Data Protection Act 1998

HC Deb 31 October 2001 vol 373 cc304-10WH

1 pm

Mr. Brian H. Donohoe (Cunninghame, South)

It is a great pleasure to speak on this subject given that the Data Protection Act 1998 came into force only a few days ago, on 24 October. I hope to show in my speech the clear conflict between the 1998 Act and Members' privileges. I thank the information commissioner, Elizabeth France, and her staff, the Library and the House authorities for providing me with some of the information that I am about to use.

I hope to show the need for a change to the law, because it is necessary to ease up on the 1998 Act. Members of Parliament are being placed in a straitjacket that is becoming more frustrating by the day. The Act places Members' privileges in question. More importantly, constituents, who have rights of representation, are being denied their rights. I am increasingly being asked to get constituents to sign waivers. They must be signed before I am able to obtain information, which hampers the representations that I can make on their behalf.

I shall give two examples. First, when I write to my local health board appending a letter from a constituent that states his problem clearly, the board takes it upon itself to write directly to my constituent asking for his approval to research the matter when it is obvious that that approval has been granted. The board might even visit my constituent to seek his approval. A complaint against a particular consultant could lead to a constituent's being called to see that consultant, all of which would be done without my involvement. In many ways, that is a slap in the face because, in the first instance, the constituent either wrote to me or came to see me. That process breaches the privileges of a Member of Parliament because it takes him or her out of the loop.

The second example is more extreme. The Scottish Prison Service has decided that, under the 1998 Act, it also needs a waiver. In this hypothetical case I shall call the constituent Jimmy, which is appropriate. Jimmy telephones me from prison and asks me to get him released for one day so that he can attend his aunt's funeral. I phone the prison governor and say, "Why won't you let Jimmy out?" The governor replies, "I am very sorry, but that is sensitive information. You must get him to fill in a waiver." I say to him, "You get that done." He replies, "No, you must do it."

To do that, I must send a letter. The post in the west of Scotland is not great, so it takes three days for the letter to arrive, three days for it to go through the prison service and another three days for it to get back to me, by which time the dear aunt with whom Jimmy stayed for 25 years has been buried. That frustrates my rights of representation on behalf of that individual, regardless of his position. Bureaucracy is denying my constituents proper representation, which was not the 1998 Act's intention.

The basic integrity of MPs has been challenged. I argue that the 1998 Act discriminates. MPs are all honourable ladies and gentleman, yet we are put in a position where organisations do not believe us. The only way that that will be addressed is by changing the law. On the other side of the equation, the public have rights, but I understood that the Data Protection Act was on the statue book simply to protect rights of access for members of the public. That aim is being frustrated and we are achieving the exact opposite of what was intended in the Act. Both public and private companies and organisations are questioning the authority of Members of Parliament.

My constituents are intelligent people, but they are not all university professors. They need protection, which is why they go to their MP in the first place. That is being denied by virtue of what I have outlined, giving just two examples from a great number of cases. Hon. Members' rights are being compromised at their very kernel, and a change in the law is required to—

Mr. Nicholas Winterton (in the Chair)

Order. I must say to the hon. Gentleman, who is making an extremely good case in which I am sure many people are interested, that an Adjournment debate is not the right forum in which to ask for a change in the law. He can ask for action and consideration of the current situation, but this is not the forum for seeking legislation to change the law.

Mr. Donohoe

I do not want to challenge the Chair, but I cleared the matter with the Clerk and was told that it would be all right.

Mr. Nicholas Winterton (in the Chair)

Order. I must intervene. I accept that the hon. Gentleman has taken that action, but my understanding, from the Clerk sitting next to me, is that the position that I outlined is correct. The hon. Gentleman is making an excellent case, and clearly asking for consideration and action. If he does that, he is entirely in order.

Mr. Donohoe

I shall try to keep to that, Mr. Winterton. One Clerk says one thing and another says something else. Perhaps I should have done more to check the position before I called for the debate.

Other elements demonstrate that Members of Parliament are being discriminated against. Lawyers—I have checked this with several—are exempt from a considerable part of the Act, a fact that is outlined in the Act itself. That is down to what is known as legal professional privilege. I argue that MPs need something along those lines. I hope that, now that I have focused attention on the subject, the Government will consider some form of change.

When researching the problem, I came upon a report by the Joint Committee on Parliamentary Privilege. It states: Parliamentary privilege consists of the rights and immunities which the two Houses of Parliament and their members and officers possess to enable them to carry out their parliamentary functions effectively. Without this protection members would be handicapped in performing their parliamentary duties, and the authority of Parliament itself in confronting the executive and as a forum for expressing the anxieties of citizens would be correspondingly diminished. It goes on to say something even more interesting: Another aspect of Parliament's right to regulate its own internal affairs concerns the application of legislation to activities taking place within the Houses of Parliament. The legislation taken not to apply to Parliament includes the Health and Safety at Work, etc. Act 1974 and the Data Protection Acts of 1984 and 1998. All we require, then, is an extension so that when we are outside the premises we remain outwith the law.

The problem for MPs is best explained by quoting two paragraphs from a letter—I believe that a copy has been sent to the Minister—that I received from Elizabeth France, the Information Commissioner, which illustrate the concerns expressed by those involved with the Act. She says: I understand why data controllers are being cautious. There was an express provision in the 1984 Act which allowed disclosure where the data user had reasonable grounds for believing that they were disclosing to someone acting on behalf of the data subject concerned. This applied even if the disclosures in question were not foreseen by the data subject. As there is no such specific provision in the 1998 Act many organisations are properly more circumspect. That demonstrates that the provision should have been included when the House considered the 1998 Act, which came into force on 24 October.

The second paragraph emphasises the point: In many cases the consent of a data subject to the disclosure of personal data can reasonably be inferred, for example where a Member of Parliament writes to an organisation and the nature and content of the letter clearly indicates that the data subject involved has asked the Member of Parliament to represent him. However, this will not always be the case, and if a data controller has doubts it is reasonable for him to check with the data subject that consent has been given. Where the personal data are sensitive, or thought to be sensitive, the data controller will require explicit consent before disclosure to a third party. Normally this consent will be written. It is worth noting that the onus is on the data controller to ensure that they have the correct level of consent before disclosure of the personal data. That is right for the average person in the street, who expects—and gets—protection, but such an approach proves frustrating where a Member of Parliament is trying to make best representations on behalf of a constituent. I am grateful for the chance to quote that letter, because it could not be more helpful in illustrating and reinforcing my argument.

Finally—and with emphasis—I should point out that the Act discriminates. If my reading of it is right, certain Ministers are exempt, and I have already mentioned the section of the Act that excludes lawyers. Although this may be a flippant point, it could be argued that the Act does not cover Scotland. It appears to remain silent on the question of convicting a person who is in breach of the Act on the basis that Scottish courts have been given no instructions in that regard.

I should be interested to hear the Minister's response to those points. In the light of the new era heralded by the Data Protection Act 1998, I want to know how I can best represent my constituents' views.

Mr. Nicholas Winterton (in the Chair)

Order. Before I call the Minister to reply, and further to the matter that I raised earlier, I shall quote from page 327 of Erskine May. Sub-paragraph (b) states: In general, matters that would entail legislation must not be discussed on a motion for the adjournment; but under SO No. 30 Mr. Speaker may permit such incidental reference to legislative action as he may consider relevant to any matter of administration under debate on a motion for the adjournment when enforcement of the prohibition would, in his opinion, unduly restrict the discussion of the matter. I hope that that is helpful to the Chamber. The hon. Member for Cunninghame, South (Mr. Donohoe) has raised an important matter and I have used my discretion. I hope that the Minister will now respond to it.

1.14 pm

The Parliamentary Secretary, Lord Chancellor's Department (Mr. Michael Wills)

Thank you, Mr. Winterton. I congratulate my hon. Friend the Member for Cunninghame, South (Mr. Donohoe) on securing an Adjournment debate on this important and, as we have heard, sensitive subject. I pay tribute to his evident hard work and concern for his constituents, which has been demonstrated in what we have heard.

I speak not as a Minister, but as a Member of Parliament I have come across these issues and know that they are extremely important. Fundamentally, all of us are here to serve our constituents. That often requires us to obtain personal information about individuals from third parties. It is right that we should have access to information so that we can carry out inquiries on behalf of our constituents, but I know that my hon. Friend recognises that we must do so in a way that respects society's concerns for the protection of personal information privacy. It affects us all. No matter how private we seek to be, we can be certain that somebody somewhere holds information about us.

With the rapid development of information and communication technology, it is essential that effective arrangements are in place to ensure that personal information is properly protected. That is not to say that impenetrable walls of secrecy must be built around our data. Information is a key commodity and modern society could not function if it could not be shared. However, we need a balanced approach and rules to safeguard our personal information when it is used by others. Equally, those rules must not prevent the legitimate and responsible use of information by those who need to see and hold it, and that includes all Members of the House of Commons. I know that that lies at the heart of my hon. Friend's concerns.

This new legislation has come into full force only in the last few days, so I draw the Chamber's attention to a helpful guide to the Data Protection Act 1998, which was issued by the House authorities in May 2000. It was prepared in consultation with the information commissioner and covers parts of the law that are relevant to constituency case work and House proceedings. It is a clear and reasonable guide to a complex area of law—I speak as someone who took no part in preparing it. As a constituency Member of Parliament I have cause to be grateful for the guidance. The chapter on constituency case work is particularly relevant.

I want to address the points raised by my hon. Friend. I cannot comment on the individual cases of the local health board and prison authorities to which he referred, and he would not expect me to. I hope that it is clearly understood that what I am about to say has no bearing on those cases.

Two points of principle seem to arise from my hon. Friend's comments. The first is the question of explicit consent. If it is clear to the organisation making the disclosure that the constituent has given consent— explicit consent in the case of sensitive data, such as that to do with health, ethnicity, religion—a disclosure can be made. However, he will appreciate that the circumstances have to be evaluated in each case and an element of interpretation will always exist over what is explicit consent. I hope that he is no doubt that that is the position. A disclosure can be made in certain areas if consent is explicit, but a question lies over the term "explicit consent". I hope that he understands that public bodies must be careful; they have an obligation placed on them by statute and it is important that they discharge it properly. I understand his concerns, but we must not do anything that encourages a public body to be too cavalier in its interpretation.

That leads me to my hon. Friend's second point, but I stress that I shall not comment on individual cases because I do not have enough information and it is not for me to do so. What I am about to say has no bearing on the individual case that he cited.

My hon. Friend referred to delay. Let me make it clear that we do not consider that the Data Protection Act 1998 should ever give rise to significant cause for delay by any public body in going about its proper tasks. The Act puts in place procedures for handling data properly and appropriately. It may require a change of culture in the way that organisations manage information and data, and that is for the best, but it should never be used as an excuse for public bodies not to do something that they should otherwise do in relation to their substantive duties, or for delay. I hope that my hon. Friend is reassured. When new legislation is introduced, some organisations need time for bedding down, but the point remains that it should never be a reason for substantive delay. The legislation introduces new procedures and proper protection.

The question of privilege is important. My hon. Friend drew attention to some of the surrounding issues. The use of personal data in the course of parliamentary proceedings is exempt from data protection principles when the exemption is necessary to avoid infringing parliamentary principle. However, there are examples when parliamentary privilege does not apply, as in the case of letters from hon. Members to Ministers or public authorities about constituency matters, in which case the 1998 Act applies.

My hon. Friend said that it is not clear whether the 1998 Act applies to Scotland. In fact, it applies throughout the United Kingdom and the relevant statute is the Scotland Act 1998, which determines whether a matter is reserved or devolved. Schedule 5 of that Act provides that the subject matter of the Data Protection Act 1998 and the 1995 EC data protection directive are reserved matters, so they apply to Scotland.

Mr. Donohoe

Section 60(1) of the Data Protection Act states: No proceedings for an offence under this Act shall be instituted- (a) in England or Wales, except by the Commissioner or by or with the consent of the Director of Public Prosecutions; (b) in Northern Ireland, except by the Commissioner or by or with the consent of the Director of Public Prosecutions for Northern Ireland. It does not refer to Scotland and the law is silent on that. I would argue that, given that silence, no one in Scotland could be prosecuted.

Mr. Wills

My hon. Friend has the advantage of having the statute in front of him. If I heard him correctly, he was referring to the institution of proceedings. I was referring to the application of the Act and it would be for the authorities in Scotland to take proceedings. Under schedule 5 of the Scotland Act, the Data Protection Act applies to Scotland.

Mr. Donohoe

The Minister now has a copy of the Act.

Mr. Wills

I have a copy, which refers to the institution of proceedings. I am delighted that I heard my hon. Friend correctly and I hope that I have covered his point.

I assure my hon. Friend that the purpose of data protection law is not to prevent Members of Parliament from doing their job properly and conscientiously, as he is doing. It does not prevent them from obtaining the information they need to pursue their constituents' concerns. It establishes a set of rules to ensure that there is appropriate protection for the personal information held about constituents and others. Members of Parliament are always acting on behalf of their constituents for the purpose of data protection legislation, but they may fall to be treated as third parties.

Mr. Jim Cunningham (Coventry, South)

I think that the point that my hon. Friend the Member for Cunninghame, South (Mr. Donohoe) is trying to get across is that when a constituent rings an MP's office wanting him or her to pursue a problem, the MP may have to write to or telephone the constituent to get written consent. Will the Minister confirm that?

Mr. Wills

That is the reality, and it is sometimes necessary. Constituents are not always explicit about what they want Members of Parliament to do on their behalf. Speaking personally, not as a Minister, I have taken up cases where a constituent has asked me to do something, then clarified it later in writing. In some cases, constituents have been unwilling for me to disclose their name to the authority that they want me to approach. They are usually clear and explicit about that from the beginning, but sometimes they do not make it clear until later on in the proceedings. A public body that receives a request for information from a Member of Parliament has statutory obligations to be clear about the basis on which it is handling the information on behalf of the individual to whom it pertains, and to treat it sensitively.

Mr. Cunningham

I accept that that is the case. However, where confusion arises, MPs must use judgment, discretion and interpretation.

Mr. Wills

Of course I accept that sensitive issues are involved. I am trying to explain the need for a balanced approach.

The information commissioner has an important role to play, and I welcome the fact that she has been helpful to my hon. Friend the Member for Cunninghame, South. I understand that she said that it may be necessary to review the range of disclosures that are permitted under schedule 3 and its associated order. It has always been the Government's view that the present arrangements are very much a starting point and that it may be necessary to consider further, in the light of experience of operating the new Act, whether additional processing gateways for sensitive personal data are needed. The directive to which the Act gives effect requires that any such gateways should be in the substantial public interest.

I will study carefully what my hon. Friends have said today to determine whether any amendment to the March 2000 order is necessary in this context. As they will understand, I cannot guarantee that that will produce the outcome that they might wish, but I shall write to them about it in due course. I hope that that gives them some comfort.

It is beyond dispute that Members of Parliament have a legitimate right to make representations on behalf of their constituents.

Mr. Donohoe

Will the Minister explain why lawyers have certain rights that Members of Parliament do not have?

Mr. Wills

They do not have certain privileges that we do not have; they have a certain qualified privilege. As this is a complex issue, I will write to my hon. Friend about it.

This important Act safeguards the rights of individuals in the crucial area of information and privacy. However, we accept that Members of Parliament have a proper interest in the matter, and I shall write to both my hon. Friends with the results of our deliberations on what they have said.