The Secretary of State may by order exempt from the subject information provisions personal data processed for the purposes of assessing any person's suitability for—

1. (a) employment by or under the Crown, or
2. (b) any office to which appointments are made by Her Majesty, by a Minister of the Crown or by a Northern Ireland department.").

The noble Lord said: My Lords, I have already spoken to this amendment. I beg to move.

On Question, amendment agreed to.

[Amendments Nos. 45 and 46 not moved.]

6.45 p.m.

Lord Williams of Mostyn moved Amendment No. 47: After Clause 37, insert the following new clause— TRANSITIONAL RELIFY (". Schedule (Transitional relief) (which confers transitional exemptions) has effect.").

The noble Lord said: My Lords, Amendment No. 47 is grouped with Amendments Nos. 58 and 79 to 83. These amendments deal with the transitional provisions proposed for the Bill. I am sorry that it has taken until now to put these proposals forward.

Perhaps not unusually, the transitional arrangements are extremely difficult because they are so technical and have been subject to many representations from various people with proper interests. It has therefore been difficult and time consuming, added to which the directive is not always the easiest beast to understand. We have tried to take full advantage of transitional flexibility while ensuring that arrangements are practicable and, importantly, do not impose unnecessary burdens on controllers.

We canvassed a number of different options and from the soundings there appeared to be two messages: first, to try to avoid if possible the creation of a dual regime— that is, running the 1984 regime and the new Act alongside each other during the transitional period; secondly, there was an equally strong desire to find arrangements which did not result in systems having to be changed merely because additional personal data were added to them during the transitional period. Organisations are already having difficulties with what I might call the "year 2000 problem". Many have made clear to us the extreme difficulty that they would have in coping in addition with the detailed technical systems changes which a provision of that kind could require. I believe that the new arrangements meet those concerns, as well as our objectives.

I shall try to be brief. The overall structure and effect of this grouping has two broad objectives: Amendments Nos. 47, 58 and 79 to 82 give effect to the transitional exemptions permitted by the directive; Amendment No. 83 makes technical provision to ensure the smooth transition from the 1984 Act to the Bill. I shall concentrate on the first set.

The key provision is the new schedule in Amendment No. 58. The basic scheme is that the transitional exemptions apply to "processing already under way" immediately before 24th October 1998. As your Lordships will remember, that is the date on which the directive is due to be implemented by member states. Paragraph 1 of the schedule is expressed in such a way that the subsequent addition of new personal data to such processing need not invalidate the exemption. That was one of the major concerns expressed to us in the discussions which I mentioned earlier. We are confident that the directive does not require this, so nor does the Bill. Any new processing started on or after 24th October 1998 will be subject in full to the Bill's provisions immediately. I therefore turn to processing already under way.

The expression is taken directly from the directive, where it is not defined. We have considered carefully whether we should seek to define it in the Bill. We concluded that we should not. Taking account of the informal discussions, we believe that the best approach is to allow data controllers themselves to decide what is and what is not processing already under way, in the light of any guidance that may be issued by the commissioner.

The exemptions fall into four broad categories. First, there is a complete exemption until 23rd October 2001 for certain processing. That covers processing of all manual records to which the Bill applies; and the principal categories of automated processing to which the 1984 Act does not apply but which will come within the scope of the Bill. Those exemptions are set out in paragraphs 2 to 9 of the schedule. Paragraph 10 is a limited exemption which replicates a similar provision in the 1984 Act.

The second main exemption applies to all remaining automated processing— that is to say, processing to which the 1984 Act currently applies. Such processing is exempt from those provisions of the Bill which are specified in paragraph 11 until 23rd October 2001. The exemption applies to most of the new requirements imposed by the Bill in consequence of the requirements of the directive. So, for example, it covers the requirement for controllers to provide information to data subjects under paragraph 2 of Part II of Schedule 1; the requirement to satisfy the conditions in Schedules 2 and, in some cases, 3, before processing may take place; the rights for individuals to object to processing under Clauses 9, 10 and 13; as well as a number of other provisions which are new to our law.

The third main exemption relates only to manual records. Part III of the schedule provides a further exemption from, in effect, the first five data protection principles (except the requirement to provide information to individuals under paragraph 2 of Part II of Schedule 1) for the period 24th October 2001 to 23rd October 2007.

In relation to this further exemption, first, it does not cover the subject access arrangements. Individuals will be able to gain access to their manual records as from 24th October 2001. Secondly, the exemption does not apply to personal data newly added to existing systems after 24th October 1998. Thirdly, the new schedule in Amendment No. 82 provides for individuals to be able to remedy inaccuracy in, or incompatible holding of, their manual data during this extended transitional period. The fourth category of exemption in the new schedule in Amendment No. 58 is found in Part IV. That provides special exemptions for processing only for historical research purposes from 23rd October 2001 with no limit as to time.

I have had to spend a moment or two in explanation. These are technical provisions. One further point arises as to the technical provisions made in Amendment No. 83. One of the things that is of concern to those affected by data protection law is what will happen to the existing registrations. We offer them the answer that existing registrations will be preserved until their normal date of expiry and treated as though they were notifications under the Bill. We believe that that is the simplest and most effective solution to this problem. It means that the data protection commissioner will not be inundated with a sudden surge of requests for notification. That is the thinking and the rationale behind this group of amendments. I commend them to the House.

Viscount Astor

My Lords, I am extremely grateful to the noble Lord for bringing forward his amendments on transitional relief. We are grateful that the Government have taken full advantage of the transitional reliefs that are offered by the directive.

As the noble Lord will appreciate, his amendments cover about six pages of the Marshalled List and he gave a detailed explanation, which I shall have to study carefully. Perhaps I may ask him one or two questions. I am concerned that paragraph 1 of the new schedule is not sufficiently clear on eligible data. Given continuity of processing for a specified purpose, the definition of "eligible data" for the purpose of transitional relief needs to be clear that they do or do not include data, such as an address, amended on or after 24th October 1998; data added to a record, such as a new educational qualification or a subsequent purchase for a continuing customer, on or after 24th October 1998; and data for a new data subject, such as a new employee, added on or after 24th October 1998.

It also needs to be clear that amendments to programs—such as those that may be necessary to deal with the millennium bug—do not disqualify the processing from transitional relief. Can the noble Lord confirm that none of these changes should disqualify processing from one or more specified purposes which began prior to 24th October 1998 from transitional relief? Further, the replacement of a software system by another employed for the same continuing purpose should not disqualify that processing from transitional relief.

I realise that those are rather technical questions and that transitional relief is a technical subject. Therefore, I should be very happy for the noble Lord to write to me between now and Third Reading on any of those questions. However, in general, we welcome the noble Lord's amendments.

Lord Williams of Mostyn

My Lords, that is a generous approach by the noble Viscount. His questions merit thought and detailed answers. I undertake to write to him with specific answers to each of those questions as soon as maybe.

On Question, amendment agreed to.

Clause 40 [Request for assessment]:

Viscount Astor moved Amendment No. 48: Page 23, line 25, at beginning insert ("if not, of his reasons, and if so,").

The noble Viscount said: My Lords, this is the amendment I nearly started to move earlier. I moved a similar amendment in Committee. It concerns the commissioner and open government. The Minister said that he accepted that my amendment applies only to the extent that the commissioner considers appropriate, which I thought was very reasonable. He then went on to say that it would not always be appropriate for her to explain her views and actions. He then used that as an argument for saying that he did not want the amendment. That rather contradicted his earlier statement that the commissioner has to go through this thing only if she considers it appropriate. For the benefit of open government I thought it worth returning to the issue to ask whether the Government had reconsidered their earlier view. I beg to move.

Lord Falconer of Thoroton

My Lords, the noble Viscount will recall my noble friend's response to his amendment in the Grand Committee. My noble friend said that the amendment was unnecessary and that remains the Government's view.

Clause 40 places an express duty on the commissioner, except in very limited circumstances, to make an assessment on receipt of a request. The noble Viscount's amendment seeks to require the commissioner to give reasons when she refuses to make such an assessment. The only bases for refusal to make an assessment under the Bill are those set out in subsection (2)(a) and (b): namely, that she has not been supplied with such information as she may reasonably require in order to satisfy herself as to the identity of the person making the request; and to enable her to identify the processing in question. So far as concerns paragraph (a)—the identity of the person making the request—that is a simple matter of trying to establish who that person is. If she is not sure, she can ask for more information. If she does not get it, she will notify as much under Clause 40(4). The basis for that will be apparent.

So far as concerns paragraph (b), if she cannot identify the processing, that is likely to be because the person making the request has not, despite being asked, given enough details. Again, that will be very apparent. The commissioner will have information notice powers to seek further details from the data controller if she can establish who that is. So it is unlikely to be the situation contemplated in Clause 40(2). On the basis of the analysis that has gone before, a refusal to make an assessment at all is only likely to result from a process of dialogue with the person making the request which ends with that person not giving enough reasonably requested information. It is not the sort of exercise of discretion where the giving of reasons has much obvious part to play.

Further—and this is worth emphasising—Clause 40(4)(b) requires the commissioner to inform the person who made the request for assessment of, any view formed or action taken as a result of the request". In the Government's view, this means that the commissioner must, to the extent that is appropriate, tell the person concerned of any view formed about the merits of a request in respect of which the commissioner decided to take no further action. Whether and to what extent the provision of this information is considered appropriate is, in our view, quite rightly a matter for the commissioner, who must have particular regard to the issues of confidentiality.

I have explained why we think the amendment is unnecessary. I hope that the noble Viscount will consider withdrawing it.

Viscount Astor

My Lords, I am grateful to the noble and learned Lord. He has certainly gone further this evening in explaining the Government's views. I think he has satisfied my concerns. No doubt the registrar will have to take account of what was said during the passage of the Bill. I shall read carefully what he said. I notice that Amendments Nos. 67, 68 and 69 are grouped with this amendment and I wonder whether the noble and learned Lord wishes to speak to those before I withdraw my amendment.

Lord Falconer of Thoroton

My Lords, I am grateful to the noble Viscount for making that point. I was going to interrupt him before he finished because I had noticed that I should have spoken to those amendments.

Amendments Nos. 67 and 68 would allow the Secretary of State to direct the commissioner to assist the commissioner's opposite number in a colony to carry out data protection functions. They have been tabled in response to a request by the Gibraltar Government, who would like the commissioner to be able to carry out data protection functions on behalf of any supervisory authority which may be established there at the request of that authority. I understand that it is Gibraltar's intention to legislate later this year to implement the 1995 data protection directive. It is not possible to estimate at this stage the extent to which the commissioner's assistance might be required in this regard, but I am able to reassure your Lordships that the commissioner will be able to charge for such assistance on such terms as the Secretary of State may direct or approve. Any receipts would be treated in the same way as if they had originated in the United Kingdom; that is to say, they would be subject to the regime specified in Schedule 5 to the Bill.

With the leave of the House I shall speak to Amendment No. 69. It relates to Clause 54. That clause imposes a duty of confidentiality on the commissioner and her staff in respect of the information (both personal and business) which they obtain in the course of carrying out their functions under the Bill. The duty is backed by a criminal sanction.

Concern has been expressed that the clause, as drafted, imposed too heavy-handed a regime of secrecy on the commissioner's staff and might place them too readily in jeopardy of criminal penalties. I know this was of concern to the registrar, particularly in view of the culture of openness fostered by her office.

In Committee, we had a brief debate about the clause in the light of an alternative version proposed by the noble Baroness. Since Committee, Home Office officials have had the opportunity of discussing the provision further with the registrar. This amendment is the result of that discussion.

It does not go as far as the registrar had perhaps hoped but does incorporate some of her suggestions. While we are sympathetic to her points we are, of course, bound to implement the directive. This contains an express requirement to ensure that the members and staff of the supervisory authority are subject to a duty of professional secrecy with regard to confidential information to which they have access.

While I appreciate that the overall effect of the amendment may appear remarkably similar to that of the present clause, it incorporates a number of changes. The obligation of secrecy is now imposed specifically on, and limited to a, person who is or has been the Commissioner, a member of the Commissioner's staff or an agent of the Commissioner", rather than being related to the information itself and applying to "any person". This wording more clearly reflects the requirement of the directive.

The drafting has also been amended so that the elements which go to make up "confidential" information are contained within subsection (1) and the extent of the authority to disclose is contained in subsection (2).

On a technical point, the registrar considers that with this amendment, in the event of a prosecution under the clause, it would be for the prosecution to prove that the disclosure was of information falling within all the elements now contained in subsection (1).

The registrar had some concern that in the present clause subsection (1)(b) might operate by way of a defence only, so that if a member of staff was charged under the clause he would have to show that the information was in the public domain. This would have placed an additional burden on the member of staff. To that extent we have sought to accommodate the registrar's concerns. I cannot see, in the light of the directive, that we can go further. I commend the amendment to the House.

Viscount Astor

My Lords, it is for me at this stage to withdraw Amendment No. 48.

Amendment, by leave, withdrawn.

Clause 41 [Information notices]:

[Amendment No. 49 not moved.]

Lord Falconer of Thoroton moved Amendment No. 50: Page 24, line 7, leave out from ("furnished") to ("pending") in line 8.

On Question, amendment agreed to.

Schedule 6 [Appeal proceedings]:

Lord Falconer of Thoroton moved Amendment No. 51: Page 47, line 30, leave out ("one or more") and insert ("those").

The noble and learned Lord said: My Lords, Clause 27 provides for personal data to be exempted from the main elements of the Bill where this is necessary to safeguard national security. The question of necessity is subject to ministerial certification. There is a right of appeal to a designated panel of the Data Protection Tribunal for any person affected by this certification. Schedule 6 has effect in relation to these appeals and to the proceedings of the tribunal in respect of them.

The proposed amendments have been put forward in the light of further reflection on the arrangements for these appeals. In this group are Amendments Nos. 51 to 56 and 84 and 85. The amendments to Schedule 6 would have the effect of requiring the tribunal to be drawn from a panel of lawyers, with a quorum of three, when hearing national security appeals other than those in which the tribunal's jurisdiction is exercised ex parte. The lawyers concerned would be drawn from those designated under paragraph 2(1) of the schedule—that is to say, from among the tribunal chairman and those deputy tribunal chairmen appointed by the Lord Chancellor whom he has designated as being capable of hearing such appeals. One of these persons will be designated by the Lord Chancellor to preside.

I said in Committee that there were going to be circumstances in which personal data would need to be processed by the appropriate agencies to safeguard national security and that Clause 27 made it possible for that processing to be carried out without the otherwise subsisting controls in the Bill putting national security at risk. I stressed that the exemptions available could apply only if they were required for the purpose of safeguarding national security and then only to the extent that they were so required. A Cabinet Minister, the Attorney-General or the Lord Advocate would be able to certify the requirement. Under the current Data Protection Act the signing of a ministerial exemption certificate is the end of the matter. This Bill will give a right of appeal to the Data Protection Tribunal for persons affected by the issue of such a certificate.

Having, as I indicated, reflected further on the arrangements for giving effect to this provision, I have to tell your Lordships that we believe the specialised and sensitive nature of these national security appeals makes it appropriate for them to be dealt with by lawyers. Appeals under Clause 27(4) of the Bill will be dealt with by a judicial review approach, which is not inherently suited to lay input. Appeals under Clause 27(6) will turn on a fairly narrow question of fact; that is, whether the certificate's general description of personal data applies to the particular personal data at issue. It seems to us that this is a question on which lay members are unlikely to be able to offer any additional expertise. But if a non-legal perspective or a particular data protection expertise were found to be needed in either case, this would of course be available to the tribunal via expert witnesses. An all-lawyer panel for these appeals would, furthermore, be in line with the position of the existing tribunals which deal with matters involving national security.

The proposed amendments to Schedule 10 would have the effect of removing the tribunal from the jurisdiction of the Council on Tribunals in relation to national security appeals. It would remain subject to the council's supervision in respect of other appeals. This proposed exemption, which the council is aware of, would preserve the current position in regard to tribunals dealing with matters involving national security; namely, that they are, because of national security considerations, outside the council's remit and their work kept within the so-called "ring of secrecy".

A particular effect of this amendment would be to remove the requirement for the Secretary of State to consult the Council on Tribunals when drawing up rules of procedure. I am happy to assure your Lordships that in practice we intend to consult the council on the rules which we shall be drafting for national security appeals as soon as practicable and which will be laid before your Lordships' House. I beg to move.

On Question, amendment agreed to.

Lord Falconer of Thoroton moved Amendments Nos. 52 to 56: Page 47, leave out lines 32 to 34. Page 47, line 35, leave out ("or (2)"). Page 47, line 36, leave out ("or, as the case may be, by the Secretary of State"). Page 47, leave out lines 40 to 44 and insert ("three of the persons designated under paragraph 2(1), of whom one shall he designated by the Lord Chancellor to preside"). Page 48, leave out lines 1 to 4.

On Question, amendments agreed to.

Clause 47 [Determination of appeals]:

Lord Williams of Mostyn moved Amendment No. 57: Page 28, line 3, at end insert— ("(7) For the purposes of subsection (6) —

1. (a) the address of a registered company is that of its registered office, and
2. (b) the address of a person (other than a registered company) carrying on a business is that of his principal place of business in the United Kingdom.").

The noble Lord said: My Lords, this a short, technical amendment. Clause 47 deals with the determination of appeals brought by data controllers to the Data Protection Tribunal. Subsection (6) provides that any party to an appeal may refer to the appropriate court on a point of law. The appropriate court depends on the address of the person who was the appellant. This amendment specifies how the address is determined. It is based on the approach adopted in the 1984 Act. I beg to move.

On Question, amendment agreed to.

Lord William of Mostyn moved Amendment No. 58: Before Schedule 8, insert the following new schedule— ("SCHEDULE TRANSITIONAL RELIEF PART 1 INTERPRETATION OF SCHEDULE 1.—(1) For the purposes of this Schedule, personal data are "eligible data" at any time if, and to the extent that, they are at that time subject to processing which was already under way immediately before 24th October 1998. (2) In this Schedule— eligible automated data" means eligible data which fall within paragraph (a) or (b) of the definition of "data" in section 1(1): eligible manual data" means eligible data which are not eligible automated data; the first transitional period" means the period beginning with the commencement of this Schedule and ending with 23rd October 2001; the second transitional period" means the period beginning with 24th October 2001 and ending with 23rd October 2007. PART II EXEMPTIONS AVAILABLE BEFORE 24TH OCTOBER 2001 Manual data 2. Eligible manual data are exempt from the data protection principles and Parts II and Ill of this Act during the first transitional period. Processing otherwise than by reference to the data subject 3. During the first transitional period, for the purposes of this Act (apart from paragraph 1), eligible automated data are not to be regarded as being "processed" unless the processing is by reference to the data subject. Payrolls and accounts 4. —(1) Subject to sub-paragraph (2), eligible automated data processed by a data controller for one or more of the following purposes—

1. (a) calculating amounts payable by way of remuneration or pensions in respect of service in any employment or office or making payments of, or of sums deducted from, such remuneration or pensions, or
2. (b) keeping accounts relating to any business or other activity carried on by the data controller or keeping records of purchases, sales or other transactions for the purpose of ensuring that the requisite payments are made by or to him in respect of those transactions or for the purpose of making financial or management forecasts to assist him in the conduct of any such business or activity,

are exempt from the data protection principles and Parts II and III of this Act during the first transitional period. (2) It shall be a condition of the exemption of any eligible automated data under this paragraph that the data are not processed for any other purpose, but the exemption is not lost by any processing of the eligible data for any other purpose if the data controller shows that he had taken such care to prevent it as in all the circumstances was reasonably required. (3) Data processed only for one or more of the purposes mentioned in sub-paragraph (1)(a) may be disclosed—

1. (a) to any person, other than the data controller, by whom the remuneration or pensions in question are payable.
2. (b) for the purpose of obtaining actuarial advice,
3. (c) for the purpose of giving information as to the persons in any employment or office for use in medical research into the health of, or injuries suffered by, persons engaged in particular occupations or working in particular places or areas,
4. (d) if the data subject (or a person acting on his behalf) has requested or consented to the disclosure of the data either generally or in the circumstances in which the disclosure in question is made, or
5. (e) if the person making the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (d) above.

(4) Data processed for any of the purposes mentioned in sub-paragraph (1) may be disclosed—

1. (a) for the purpose of audit or where the disclosure is for the purpose only of giving information about the data controller's financial affairs; or
2. (b) in any case in which disclosure would be permitted by any other provision of this Part of this Act if sub-paragraph (2) were included among the non-disclosure provisions.

(5) In this paragraph "remuneration" includes remuneration in kind and "pensions" includes gratuities or similar benefits. Unincorporated members' clubs and mailing lists 5. Eligible automated data processed by an unincorporated members' club and relating only to the members of the club are exempt from the data protection principles and Parts II and III of this Act during the first transitional period. 6. Eligible automated data processed by a data controller only for the purposes of distributing, or recording the distribution of, articles or information to the data subjects and consisting only of their names, addresses or other particulars necessary for effecting the distribution, are exempt from the data protection principles and Parts II and III of this Act during the first transitional period. 7. Neither paragraph 5 nor paragraph 6 applies to personal data relating to any data subject unless he has been asked by the club or data controller whether he objects to the data relating to him being processed as mentioned in that paragraph and has not objected. 8. It shall be a condition of the exemption of any data under paragraph 5 that the data are not disclosed except as permitted by paragraph 9 and of the exemption under paragraph 6 that the data are not processed for any purpose other that mentioned in that paragraph or as permitted by paragraph 9, but—

1. (a) the exemption under paragraph 5 shall not be lost by any disclosure in breach of that condition, and
2. (b) the exemption under paragraph 6 shall not be lost by any processing in breach of that condition.

if the data controller shows that he had taken such care to prevent it as in all the circumstances was reasonably required. 9. Data to which paragraph 8 applies may be disclosed—

1. (a) if the data subject (or a person acting on his behalf) has requested or consented to the disclosure of the data either generally or in the circumstances in which the disclosure in question is made,
2. (b) if the person making the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (a), or
3. (c) in any case in which disclosure would be permitted by any other provision of this Part of this Act if paragraph 8 were included among the non-disclosure provisions.

Back-up data 10. Eligible automated data which are processed only for the purpose of replacing other data in the event of the latter being lost, destroyed or impaired are exempt from section 7 during the first transitional period. Exemption of all eligible automated data from certain requirements 11. —(1) During the first transitional period, eligible automated data are exempt from the following provisions—

1. (a) the first data protection principle to the extent to which it requires compliance with—
1. (i) paragraph 2 of Part II of Schedule 1,
2. (ii) the conditions in Schedule 2, and
3. (iii) the conditions in Schedule 3,
2. (b) the seventh data protection principle to the extent to which it requires compliance with paragraph 13 of Part II of Schedule 1;
3. (c) the eighth data protection principle,
4. (d) in section 7(1), paragraphs (b), (c)(ii) and (d),
5. (e) sections 9 and 10,
6. (f) section 11, except so far as relating to—
1. (i) any contravention of the fourth data protection principle,
2. (ii) any disclosure without the consent of the data controller,
3. (iii) loss or destruction of data without the consent of the data controller, or
4. (iv) processing for the special purposes, and
7. (g) section 13.

(2) The specific exemptions conferred by sub-paragraph (1)(a), (c) and (e) do not limit the data controller's general duty under the first data protection principle to ensure that processing is fair. PART III EXEMPTIONS AVAILABLE AFTER 23RD OCTOBER 2001 BIT BEFORE 24TH OCTOBER 2007 12. —(1) During the second transitional period, eligible manual data which were held immediately before 24th October 1998 are exempt from the following provisions—

1. (a) the first data protection principle except to the extent to which it requires compliance with paragraph 2 of Part II of Schedule 1,
2. (b) the second, third, fourth and fifth data protection principles, and
3. (c) section 12.

(2) Sub-paragraph (1) does not apply to any eligible manual data to which the exemption in paragraph 14 applies. PAK r IV EXEMPTIONS AFTER 23RD OCTOBER 2001 FOR HISTORICAL RESEARCH 13. In this Part of this Schedule "the relevant conditions" has the same meaning as in section 32. 14. —(1) Eligible manual data which are processed only for the purpose of historical research in compliance with the relevant conditions are exempt from the provisions specified in b-paragraph (2) after 23rd October 2001. (2) The provisions referred to in sub-paragraph (1) are—

1. (a) the first data protection principle except in so far as it requires compliance with paragraph 2 of Part II of Schedule 1,
2. (b) the second, third, fourth and fifth data protection principles, and
3. (c) section 12.

15. —(1) After 23rd October 2001 eligible automated data which are processed only for the purpose of historical research in compliance with the relevant conditions are exempt from the first data protection principle to the extent to which it requires compliance with the conditions in Schedules 2 and 3. (2) Eligible automated data which are processed—

1. (a) only for the purpose of historical research,
2. (b) in compliance with the relevant conditions, and
3. (c) otherwise than by reference to the data subject,

are also exempt from the provisions referred to in sub-paragraph (3) after 23rd October 2001. (3) The provisions referred to in sub-paragraph (2) are—

1. a) the first data protection principle except in so far as it requires
2. compliance with paragraph 2 of Part II of Schedule 1,
3. (b) the second, third, fourth and fifth data protection principles, and
4. (c) section 12.

16. For the purposes of this Part of this Schedule personal data are not to be treated as processed otherwise than for the purpose of historical research merely because the data are disclosed—

1. (a) to any person, for the purpose of historical research only,
2. (b) to the data subject or a person acting on his behalf,
3. (c) at the request, or with the consent, of the data subject or a person acting on his behalf, or
4. (d) in circumstances in which the person making the disclosure has reasonable grounds for believing that the disclosure falls within paragraph (a), (b) or (c).").

The noble Lord said: My Lords, I have already spoken to this. I beg to move.

On Question, amendment agreed to.

Clause 49 [General duties of Commissioner]:

Viscount Astor moved Amendment No. 59: Page 28, line 8, after ("Commissioner") insert ("after taking account of any representations made to him").

The noble Viscount said: My Lords, in Committee I moved a similar amendment seeking that it should be the duty of the commissioner, after consultation with the parties affected, to promote good practice by data controllers. The noble and learned Lord the Solicitor-General said that he wondered whether a statutory requirement was right because it raised questions about who the commissioner should consult and that that would be difficult to prescribe. I took note of what the noble and learned Lord said. I have altered the wording so that the amendment I am moving today, Amendment No. 59, does not impose any prescription on who should be consulted, but states simply that the commissioner should take, account of any representations made to him". I propose the amendment on the basis that it seems an improvement which takes into account the noble and learned Lord's concerns. Given that he offered me a slight chink of light in Committee when he said that he would certainly have another look at the matter, I thought that I would come back with a better amendment. I hope that the noble and learned Lord finds it acceptable.

Again, this is a large group of amendments and your Lordships will note that it includes Amendment No. 71, which stands in the name of the noble Baroness, Lady Nicholson, and which deals with data matching. I have my name to that amendment as I support the principle, but I shall leave it to the noble Baroness to go into all the details. I beg to move Amendment No. 59.

Lord Williams of Mostyn

My Lords, this grouping contains Amendments Nos. 59, 61 and 62. The noble Viscount is right that he raised this matter in Committee when we indicated that there might be some advantage in requiring the commissioner to consult. We promised that we would think about it and we have. We have become convinced that there is an advantage in making the consultation mandatory. It is important that those affected should give their views as part of the process. We believe that our amendment, Amendment No. 61, which specifies, and after such consultation with trade associations, data subjects or persons representing data subjects as appears … to be appropriate", meets the questions raised by the noble Viscount and others. On the basis that our amendment has been drafted to meet what the noble Viscount wanted, I ask him to withdraw his amendments, Amendments Nos. 59 and 62, and to endorse Amendment No. 61, the government amendment, which we have tabled bearing in mind the representations that he made.

Viscount Astor

My Lords, I am extremely grateful to the Minister and I shall, of course, withdraw my amendment. According to my groupings list, other amendments are grouped with this and I do not know whether it will be convenient for the noble Baroness, Lady Nicholson, to speak to her amendments now or whether the Minister would like me to withdraw mine first.

Lord Williams of Mostyn

My Lords. I believe that Amendments Nos. 60, 63 and 65, which stand in the name of the noble Baroness, come in the next group.

Viscount Astor

My Lords, I have a different groupings list. I am grateful to the Minister. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

7.15 p.m.

Baroness Nicholson of Winterbourne moved Amendment No. 60: Page 28, line 18, at beginning insert ("where so directed by the Secretary of State by order and, in any other case,").

The noble Baroness said: My Lords, in moving Amendment No. 60, I should like to speak also to Amendments Nos. 63, 65, 66, 77 and 71, which is starred. In their places on the Marshalled List, I shall also be moving Amendments Nos. 73 and 76, but most briefly because they are part of the same thinking as this group of important amendments to which I am now speaking.

Clause 49, my proposals to amend it, and the new clause which I propose should follow it (Amendment No. 66) strengthen the position of the data protection commissioner particularly with regard to codes of practice. In justifying such action, perhaps I may refer again in greater detail to Article 286 of the treaty establishing the European Community, as inserted and renumbered by the Treaty of Amsterdam, to the effect that the Council, acting together with the Commission and the European Parliament, shall establish an independent supervisory body responsible for monitoring the application of such Community Acts"— as it were, on data protection— to Community institutions and bodies and shall adopt any other relevant provisions as appropriate". Therefore, it looks as though a commissioner will be appointed in Brussels with broad supervisory powers if the majority of member states go ahead, as we would expect, and ratify the Treaty of Amsterdam. It therefore falls to us to ensure that our data protection commissioner has sufficient powers and sufficient authority to be able to work effectively within such an important EU context.

I suggest that strengthening parliamentary control over this area of work is therefore good practice both with regard to the principles of parliamentary democracy and, in our democracy, given a change of government, it enables the Opposition to look at the activities of the commissioner and to flag up certain issues. That is why my two later amendments ask for positive rather than negative resolution.

The Minister and the Solicitor-General already know how important I think it is that we should address codes of practice particularly with regard to data matching which opens the door to blackmail and blacklisting with regard to household indebtedness and trades union involvement. From the point of view of individual freedom, codes of practice on matters such as data matching are safeguards with regard to the trend towards centralised computer filing. The immense increase in computer powers in the current decade has made "Big Brother" central filing not only a technical possibility by the linking together of data bases, but also an actuality. "Relational data bases" are a practice nowadays.

I am sorry to say that "data mining", which means searching for and extracting by automated means information of personal importance, has already been engaged in by government agencies for commercial gain. I cite an example which was given to me by a civil servant. In his private capacity he parked his car in a Safeway car park. To his surprise, by the payment of £2.50 Safeway was easily able to obtain his details from the agency which carries the powers of registering and licensing cars. In fact, he had no parking problems. He wrote to the agency asking how it could happen and it was made clear to him that on the payment of £2.50 it was readily possible for the agency to match a numberplate with a name and address and to give out that information to bodies such as supermarkets and carpark agencies.

It is therefore very important that codes of practice are drawn up for data matching and data mining for relational data bases. These and other codes of practice will come within the commissioner codes to be placed before Parliament so that Parliament, the general public and experts in this field of work are consulted in the drafting process under this part of the Bill, and Parliament will have authority to comment on such matters.

Finally, although such codes will not have the force of law they will nevertheless be extremely influential. I have no doubt that they are likely to be taken into account by courts dealing with data protection issues. I beg to move.

Lord Elton

My Lords, before the noble Baroness sits down perhaps she will deal with one point. The noble Baroness said that she was speaking also to Amendment No. 65, which apparently withdraws the requirement for the registrar to report to Parliament. I did not hear the noble Baroness refer to it in her speech. Can she tell us why that is so?

Baroness Nicholson of Winterbourne

My Lords, if the noble Lord, Lord Elton, did not hear me comment on that amendment then I doubt very much that I did so. I shall double check to see why I did not. I suggest that the noble Lord speaks to it himself.

The Earl of Northesk

My Lords, I acknowledge that the Bill poses a thorny problem with respect to issues such as data matching, data sharing or even data mining, to which reference has been made by the noble Baroness, Lady Nicholson. On the one hand, I do not believe that there is any dispute among noble Lords that such practices need to be properly and adequately regulated. On the other hand, it is appropriate to ask whether the Bill as a framework measure is the appropriate place to achieve that objective. I have no objections to the general tenor of the arguments advanced by the noble Baroness. Proper and effective codes of practice for data matching are necessary. In so far as I have a difficulty with Amendment No. 71 for example, it is because while it may resolve the specific problem with regard to government departments its remit in the context of a framework Bill is a little too focused. Leaving aside the issue of government being a very big player in information terms, what of the wider world? More importantly, if it is right to regulate data matching in this way surely it must also be right to regulate data sharing, data mining, closed-circuit television and so on by the same mechanism.

I believe that to pursue such a strategy renders the Bill rather more unwieldy than it already is and fixes it in the here and now, thereby denying it flexibility so that it is applicable for a sufficient time in the future. Of course, this leaves the difficulty of how to regulate such practices within government and beyond. I believe that the most serious problem is one of transparency. The public do not really know what goes on with government and other databases. That being so, it gives rise to quite legitimate fears that perhaps data is being processed unlawfully by virtue of these practices. The real issue, therefore, is how to engender that transparency as well as greater public trust in the technologies involved. I tend to share the views of the data registrar on this point. In an ideal world it should be possible to ensure that the practice of data matching or any other current or future computer technologies which have implications for data protection is assessed on a case-by-case basis; that is, as a generality it is conceivable that the problems here can be addressed by reference to specific clauses in individual pieces of legislation as and when it becomes necessary so to do.

It may be that earlier in today's proceedings I enhanced any reputation that I may have had as a member of the awkward squad as far as concerned the Front Bench opposite. I hope that my views on this matter do something to help redress the balance. I wonder whether the Minister has any thoughts to contribute on the suggestion that I have made.

Lord Elton

My Lords, curiosity has drawn me into a debate in which I had not intended to participate. I note that Amendment No. 65 purports to remove subsection (7) from Clause 49. That amendment is grouped with the amendment that we are now discussing, and the noble Baroness said that she was speaking to the whole group. I do not believe that it is germane to the questions that we are asking. I believe that it would be quite appropriate for the registrar to make this report, but, in any case, if no arguments are put forward in support of the amendment I am sure that noble Lords will not accept it.

Baroness Nicholson of Winterbourne

My Lords, the noble Lord, Lord Elton, in his very helpful intervention, may not have had sufficient time to examine Amendment No. 66.

Lord Williams of Mostyn

My Lords, this group of amendments comprises Amendments Nos. 60, 63, 65, 66, 71 and 77. We had an interesting and informed discussion in Grand Committee on the issues to which the noble Baroness has returned this evening. We pointed to the Bill's requirements for personal data to be processed lawfully and fairly and explained that such processing could only be done lawfully by government departments under the royal prerogative, the authority of statute or common law. We said that we would carefully consider the general approach which the noble Baroness deployed.

There have been very useful discussions between officials, the registrar, the noble Baroness and others. Therefore, we are perfectly content to welcome Amendments Nos. 60, 63, 65, 66 and 77. We believe that there is a difference in respect of Amendment No. 71, and it is certainly not the awkward squad from which I take my endorsement. The noble Earl, who is very knowledgeable on these matters, said in Committee that we needed to have a sensible regime that was not too inflexible and therefore unworkable either for industry or data subjects. We do not believe that we need the provision set out in Amendment No. 71 because we have moved flexibly towards a good deal, if not virtually all, of what the noble Baroness sought. Therefore, I respectfully invite her not to press Amendment No. 71 but to be content with something that is larger than a small mercy; namely, the acceptance, if your Lordships think it appropriate, of Amendments Nos. 60, 63, 65, 66 and 77.

Baroness Nicholson of Winterbourne

My Lords, I am most grateful to the Government. I appreciate the initial response of the Minister when I raised this subject in Grand Committee. I fully appreciate that this subject takes considerable thought. I also recognise the hard work that has gone into this matter and the consultation that the Minister has so kindly enabled me to have. He properly suggests that with the acceptance of Amendments Nos. 60, 63, 65, 66 and 77 Amendment No. 71 becomes superfluous. Therefore, I shall not move that amendment.

Viscount Astor

My Lords, before the noble Baroness sits down, since my name appears against Amendment No. 71 perhaps I may say how grateful I am to the Government for their response. Certainly, the other amendments go a long way towards addressing the concerns.

On Question, amendment agreed to.

Lord Williams of Mostyn moved Amendment No. 61: Page 28, line 18, after ("so") insert ("and after such consultation with trade associations, data subjects or persons representing data subjects as appears to him to be appropriate,").

On Question, amendment agreed to.

[Amendment No. 62 not moved.]

Baroness Nicholson of Winterbourne moved Amendment No. 63: Page 28, line 28, at end insert— ("() An order under subsection (3)(a) shall describe the personal data or processing to which the code of practice is to relate, and may also describe the persons or classes of persons to whom it is to relate.").

On Question, amendment agreed to.

[Amendment No. 64 not moved.]

Baroness Nicholson of Winterbourne moved Amendment No. 65:

Page 29, line 4, leave out subsection (7).

On Question, amendment agreed to.

Baroness Nicholson of Winterbourne moved Amendment No. 66: After Clause 49, insert the following new clause— REPORTS AND CODES OF PRACTICE TO BE LAID BEFORE PARLIAMENT (".—(1) The Commissioner shall lay annually before each House of Parliament a general report on the exercise of his functions under this Act. (2) The Commissioner may from time to time lay before each House of Parliament such other reports with respect to those functions as he thinks fit. (3) The Commissioner shall lay before each House of Parliament any code of practice prepared under section 49(3)(a) for complying with a direction of the Secretary of State, unless the code is included in any report laid under subsection (1) or (2).").

On Question, amendment agreed to.

Clause 51 [International co-operation]:

Lord Falconer of Thoroton moved Amendments Nos. 67 and 68: Page 30, line 11, leave out from ("Kingdom") to end of line 14 and insert— ("() The Commissioner shall, if so directed by the Secretary of State, provide any authority exercising data protection functions under the law of a colony specified in the direction with such assistance in connection with the discharge of those functions as the Secretary of State may direct or approve, on such terms (including terms as to payment) as the Secretary of State may direct or approve."). Page 30, line 28, at end insert— (""data protection functions" means functions relating to the protection of individuals with respect to the processing of personal information.").

On Question, amendments agreed to.

Clause 54 [Confidentiality of information]:

Lord Falconer of Thoroton moved Amendments Nos. 69 and 70: Page 31 , line 23, leave out subsections (1) and (2) and insert— ("(1) No person who is or has been the Commissioner, a member of the Commissioner's staff or an agent of the Commissioner shall disclose any information which—

1. (a) has been obtained by, or furnished to, the Commissioner under or for the purposes of this Act,
2. (b) relates to an identified or identifiable individual or business, and
3. (c) is not at the time of the disclosure, and has not previously been, available to the public from other sources,

unless the disclosure is made with lawful authority. (2) For the purposes of subsection (1) a disclosure of information is made with lawful authority only if, and to the extent that—

1. (a) the disclosure is made with the consent of the individual or
2. of the person for the time being carrying on the business,
3. (b) the information was provided for the purpose of its being made available to the public (in whatever manner) under any provision of this Act.
4. (c) the disclosure is made for the purposes of, and is necessary for, the discharge of—
1. (i) any functions under this Act, or
2. (ii) any Community obligation,
5. (d) the disclosure is made for the purposes of any proceedings, whether criminal or civil and whether arising under, or by virtue of, this Act or otherwise, or
6. (e) having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary for reasons of substantial public interest.").

After Clause 56, insert the following new clause— AMENDMENTS OF CONSUMER CREDIT ACT 1974 (".—(1) In section 158 of the Consumer Credit Act 1974 (duty of agency to disclose filed information) —

1. (a) in subsection (1) —
1. (i) in paragraph (a) for "individual" there is substituted "partnership or other unincorporated body of persons not consisting entirely of bodies corporate", and
2. (ii) for "him" there is substituted "it",
2. (b) in subsection (2), for "his" there is substituted "the consumer's", and
3. (c) in subsection (3), for "him" there is substituted "the consumer".

(2) In section 159 of that Act (correction of wrong information) for subsection (1) there is substituted— (1) Any individual (the "objector") given—

1. (a) information under section 7 of the Data Protection Act 1998 by a credit reference agency, or
2. (b) information under section 158,

who considers that an entry in his file is incorrect, and that if it is not corrected he is likely to he prejudiced, may give notice to the agency requiring it either to remove the entry from the file or amend it. (3) In subsections (2) to (6) of that section—

1. (a) for "consumer", wherever occurring , there is substituted "objector", and
2. (b) for "Director", wherever occurring, there is substituted "the relevant authority".

(4) After subsection (6) of that section there is inserted— (7) The Data Protection Commissioner may vary or revoke any order made by him under this section. (8) In this section "the relevant authority" means—

1. (a) where the objector is a partnership or other unincorporated body of persons, the Director, and
2. (b) in any other case, the Data Protection Commissioner."

(5) In section 160 of that Act (alternative procedure for business consumers) —

1. (a) in subsection (4) —
1. (i) for "him" there is substituted "to the consumer", and
2. (ii) in paragraphs (a) and (b) for "he" there is substituted "the consumer" and for "his" there is substituted "the consumer's", and
2. (b) after subsection (6) there is inserted—

(7) In this section "consumer" has the same meaning as in section 158." ").

On Question, amendments agreed to.

[Amendment No. 71 not moved.]

Clause 60 [Orders, regulations and rules]:

Lord Williams of Mostyn moved Amendment No. 72: Page 34, line 29, leave out ("13(5)") and insert ("13(2A)(b)").

On Question, amendment agreed to.

Baroness Nicholson of Winterbourne moved Amendment No. 73: Page 34, line 32, at end insert— ("section 31(3),")

The noble Baroness said: My Lords, I spoke to this amendment earlier on Amendment No. 76. It is a request to the Government that approval should be sought by Parliament rather than that codes of practice, particularly with regard to journalism, literature and art should go through by negative resolution. I ask the Government to comment on the two amendments.

Lord Falconer of Thoroton

My Lords, Amendments Nos. 73 and 76 were grouped at an earlier stage. Amendment No. 73 is being moved now, but there is no difficulty over that.

It is essentially a matter of judgment whether a particular power to make subordinate legislation should be subject to negative resolution or affirmative resolution. The general approach adopted in the Bill is that the affirmative resolution procedure is needed where the subordinate legislation affects individuals' rights—for example, subject access exemption orders— or otherwise significantly affects the basic data protection regime; for example, the specification of the descriptions of processing subject to preliminary assessment under Clause 21.

I do not believe that the power provided by Clause 31(3) falls into either of those categories. It is essentially a procedural mechanism for establishing whether or not particular codes of practice relevant to the question whether publication of special purposes material is in the public interest. The order-making power does not of itself determine whether publication is in the public interest. It merely allows the Secretary of State to say that such and such a code may be relevant to the question. This is a very limited function, and I am not absolutely persuaded that it needs to be subject to the affirmative resolution procedure.

The Select Committee on Delegated Powers and Deregulation of your Lordships' House has considered the powers provided by the Bill to make subordinate legislation. In its report of 4th February it did not express a view on the power in Clause 31(3). This suggests that the Select Committee is satisfied that negative resolution is appropriate. Nonetheless, since the noble Baroness clearly feels that this is a matter of some importance, I am pleased to tell her that the Government can accept these amendments.

Baroness Nicholson of Winterbourne

My Lords, I am grateful to the Solicitor-General for his exceptional attention to the Select Committee's pronouncements. I hope that he will continue to think about its pronouncements on Clause 28(4) later in the proceedings.

On Question, amendment agreed to.

Lord Williams of Mostyn moved Amendment No. 74: Page 34, line 34, at end insert ("or paragraph 3A of Schedule 7").

On Question, amendment agreed to.

[Amendment No. 75 not moved.]

Baroness Nicholson of Winterbourne moved Amendment No. 76: Page 34, leave out line 42.

On Question, amendment agreed to.

Baroness Nicholson of Winterbourne moved Amendment No. 77:

Page 34, line 42, at end insert—

("section 49(3)(a),").

On Question, amendment agreed to.

Clause 62 [Index of defined expressions]:

Lord Williams of Mostyn moved Amendment No. 78: Page 36, line 44, column I. leave out ("personal") and insert ("information or").

The noble Lord said: My Lords, in Committee we improved the drafting of the definition of processing by substituting "information or data" for "personal data", wherever the latter term appeared. Those changes were not carried through to the index of definitions. This technical amendment is designed to put that right. I beg to move.

On Question, amendment agreed to.

Lord Williams of Mostyn moved Amendments Nos. 79 to 83: Page 36. line 44, column 2, at end insert ("and paragraph 3 of Schedule (Transitional relief)"). After Clause 62, insert the following new clause— MODIFICATIONS OF ACT HAVING EFFECT AFTER 23RD OCTOBER 2001 BUT BEFORE 24TH OCTOBER 2007 (". During the period beginning with 24th October 2001 and ending with 23rd October 2007, the provisions of this Act shall have effect subject to the modifications set out in Schedule (Modifications of Act)."). After Clause 62, insert the following new clause— TRANSITIONAL PROVISIONS AND SAVINGS (". Schedule (Transitional provisions and savings) (which contains transitional provisions and savings) has effect."). Before Schedule 10, insert the following new schedule — ("SCHEDULE MODIFICATIONS OF ACT 1. After section 13 there is inserted— "Rights of data subjects in relation to eligible manual data. 13A.—(1) A data subject is entitled at any time by notice in writing—

1. (a) to require the data controller to rectify, block, erase or destroy eligible manual data which are inaccurate, or
2. (b) to require the data controller to cease holding eligible manual data in a way incompatible with the legitimate purposes pursued by the data controller.

(2) A notice under subsection (1)(a) or (b) must state the data subject's reasons for believing that the data are inaccurate or, as the case may be, his reasons for believing that they are held in a way incompatible with the legitimate purposes pursued by the data controller. (3) If the court is satisfied, on the application of any person who has given a notice under subsection (1) which appears to the court to be justified (or to be justified to any extent) that the data controller in question has failed to comply with the notice, the court may order him to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit. (4) In this section— eligible manual data" means eligible manual data as defined in paragraph 1(2) of Schedule (Transitional relief) which were held immediately before 24th October 1998, but does not include data to which the exemption in paragraph 14 of that Schedule applies; inaccurate" shall he construed in accordance with section 12(5). 2. In section 14(1), for "13" there is substituted "13A". 3. In section 31—

1. (a) in subsection (2) for "section 13" there is substituted "sections 13 and 13A", and
2. (b) in subsection (4) for "or 13(6)" there is substituted ", 13(6) or 13A(3)".

4. In section 33 for "section 12" there is substituted "sections 12 and 13A". 5. In paragraph 9 of Part 11 of Schedule 1, the word "or" at the end of paragraph (c) is omitted and after paragraph (d) there is inserted "or (e) he contravenes section 13A by failing to comply with a notice given under subsection (1) of that section to the extent that the notice is justified."). Before Schedule 10, insert the following new schedule— ("SCHEDULE TRANSITIONAL PROVISIONS AND SAVINGS Interpretation 1. In this Schedule— the 1984 Act" means the Data Protection Act 1984; the old principles" means the data protection principles within the meaning of the 1984 Act; the new principles" means the data protection principles within the meaning of this Act. Effect of registration under Part 11 of 1984 Act 2.—(1) Subject to sub-paragraph (2), any person who, immediately before the commencement of Part III of this Act—

1. (a) is registered as a data user under Part II of the 1984 Act, or
2. (b) is treated by virtue of section 7(6) of the 1984 Act as so registered,

is exempt from sections 16(1) and 21(5) of this Act until the end of the period at the end of which, if section 8 of the 1984 Act had remained in force, the registration would have expired unless renewed. (2) Any application for registration as a data user under Part II of the 1984 Act which is received by the Commissioner before the commencement of Part III of this Act (including any appeal against a refusal of registration) shall be determined in accordance with the old principles and the provisions of the 1984 Act. (3) If a person falling within paragraph (b) of sub-paragraph (1) receives a notification under section 7(1) of the 1984 Act of the refusal of his application, sub-paragraph (1) shall cease to apply to him—

1. (a) if no appeal is brought, at the end of the period within which an appeal can be brought against the refusal, or
2. (b) on the withdrawal or dismissal of the appeal.

(4) The Commissioner shall include in the register maintained under section 18 an entry in respect of each person who is exempt from section 16(1) by virtue of sub-paragraph (1); and each entry shall consist of the particulars which, immediately before the commencement of Part III of this Act, were included (or treated as included) in respect of that person in the register maintained under section 4 of the 1984 Act. (5) For the purposes of section 19(1), a person who is exempt from section 16(1) by virtue of sub-paragraph (1) shall be taken to be a person in respect of whom an entry as a data controller is for the time being included in the register maintained under section 18; and notification regulations under Part IV of this Act may make provision modifying the duty referred to in section 19(1) in its application to such persons. (6) Where, at the end of the period referred to in sub-paragraph (1), subsection (5) of section 21 applies to a person who was previously exempt by virtue of that sub-paragraph, that subsection shall have effect with the omission of the words from "and either" onwards. (7) Notification regulations under Part III of this Act may make further transitional provision in connection with the substitution of Part III of this Act for Part II of the 1984 Act (registration), including provision modifying the application of provisions of Part III in transitional cases. Rights of data subjects 3.—(1) The repeal of section 21 of the 1984 Act (right of access to personal data) does not affect the application of that section in any case in which the request (together with the information referred to in paragraph (a) of subsection (4) of that section and, in a case where it is required, the consent referred to in paragraph (b) of that subsection) was received before the day on which the repeal comes into force. (2) Sub-paragraph (1) does not apply where the request is made by reference to this Act. (3) Any fee paid for the purposes of section 21 of the 1984 Act before the commencement of section 7 in a case not falling within sub-paragraph (1) shall be taken to have been paid for the purposes of section 7. 4. The repeal of section 22 of the 1984 Act (compensation for inaccuracy) and the repeal of section 23 of that Act (compensation for loss or unauthorised disclosure) do not affect the application of those sections in relation to damage or distress suffered at any time by reason of anything done or omitted to be done before the commencement of the repeals. 5. The repeal of section 24 of the 1984 Act (rectification and erasure) does not affect any case in which the application to the court was made before the day on which the repeal comes into force. 6. Subsection (3)(b) of section 12 does not apply where the rectification, blocking, erasure or destruction occurred before the commencement of that section. Enforcement and transfer prohibition notices served under Part V of 1984 Act 7.—(1) If, immediately before the commencement of section 38—

1. (a) an enforcement notice under section 10 of the 1984 Act has effect, and
2. (b) either the time for appealing against the notice has expired or any appeal has been determined,

then, after that commencement, to the extent mentioned in sub-paragraph (3), the notice shall have effect for the purposes of sections 39 and 45 as if it were an enforcement notice under section 38. (2) Where an enforcement notice has been served under section 10 of the 1984 Act before the commencement of section 38 and immediately before that commencement either—

1. (a) the time for appealing against the notice has not expired, or
2. (b) an appeal has not been determined,

the appeal shall be determined in accordance with the provisions of the 1984 Act and the old principles and, unless the notice is quashed on appeal, to the extent mentioned in sub-paragraph (3) the notice shall have effect for the purposes of sections 39 and 45 as if it were an enforcement notice under section 38. (3) An enforcement notice under section 10 of the 1984 Act has the effect described in sub-paragraph (1) and (2) only to the extent that the steps specified in the notice for complying with the old principle or principles in question are steps which the data controller could be required by an enforcement notice under section 38 to take for complying with the new principles or any of them. 8.—(1) If, immediately before the commencement of section 38—

1. (a) a transfer prohibition notice under section 12 of the 1984 Act has effect, and
2. (b) either the time for appealing against the notice has expired or any appeal has been determined,

then, on and after that commencement, to the extent specified in sub-paragraph (3), the notice shall have effect for the purposes of sections 39 and 45 as if it were an enforcement notice under section 38. (2) Where a transfer prohibition notice has been served under section 12 of the 1984 Act and immediately before the commencement of section 38 either—

1. (a) the time for appealing against the notice has not expired, or
2. (b) an appeal has not been determined,

the appeal shall be determined in accordance with the provisions of the 1984 Act and the old principles and, unless the notice is quashed on appeal, to the extent mentioned in sub-paragraph (3) the notice shall have effect for the purposes of sections 39 and 45 as if it were an enforcement notice under section 38. (3) A transfer prohibition notice under section 12 of the 1984 Act has the effect described in sub-paragraph (1) or (2) only to the extent that the prohibition imposed by the notice is one which could be imposed by an enforcement notice under section 38 for complying with the new principles or any of them. Notices under new law relating to matters in relation to which 1984 Act had effect 9. The Commissioner may serve an enforcement notice under section 38 on or after the day on which that section comes into force if he is satisfied that, before that day, the data controller contravened the old principles by reason of any act or omission which would also have constituted a contravention of the new principles if they had applied before that day. 10. The Commissioner may serve an information notice under section 41 on or after the day on which that section comes into force if he has reasonable grounds for suspecting that, before that day, the data controller contravened the old principles by reason of any act or omission which would also have constituted a contravention of the new principles if they had applied before that day. Warrants issued under 1984 Act 11. The repeal of Schedule 4 to the 1984 Act does not affect the application of that Schedule in any case where a warrant was issued under that Schedule before the commencement of the repeal. Complaints under section 36(2) of 1984 Act and requests for assessment under section 39 12. The repeal of section 36(2) of the 1984 Act does not affect the application of that provision in any case where the complaint was received by the Commissioner before the commencement of the repeal. 13. In dealing with a complaint under section 36(2) of the 1984 Act or a request for an assessment under section 39 of this Act, the Commissioner shall have regard to the provisions from time to time applicable to the processing, and accordingly—

1. (a) in section 36(2) of the 1984 Act, the reference to the old principles and the provisions of that Act includes, in relation to any time when the new principles and the provisions of this Act have effect, those principles and provisions, and
2. (b) in section 39 of this Act, the reference to the provisions of this Act includes, in relation to any time when the old principles and the provisions of the 1984 Act had effect, those principles and provisions.").

On Question, amendments agreed to.

Schedule 10 [Minor and consequential amendments]:

Lord Falconer of Thoroton moved Amendments Nos. 84 and 85: Page 56, line 31, leave out ("sub-paragraph (a) of'). Page 56, leave out lines 33 to 36 and insert—

(""Data protection	14.(a) The Data Protection Commissioner appointed under section 6 of the Data Protection Act 1998;
	(b) the Data Protection Tribunal constituted under that section, in respect of its jurisdiction under section 46 of that Act.")

On Question, amendments agreed to.

Clause 64 [Short title, commencement and extent]:

Lord Williams of Mostyn moved Amendments Nos. 86 and 87: Page 37, line 17, at end insert— ("() sections 1 to 3,"). Page 37, line 20, leave out ("section 60,") and insert ("sections 60 to 62,").

The noble Lord said: My Lords, this group consists of Amendments Nos. 86 and 87. These amendments are technical. They bring the Bill's definition provisions into force on Royal Assent. That clarifies the basis upon which we will be making subordinate legislation once the Bill is passed but before it comes fully into force. I beg to move.

On Question, amendments agreed to.