§ 7.21 p.m.
§ Baroness Scotland of Asthal
rose to move, That the draft order laid before the House on 24th July be approved [38th Report from the Joint Committee].
The noble Baroness said: My Lords, the draft order deals with a problem that was drawn to the Government's attention by Members of the other place. They are concerned that the Data Protection Act 1998 prevents them from carrying out their constituency functions properly. There are two related problems, which are different sides of the same coin. The first problem occurs where MPs taking up constituents' cases need to disclose the constituents' 550 personal data to, for example, a government department. If the constituents have not expressly authorised the MPs to disclose the constituents' personal data, the Act will normally require them to seek the constituents' explicit consent to the disclosure. The second problem is the mirror image of the first. It occurs where organisations, such as government departments, need to disclose individuals' personal data to MPs who are acting at the request of the individuals. Again, in most cases the individuals' explicit consent must be sought before the disclosure can be made.
It is important to recognise that the Data Protection Act does not have this effect in every case. As required by the 1995 EC Data Protection Directive, to which it gives effect, the Act distinguishes two categories of personal data: sensitive and non-sensitive. Sensitive personal data cover information about race, political opinions, religious beliefs, trade union membership, health, sex life and criminal activity. All other categories of personal data are regarded as non-sensitive for the purposes of the directive and the Act. The problems I have described arise only with sensitive personal data. But your Lordships should bear in mind that when any information, however trivial it may appear, falls into one of the categories of sensitive data, problems are likely to occur.
The Data Protection Act applies to personal information about individuals that is held in electronic form or on certain manual records. It is not the purpose of the Act to prevent the processing of personal data. Its purpose is, rather, to establish good practice rules with which those processing personal data must comply. I fear that the Act uses some technical terms. I should make clear that the term "processing" as used in the Act means doing anything at all with personal data, from collecting them right through to destroying them, including disclosing them and even merely holding them.
Consistent with the directive, one of the Act's requirements is that the processing of personal data must meet one of various general criteria if it is to go ahead. For non-sensitive data, these criteria pose no problems to MPs in dealing with constituency casework. But the Act sets narrower criteria for the processing of sensitive data. It is with these that problems arise. Among the criteria set out in the Act, and in an order already made under it, the only one that is likely to be relevant is that the individual has given his or her explicit consent to the processing.
Acting on the basis of explicit consent is a very strong safeguard for individuals. The best practice will normally be for elected representatives to seek consent. But there are circumstances in which it is neither necessary nor desirable to seek explicit consent. MPs and other elected representatives will be acting on the basis of requests from their constituents. Constituents will expect elected representatives to take the action necessary to deal with their requests. If they have written to their elected representatives asking them to take up a matter with the authorities, they are likely to be surprised and confused to find that the first action is a response from the elected representatives asking 551 them to confirm that they may disclose their sensitive personal data. Most will surely have thought they had already given the necessary consent by making a request in the first place.
A requirement of explicit consent may also be harmful to individuals' interests, particularly where urgent action is needed. In one case, which led to the preparation of this draft order, a prisoner asked his MP to find out why he could not be given temporary release to at tend his aunt's funeral. The prison refused to give the MP the information without the prisoner's explicit consent. By the time the consent had been obtained, the funeral had taken place. The draft order would overcome that problem by allowing Members of the other place and all other elected representatives to process sensitive data without having to seek their constituents' explicit consent. I beg to move.
Moved, That the draft order laid before the House on 24th July be approved [38th Report from the Joint Committee].—(Baroness Scotland of Asthal.)
§ Lord Goodhart
My Lords, the order was welcomed by Members of all parties in the other place because it makes it easier for Members of Parliament and those of other elected bodies, such as the Scottish Parliament and local authorities, to help their constituents. It does not apply to your Lordships' House, which is entirely understandable, because it concerns elected representatives taking action on behalf of their electorate. This House is not elected; therefore, we do not represent anyone. We do not have regular casework.
There are circumstances in which it would be useful for this order to extend to your Lordships' House. For example, when we are dealing with issues raised by Bills such as the Nationality, Immigration and Asylum Bill, we may be contacted by individuals or organisations acting on behalf of individuals who tell us about their cases with a view to our making use of them in debates. I suspect that few Members of your Lordships' House—including myself, until today—were aware that, in doing so, we might be in breach of the Data Protection Act unless we get explicit consent from the data subject. We cannot rely on inferences. Have the Government considered extending this exemption, in any circumstances, to your Lordships' House? If so, why have they decided not to proceed? If, as I think is more likely, they have not considered extending the exemption, might they consider it, regardless of the outcome? We on these Benches will be happy to support this order here as we did in the other place.
§ Lord Kingsland
My Lords, as happens so frequently, the noble Lord, Lord Goodhart, has said what I wished to say. As a consequence of so speaking, he has rendered any further contribution by me wholly superfluous.
§ Baroness Scotland of Asthal
My Lords, any comments by the noble Lord will never be wholly superfluous.
552 In response to the noble Lord, Lord Goodhart, the Government have considered the position of your Lordships' House. It was decided that this order should refer specifically to elected representatives, of which there are none in this House. We have yet to see whether that will remain the case in the long term. It is correct that the most important elements of the Data Protection Act are the principles that apply. Your Lordships may find that the distinction between sensitive and non-sensitive data is helpful. The majority of information that comes to Members of this House tends to fall into the latter category and not the former. I am sure that noble Lords have made judicious use of that distinction in the past.
On Question, Motion agreed to.