Orders of the Day — Data Protection Bill [Lords]

House of Commons, 2 July 1998.

BASIC INTERPRETIVE PROVISIONS

Geoff Hoon (Labour, Ashfield)

I beg to move amendment No. 19, in page 2, line 43, leave out from beginning to end of line 4 on page 3.

Alan Haselhurst (Deputy Speaker, Saffron Walden)

With this, it will be convenient to discuss Government amendment No. 48.

Geoff Hoon (Labour, Ashfield)

The purpose of the amendments is to delete clause 1 (5) and (6) and the associated reference to the definition of "transfer" in the index of defined expressions in clause 71. Subsections (5) and (6) were originally included in the Bill with the intention that they would help to clarify the somewhat opaque provisions relating to the international movement of personal data in articles 4 and 25 of the directive. In the Bill, we sought to clarify the relationship between those two rules by means of the partial definition of "transfer" in clause 1(5) and the provision in clause 1(6) setting out the application of the geographical scope of provisions in clause 5. However, those provisions have not met with uniform approval and, on reflection and after listening carefully to further representations, the Government have concluded that there still remains a measure of difficulty about their purpose. Given that the sole reason for the inclusion of the provisions was to clarify the position, the fact that they do not appear to have that effect means that they are plainly unsatisfactory. We cannot immediately see a useful way in which the necessary clarity can be achieved by further amending these subsections, so we have concluded that the best thing would be simply to delete them.

John Greenway (Conservative, Ryedale)

In Committee, I asked why the subsections were there at all. I made the point that I had been minded to table an amendment to delete them, but had decided that it might be seen as a wrecking amendment. We warmly welcome the Minister's decision. For the avoidance of doubt or confusion, it is better to remove clause 1 (5) and (6) altogether. It says much about the complexity of the legislation that all the best brains in the Home Office cannot find a way of putting on the face of the Bill what the two subsections intend. Imperfect though the legislation will be without them, it will be less imperfect than it would be with them.

RIGHT OF ACCESS TO PERSONAL DATA

Geoff Hoon (Labour, Ashfield)

I beg to move amendment No. 20, in page 5, line 22, after 'subject' insert 'for the purpose of evaluating matters relating to him such as, for example, his performance at work, his creditworthiness, his reliability or his conduct,'.

Alan Haselhurst (Deputy Speaker, Saffron Walden)

With this, it will be convenient to discuss the following amendments: Government amendments Nos. 21 to 23. No. 11, in page 5, line 48, after 'otherwise', insert ', and with the proviso that the identity of individuals providing information used by credit reference agencies in supplying trade references for partnerships and sole traders should also be exempted from disclosure.'. No. 12, in schedule 7, page 57, line 48, at end insert— '2. In addition, personal data are exempt from section 7 if they consist of the name of the person who has given a reference in confidence for the purpose of assisting a credit reference agency to comment on the creditworthiness of the data subject.'. Government amendment No. 55.

Geoff Hoon (Labour, Ashfield)

Amendment No. 20 relates to clause 7(1)(d), which gives individuals the right of access to information about the logic involved when decisions about them are based solely on the automated processing of their personal data. The intention is that, consistent with the directive, the provision should apply only to decision making to which clause 12 applies. Amendments Nos. 21, 22 and 23 are technical amendments which make more precise the wording of clause 7(2). Amendment No. 55 concerns the Human Fertilisation and Embryology Act 1990, which involves detailed provision relating to the collection of, and access to, personal information. In that sensitive area of treatment affecting the very basics of human life, it is important to ensure that those provisions are not in any way undermined by the Bill. The amendment would ensure that the existing position is maintained.

John Greenway (Conservative, Ryedale)

Amendment No. 20 addresses an issue that I raised in Committee, and I welcome it. In one sense, it limits the scope of the duty for data controllers with regard to the logic in automated decisions. However, the inclusion of the words in the amendment, especially those referring to an individual's performance at work…his reliability or his conduct", are beneficial to the Bill, as they make it clear that such key matters are covered and that automated decision taking will not be permitted concerning them. I think that amendments Nos. 21 to 23 are drafting amendments. I have had the opportunity of discussing amendment No. 55, concerning embryos, with the Under-Secretary of State for the Home Department, the hon. Member for Knowsley, North and Sefton, East (Mr. Howarth), and I agree that, for the avoidance of doubt, it is probably sensible to remove that passage. Amendments Nos. 11 and 12 stand in the names of my hon. Friends the Members for Esher and Walton (Mr. Taylor) and for Poole (Mr. Syms). I do not know whether my hon. Friend the Member for Esher and Walton wishes to catch your eye, Mr. Deputy Speaker, but there has been concern that there should be some exemption from disclosure for the identity of individuals providing information used by credit reference agencies in supplying trade references for partnerships and sole traders". I know that the Government have received several representations on that subject, and the Opposition strongly urge Ministers to keep the issue under review should our amendments not commend themselves to the Government. Several commercial organisations are concerned about the matter, and I hope that the Minister will accept that the Bill as drafted leaves some room for doubt. If it is not to be amended, we ought to have some assurance that the matter will be kept under active review and that perhaps, in two or three years' time, a more formal review will be undertaken.

Ian Taylor (Conservative, Esher and Walton)

I apologise to the Minister for missing, as I dashed into the Chamber, what must have been his fairly extensive opening remarks. I apologise for my lack of courtesy in that respect, but I am grateful that my Front-Bench spokesman has already mentioned amendments Nos. 11 and 12. I do not intend to speak for more than a moment about them because we discussed the general area in Committee. In Committee, the Parliamentary Secretary, said that he would consider the subject sympathetically, but the Home Office then redefined the word "sympathetically" to mean that it would consider the subject very cautiously. I am concerned that, because of the requirement to reveal sources, sole traders, small partnerships and other very small companies may have difficulty in getting credit at all. I believe that there is a general understanding that the subject should be reviewed within three years, and if the Minister is prepared to give me some comfort in that direction, I would not wish to go much further. I want the Government to keep the matter under close review, because, if things went wrong, there could be serious repercussions for very small companies and single traders.

Brian White (Labour, North East Milton Keynes)

I raised this issue a couple of times in Committee, and I know that, since the Minister gave me an assurance at that time, there have been a couple of meetings with the Home Office. I echo the comments that have been made about the need to take the matter seriously and to consider a review. If the Government are not prepared to accept the amendments, perhaps before the Bill comes back from the Lords they will think about keeping the matter under review. Although the provision affects only a small number of people, it could be crucial for the small business men concerned. I urge the Minister to give further thought to that aspect of the Bill. Under the Consumer Credit Act 1974, special provision was made, which was repeated in the Data Protection Act 1984, and it would be useful to review the issue on a continuing basis.

Geoff Hoon (Labour, Ashfield)

I am grateful to the hon. Member for Esher and Walton (Mr. Taylor) for his comments. He should note that, although my introductory observations may not have been extensive, they were certainly comprehensive. He should also appreciate the fact that it is possible to consider representations sympathetically without necessarily agreeing with them. The Government have indeed received a number of representations on the subject, and we recognise that the industry's concerns are genuinely held. The question at the heart of the matter is whether the fundamental information privacy right—the right to subject access—should be restricted because of concerns about the future availability of credit. The arguments presented to the Government so far have not been sufficient to persuade us that the Bill would have the harmful effect on the granting of credit that the industry fears. Therefore, at this stage, the Government cannot accept the amendments. Nevertheless, we recognise that only experience will establish conclusively whether the industry's concerns are justified and, in view of the strength of the concern, I am pleased to give the assurance that the Government will keep the issue under review. We shall reconsider it, in consultation with both the credit industry and small businesses, to see whether the Bill is operating as we intend. I hope that the Opposition will agree that that provides a positive way forward, and will not press their amendments.

RIGHT TO PREVENT PROCESSING FOR PURPOSES OF DIRECT MARKETING

George Howarth (Labour, Knowsley North and Sefton East)

I beg to move amendment No. 24, in page 8, line 27, leave out 'requirement' and insert 'notice'.

Alan Haselhurst (Deputy Speaker, Saffron Walden)

With this, it will be convenient to discuss Government amendments Nos. 25, 26, 30 to 32, 39 to 45, 47, 49 to 54, 56 to 67 and 69.

George Howarth (Labour, Knowsley North and Sefton East)

These are essentially minor, technical drafting amendments, and to save the time of the House I do not intend to make a speech about them. However, I should be happy to explain the purpose of any of them, should that be necessary.

RIGHTS IN RELATION TO AUTOMATED DECISION-TAKING

RECTIFICATION, BLOCKING, ERASURE AND DESTRUCTION

George Howarth (Labour, Knowsley North and Sefton East)

I beg to move amendment No. 27, in page 10, line 30, leave out 'failure' and insert 'contravention'.

Alan Haselhurst (Deputy Speaker, Saffron Walden)

With this, it will be convenient to discuss Government amendments Nos. 28 and 29.

George Howarth (Labour, Knowsley North and Sefton East)

The first of the amendments simply corrects an inconsistency in the drafting of clause 14(4). Paragraph (a) refers to a contravention of the Act. Paragraph (b) refers to a further failure. It should refer to a "further contravention". The amendment makes the necessary change. Clause 14(4) gives the court the power in certain circumstances to order the erasure, destruction or blocking of personal data. Elsewhere, for example in clause 14(1), the court has the power to order the rectification of personal data as well as their blocking, erasure or destruction. There is no good reason why clause 14(4) should not also allow the court to order the rectification of personal data. Indeed, the directive appears to suggest as much. On reflection, we think that confining the rectification remedy to cases of inaccuracy is unduly restrictive. The amendments add the power to rectify to clause 14(4) and make the consequential provision in clause 14(5); and generally align the wording with that used elsewhere.

John Greenway (Conservative, Ryedale)

We welcome the amendments. Clause 14 is extremely important in terms of data subject rights. We agree that the court should have the power to rectify information that is inaccurate in respect of data subjects. The three amendments strengthen the Bill in that area, and we are happy to see them incorporated.

PROHIBITION ON PROCESSING WITHOUT REGISTRATION

George Howarth (Labour, Knowsley North and Sefton East)

I beg to move amendment No. 70, in page 12, line 6, leave out 'section 22 applies to the processing' and insert the processing is assessable processing for the purposes of section 22'.

Alan Haselhurst (Deputy Speaker, Saffron Walden)

With this, it will be convenient to discuss Government amendments Nos. 71 to 82.

George Howarth (Labour, Knowsley North and Sefton East)

I hope to be able to deal quickly with this group of amendments, which makes what is essentially a series of technical improvements to the preliminary assessment provisions in clause 22 and associated provisions. The Bill provides for a limited category of processing, a category where particular worries about data subjects' interests arise, to be assessed by the Data Protection Commissioner for compliance with the principles before it may begin. That implements the system described in article 20 of the directive as prior checking. It is essentially a system reliant on such processing being brought to the commissioner's attention some time before it actually begins, so that he or she can consider it and give a view. In itself, it is not a direct control on processing. It does not give the commissioner a power to intervene in advance and prevent the processing before any problem has in fact arisen. It remains the data controller's responsibility to address any concerns raised in his own way. The simplest means of operating this system is through the process of notification. That is why all processing in this limited category, even where it is carried out manually or might otherwise have been exempted from the notification regime, has to be notified. Usually, when a data controller has made a notification, he may start processing immediately. In the limited category that we are now considering, after the processing has been notified, the data controller must wait for a fixed period, or until he has heard from the commissioner if that is sooner, before he may start processing. That is so that he or she can carry out an assessment. As it stands, the Bill is not as clear as it might be that that is how the system works. The Government are aware that this is a very new feature in our data protection law, being introduced by the Bill as a result of an obligation in the directive. We are also aware that there is an understandable desire among those who might be directly affected for reassurance that the new system will work as clearly and straightforwardly as possible. That is why we have tabled the amendments. The amendments essentially do three things. First, they make technical changes so that the key provisions in clause 22 are easier to follow and the sequence of events is set out more plainly. The drafting is simplified and made more narrative. Secondly, the amendments make clearer the relationship between the preliminary assessment itself and the notification that precedes it. The entire operation of clause 22 is now explicitly predicated on the receipt of a notification by the commissioner, and a more distinct link is made between the processing as it is described in the notification and as it falls to be assessed. Thirdly, both those improvements are carried through to the transitional provisions, where the arrangements are substantially simplified. The provisions on manual and automated data are brought together, and the preliminary assessment system is straightforwardly disapplied in both cases in respect of processing already under way immediately before 24 October 1998. As I have said, preliminary assessment of this nature is a novelty in UK data protection law. Its purpose is to address understandable anxieties relating to particular categories of data processing. The Government are concerned that, in this sensitive area, the Bill's provisions should be as easy to follow and to operate as possible. These technical amendments make substantial improvements in that direction. I commend them to the House.

John Greenway (Conservative, Ryedale)

In Committee, I made the point that, as the effect of the clause is to prevent the data controller from commencing processing until the Data Protection Commissioner has given consent for that processing, it is crucial that the commercial organisations involved know where they stand. Although I still have reservations about the period specified, I agree with the Minister that the amendments improve the meaning of the legislation. However, I draw attention to the fact that, even at this late stage, we are being asked to approve a large number of technical amendments.

DUTY TO NOTIFY CHANGES

PRELIMINARY ASSESSMENT BY COMMISSIONER

NATIONAL SECURITY

Harry Cohen (Labour, Leyton and Wanstead)

I beg to move amendment No. 13, in page 17, line 43, at end insert— '(13) The relevant Commissioner may— (a) investigate any procedure which relates to— (i) the processing of personal data for the purpose of safeguarding national security, (ii) the application of an exemption which is required for the purpose of safeguarding national security, or (iii) the signing of a certificate under this section, (b) make any recommendation which relates to— (i) an investigation under paragraph (a) of this subsection, or (ii) safeguarding the interests of data subjects, and (c) if appropriate— (i) raise any matter which relates to an investigation in an annual report, or in any other report to the Prime Minister, or (ii) liaise with the Data Protection Commissioner or another relevant Commissioner on matters which relate to an investigation. (14) The Data Protection Commissioner may raise with a relevant Commissioner any matter which relates to the processing of personal data for the purpose of safeguarding national security. (15) In this section, the "relevant Commissioner" means the Commissioner appointed by virtue of— (a) section 4 of the Security Service Act 1989, (b) section 8 of the Intelligence Services Act 1994, (c) section 91 of the Police Act 1997, or (d) section 8 of the Interception of Communications Act 1985.'. The idea of the amendment is to introduce some element of accountability to the processing of personal data for the purposes of national security. I find it strange, to say the least, that, in certain respects, the Government are offering more privacy protection to members of the mafia and terrorists under investigation by the security services than they are to ordinary law-abiding members of the public—for instance, a data subject who is being positively vetted. What is more, I am concerned that the Data Protection Act 1984 is being watered down. That Act placed a duty on the security services, by virtue of section 2(2), to comply with the data protection principles. That duty has been removed by this Bill; an exemption under clause 28(1)(a) removes the obligation to comply with the principles. Under section 27 of the Data Protection Act 1984, personal data held for safeguarding national security are exempt only from the enforcement regime, registration and rights of data subjects. That means that GCHQ and MI5 and MI6 had a legal duty to apply the data protection principles, even though there was no way for the data protection registrar to test whether the duty was complied with. The 1984 Act therefore places those organisations under a moral duty to comply with the principles, but, under the provisions of clause 28, they are permitted to process personal data insecurely, disclose personal data to unauthorised persons, and even sell it to newspapers by virtue of the exemption from clause 55(4). It may seem a flippant question, but I ask the Minister whether the fees raised by the sale of such unlawfully procured personal data will go into the Consolidated Fund, and how much revenue he expects to be raised in the next financial year. The Minister might say that MI5, MI6 and GCHQ will not sell unlawfully procured personal data. If that is his argument, why is the exemption in clause 28(1)(c) so wide as to include exemption from clause 55(4), which makes the selling of such personal data an offence? That shows how unnecessarily wide the exemption is with respect to safeguarding national security. Selling misinformation to the newspapers about politicians and perhaps even about the Government will be perfectly lawful for the security services. In support of my amendment, I draw the attention of the House to some of the differences between warrants and certificates under the Bill. In respect of warrants signed by the Secretary of State—for example, for the interception of communications, or burglary—there is a safeguard, in that such a warrant is signed and validated for six months at a time. By contrast, under the provisions of the Bill, a certificate lasts for ever and is never reviewed. I note that for warrants under the Interception of Communications Act 1985, there is an obligation under section 6(3) of that Act to discard irrelevant personal information that has been intercepted. Under the Bill, however, the negation of the third and fifth data protection principles means that irrelevant personal data obtained by means of a certificate can be kept indefinitely. The previous Government gave the security services a new role—to assist the police in dealing with serious crime. The obligations of the police in respect of data protection compliance are apparently not to be required of the security services. The Minister should explain why he has come to that conclusion. The Government seem to be ignoring the advice of the Data Protection Registrar, who asserts in her document "Our Answers": The extension of the role of the Security Service into areas of traditional policing should not carry with it an extension of the exemptions provided by section 27"— the section of the 1984 Act that deals with national security. There is a significant risk that improper processing of personal data—for example, data obtained by what may be regarded in other circumstances as unlawful means—relating to a serious crime suspect, would not be subject to any data protection rules at all. Such processing can be undertaken by the security services. That could jeopardise the quality of evidence before a court and the subsequent trust placed in it by a jury. If data protection is so thoroughly disregarded, there is a possibility that some serious criminals will not be convicted. My amendment would go some way towards introducing a smidgen of accountability into the way that the security services process data. It would use the expertise of the commissioners established by section 4 of the Security Services Act 1989, section 8 of the Intelligence Services Act 1994, section 91 of the Police Act 1997 and section 8 of the Interception of Communications Act 1985. It would be the duty of those commissioners to examine procedures with respect to data protection. They would have powers to investigate any procedure relating to the processing of personal data for the purpose of safeguarding national security; the application of an exemption that is required for the purpose of safeguarding national security; and the signing of a certificate by a Cabinet Minister. The relevant commissioner could make any recommendation relating to that investigation, and make recommendations that were needed to safeguard the interests of data subjects. The proposals in my amendment are no different from the current duties associated with warrants. The amendment would permit the commissioner, if appropriate, to raise any matter that relates to an investigation in an annual report, or in any other report, to the Prime Minister, and to communicate with the Data Protection Commissioner or any other relevant commissioner. That is a pretty moderate amendment. On 1 June the Under-Secretary of State for the Home Department, my hon. Friend the Member for Knowsley, North and Sefton, East (Mr. Howarth) replied to me that the Government have decided not to depart from the existing policy that the Security Service should not register any of the personal data they hold under the Data Protection Act 1984. He went on to say: I understand similar considerations also apply to the Secret Intelligence Service and GCHQ."—[Official Report, 1 June 1998; Vol. 313, c. 52] However, it is a departure from data protection policy when the security services take on a traditional policing role, and that is against the advice of the Data Protection Registrar. I believe that it is an unwise decision. At the very least, the Minister should explain it to the House.

Richard Allan (Liberal Democrat, Sheffield, Hallam)

We have some sympathy with the spirit of the amendment. My noble Friends in another place also tabled amendments on the issue of the security services exemption, because we are concerned about any blanket exemption, where there is no specific justification for exempting data from the data protection principles. The thrust of the Bill derives from European conferences and conversations in which the Parliamentary Secretary, Lord Chancellor's Department was deeply involved, and which reflected, to ome extent, the experiences of the residents of the former East Germany, who had good reason to be suspicious of the way in which their security services held data. We have been extremely fortunate in this country, in that—apart from the odd rumour that is kicking around—our security services have not generally been held responsible for holding damaging personal data. However, one could argue that the security services hold the most damaging data about individuals. They could leak information about someone, perhaps accusing him of heinous crimes such as being a member of CND or—dare I say it—a socialist. Rumours have circulated only recently that the security services hold information and files on people as prestigious as members of the current Government, and that such information was potentially leakable and potentially damaging. We applaud the spirit of the amendment, which seeks to ensure that there is some oversight of security services data and that the buck stops with someone who is accountable under the legislation. We look forward to hearing from the Minister how the Bill would cope if damaging, sensitive personal data were revealed and were traced back to a security services source. If a person sought redress for that, we would be interested to hear what channels would be available to him, and how the issue would be resolved.

John Greenway (Conservative, Ryedale)

I have been looking forward to the contribution of the hon. Member for Leyton and Wanstead (Mr. Cohen). He tabled a great number of amendments for the Standing Committee, but sadly, for reasons that I cannot explain, he was not selected to serve on the Committee, so we were denied the opportunity of hearing from him. However, having listened to the hon. Gentleman, and having considered his amendment No. 13, Conservative Members would oppose its inclusion in the Bill. We considered this important matter in Committee, and we were at pains to support the Government in requiring that the provision be in the Bill. It is provided for by the directive in article 13 and we believe that, on balance, clause 28 provides an adequate appeal mechanism to the tribunal. While we understand that there are always concerns about such matters, we are not convinced that the House needs to go further in this legislation than the appeal mechanism that is already provided in clause 28.

George Howarth (Labour, Knowsley North and Sefton East)

My hon. Friend the Member for Leyton and Wanstead (Mr. Cohen) and the hon. Member for Sheffield, Hallam (Mr. Allan) tempt me along highways and byways in this debate that it would probably be sensible not to pursue. However, it is important to say at the outset that the Data Protection Act 1984, to which my hon. Friend referred, does not exempt agencies from the data protection principles. Only data users who are required to register are bound by the principles. Section 27 of the 1984 Act provides an exemption from registration where the exemption is needed for national security purposes. That is the exact position. Consistent with that, clause 28 provides for personal data to be exempted from the main elements of the Bill when that is necessary in order to safeguard national security. The question of necessity is subject to ministerial certification. There is a right of appeal for any person who is directly affected by that certification. The exemptions provided in clause 28 apply only to the extent needed, and a Minister must satisfy himself that the exemptions claimed are in fact required for the purpose of safeguarding national security before issuing a certificate. The right of appeal against a national security certificate is an important new safeguard. It represents an advance on the 1984 Act, which offered no appeal rights. Appeals will be considered by a specially constituted panel of the data protection tribunal, whose membership will be drawn from the chairman and deputy chairman appointed by the Lord Chancellor and designated by him as being capable of hearing such appeals. My hon. Friend's amendment would, perversely, have the effect of extending the roles of certain commissioners well beyond those that Parliament intended for them. Commissioners were appointed to carry out certain well-defined and limited functions specifically in relation to the security and intelligence services, the use of intrusive surveillance by the police and the interception of communications. Furthermore, the commissioners' remits by no means cover the whole field encompassed by the national security exemption. The arrangements set out in clause 28, as drafted, give continued effect to the well-established policy that personal data should be exempt from the main elements of the data protection regime, including supervision by the Data Protection Commissioner, where that is necessary in order to safeguard national security. My hon. Friend chooses not to recognise that the exemption is balanced by the provision for appeals to be made to the tribunal against the issue of ministerial exemption certificates. My hon. Friend's amendment would undermine that policy.

Harry Cohen (Labour, Leyton and Wanstead)

I hear what my hon. Friend has said, particularly in his initial comments. The thrust of my argument is that, under the 1984 Act, the security services have a legal duty to comply with the data protection principles, although they do not have to register. The Bill takes away that duty in the law for security services to comply. Is the Minister saying that I have misread the situation—that the security services still have a duty to comply with the data protection principles and that the 1984 Act has not been weakened in any way?

George Howarth (Labour, Knowsley North and Sefton East)

I apologise if my hon. Friend misunderstood me earlier. The 1984 Act exempts the security services from the principles, and it is important to recognise that fact. In light of my arguments and the necessity for such arrangements, I hope that my hon. Friend will feel able to withdraw his amendment.

Harry Cohen (Labour, Leyton and Wanstead)

I will seek to withdraw my amendment, as I hear what the Minister has said. However, I ask him to re-examine his last comment that the 1984 Act did not require the security services to comply with the data protection principles. As I understand it, section 2(2) of part I of the Act requires them to comply with those principles. I ask my hon. Friend to re-examine that point and perhaps clarify the situation in writing. On the basis of my hon. Friend's comments, I beg to ask leave to withdraw the amendment.

CRIME AND TAXATION

John Greenway (Conservative, Ryedale)

I beg to move amendment No. 8, in page 17, line 45, after 'prevention', insert 'investigation'. This is the first of two or three important points that the Opposition wish to raise on Report. The entire Committee stage was characterised by several debates about the importance of safeguarding those organisations, other than the police service and public authorities, whose role is to protect us from the criminal and fraudulent activities of others. I shall briefly explain the background. The Bill essentially blocks or prevents the processing of sensitive data, including matters relating to criminal convictions and criminal records, other than in the case of certain specific exemptions. The main exemptions with regard to crime are set out in clause 29. Those exemptions are clearly enshrined in article 13 of the directive, which the Bill seeks to implement in our law. The specific exemption is that personal data may, in certain circumstances, be exempt from the provisions of the Bill if they are processed for the prevention or detection of crime. Article 13 refers not just to the prevention or detection of crime and the prosecution of criminal offences but to the investigation of crime. We believe that the inclusion of the word "investigation" in the Bill will give added comfort to those who undertake risk assessment work in order to combat potential fraud involving credit cards, false insurance claims and so on. Much of that work is of an exploratory nature, when there is no evidence of any crime. Investigation and detection are two separate activities. For instance, let us suppose that we are talking about a suspicious death. When it is clear that that suspicious death is the result of a murder, the investigation seeks to detect who committed that murder. However, if there is a suspicious death and the investigation seeks to establish the circumstances of that death, it may be discovered that there was no murder at all. However, there is an investigation. Commercial organisations conduct such routine investigations every day in assessing whether certain people are making a succession of fraudulent insurance claims or are involved in credit card or other banking or financial fraud. Many of their investigations conclude that there was no crime committed in a particular case. As article 13 gives Parliament the opportunity to incorporate the word "investigation" of crime and criminal offences in our legislation, I cannot, for the life of me, understand why the Government are so against including that word. The Minister will argue that that word is superfluous, and that, in the Government's judgment, prevention or detection of crime is adequate. If that is the case, why on earth does the directive allow for the prevention, investigation or detection of crime? Clearly the intention when the directive was drafted was that the word "investigation" would add comfort to the scope of the exemption. Given the seriousness of what we are attempting to provide for, I do not understand why the Government are so against it. 8 pm Although we had a lengthy debate in Committee, and although we acknowledge that Ministers have said that they will give other comforts to those organizations—I should state for the sake of the record that the order-making power at paragraph 9 of schedule 3 provides that the Secretary of State may exempt several specific circumstances from a number of provisions—the Bill would be better if it included the word "investigation". That word adds something, and we thought it important for that reason to draw the House's attention to the matter. I ask hon. Members to accept the amendment.

George Howarth (Labour, Knowsley North and Sefton East)

I hope to convince the hon. Member for Ryedale (Mr.Greenway), as he anticipated, that his amendment is unnecessary. Clause 29 sets out specific exemptions that are needed to tackle crime and to collect taxes. They variously affect the fairness and lawfulness principles, subject access, subject information and the non-disclosure provisions. Between them, the purposes set out in subsection (1)(a) and (b) cover the whole process of tackling crime—from measures intended to prevent crime being committed, to the prosecution of an offender if a crime occurs. The clause does not leave any gaps. The phrases prevention or detection of crime and apprehension or prosecution of offenders are familiar from the Data Protection Act 1984. They embrace the whole investigative process, which is covered by a combination of "detection", "apprehension" and "prosecution". The investigation of a crime is an activity rather than a purpose. There are a number of purposes for which someone might want to investigate a crime: they might be benign, such as academic research, or not, such as the furtherance of a crime. The hon. Member for Ryedale went some way to acknowledge that point. The scope of clause 29 is limited to the purposes of law enforcement and public protection. The investigation of a crime in that context is limited in its purposes to the prevention or detection of crime and the apprehension or prosecution of offenders. Those are the only relevant objects of criminal investigation for current purposes, and they are already covered by clause 29. There is no disagreement between the hon. Member for Ryedale and the Government. The amendment is simply not necessary to achieve the effect that he and I want to achieve. In the light of that, I hope that he will withdraw it.

John Greenway (Conservative, Ryedale)

As the Minister said, I had anticipated his answer, and it was very much the answer that we got in Standing Committee.

Geoff Hoon (Labour, Ashfield)

Consistent.

John Greenway (Conservative, Ryedale)

It certainly is consistent—and we have been consistent in our argument. The Minister has not answered on why the word "investigation" appears in the directive but not in the Bill. We must agree to differ, although Conservative Members must take every opportunity to ensure not only that the directive is properly implemented but that the Bill is absolutely clear and as comprehensive as it needs to be. We clearly disagree, and I thought it right to draw the House's attention to this important issue. Over the past few months, many hon. Members have received letters from the organisations to which I referred about their work in combating fraud and criminal activity. We are disappointed that we cannot persuade the Minister on the amendment, but have no wish to divide the House. I beg to ask leave to withdraw the amendment.

John Greenway (Conservative, Ryedale)

I beg to move amendment No. 9, in page 18, line 1, after 'offenders', insert— '(ba) the safeguarding of public security,'. On 22 June, during the Report stage of the Crime and Disorder Bill, there was an important exchange between the hon. Member for Bassetlaw (Mr. Ashton) and the Home Secretary about the extent to which the data protection legislation inhibits the availability and disclosure of information to deal with the vexed problem of football hooligans. I have come across that question before. It was raised seven or eight years ago during the Home Affairs Committee's in-depth inquiry into the policing of football hooligans following the 1990 world cup. The gist of the problem is that information about certain individuals is available but cannot be disclosed to ferry companies or to organisations and football clubs that are issuing tickets because that would breach the data protection legislation. The Bill gives even more comfort to data subjects in protecting their rights over sensitive information about criminal matters, especially when that information has not been tested in the courts, and even though the football intelligence unit may have been monitoring the behaviour of certain individuals. Those people may not have been prosecuted even though the police are only too well aware that, given half a chance, they would cause mayhem. Sadly, some of our own people, and others, have caused mayhem in France and Belgium over the past two or three weeks. In his response to the hon. Member for Bassetlaw, the Home Secretary acknowledged not only that that is a problem, but that he would like to do something about it, if that was at all possible. The Minister is well aware of that. I have spent some time considering the extent to which we might improve the position through the Bill. I previously referred to article 13 on the question of the prevention, investigation and detection of crime, which is one of the exemptions permitted in legislation. It also refers to the national security exemption, which the hon. Member for Leyton and Wanstead (Mr. Cohen) mentioned, and to our defence. Furthermore, it allows national legislation implementing the directive to safeguard public security through an exemption. That is all that we seek: the amendment would safeguard public security, as provided for in the directive. We believe that, if the amendement were accepted, the police would be strengthened and given opportunities to deal with the vexed problem of these louts and hooligans, who have caused so much mayhem and trouble to all of us. The Minister, who comes from Liverpool, knows exactly the extent to which people in his city are heartily sick of the handful who cause such trouble and give the rest a bad name. We debated this extremely important matter not long ago in the context of the Hillsborough tragedy. We are not making the suggestion glibly as an off-the-cuff solution; it is a sincere and genuine effort to help in the fight against hooliganism, which the entire country wants the Government to tackle. I cannot see why the measure would create difficulties for the implementation of the directive. If allowing the police an exemption to deal more effectively with football hooligans does not safeguard the peace and tranquillity of the country, I do not know what does. I can think of nothing that has caused as much alarm and concern to those affected as the antics of those mindless lads. I hope that I have convinced the House that the amendment is extremely important. The Minister may prefer to change the wording. He has tabled a stack of amendments, some of which we have discussed already. The difficulty is that, once we conclude tonight's Report stage and the Bill returns to the other House, the opportunity to amend the Bill will have gone. If the Government accept the amendment tonight, the other place will at least have an opportunity to put it into a more appropriate form of words with which the Government might feel more comfortable. It is 14 years since the House last legislated on data protection; those of us who served on the Standing Committee, and doubtless all the officials and organisations who have had to deal with this complex Bill, hope to goodness that it is at least another 14 years before we do so again. Clearly, we shall not have an early opportunity to do something about this problem in the future, so I hope that the Minister will look favourably on the argument that we have set out and agree to accept the amendment.

George Howarth (Labour, Knowsley North and Sefton East)

I associate myself with the sentiment behind the amendment. The hon. Member for Ryedale (Mr. Greenway) knows from statements that my right hon. Friend the Secretary of State has made that, like him, we consider those hooligans to be a disgrace not just to the part of the world that I come from—Liverpool—but to every town and city in the country. The Government are determined to do all that we can to reduce football hooliganism. The hon. Gentleman is aware that we are conducting a review of football-related legislation, which will take account of the lessons to be learned from what happened in France. It is clear that we need to consider implementing measures to deal with the football hooligan element who tarnish our reputation abroad. A number of options will be considered, including the ability to restrict those who cause trouble abroad. I know that, in raising these issues, the hon. Gentleman is sincere about what he seeks to achieve. Home Office Ministers are sympathetic to proposals to have special checks, for example, on recipients of world cup tickets. We have asked the Association of Chief Police Officers sub-committee on disclosure to explore the legality and feasibility of making those checks. People who apply to join the England members club, which is run by the Football Association, are checked against a National Criminal Intelligence Service database, which holds information about persons who are known to be, or suspected of being, involved in organised criminality associated with football. NCIS is registered with the Data Protection Registrar, and the Football Association is listed as a body to which NCIS intends, or may wish, to disclose data. 8.15 pm Currently, ACPO has agreed that criminal records should be released only for limited purposes—mainly relating to national security, probity in the administration of the law and protection of vulnerable people, especially children. ACPO concluded that there was very significant legal doubt about its ability to release other information, which could not be resolved within the tight time scale. That was a matter not of data protection, but of its powers under the general law. There was also the practical difficulty of how to be sure that the criminal records released related to the people concerned, rather than to others of the same name. In any event, there would have been further difficulties about compliance with the Data Protection Act 1984 principles of fair obtaining and processing. The Data Protection Registrar was concerned that nothing had been said to people when they applied for tickets in the first instance, and that the check would have been indiscriminate, without regard to suspicion in individual cases. It appeared that the check would have gone much wider than the particular needs of preventing football hooliganism. The FA's desire to check hooliganism was entirely right and proper: the issue was whether that was the right way in which to do it. The ACPO sub-committee is looking afresh at the issues involved. It was not possible to resolve the issues in the short time available before the world cup, but there is now an opportunity for ACPO, the FA and, as necessary, the Data Protection Registrar to consult about the right approach to be taken in future. It is important to have had this debate, and I am grateful to the hon. Member for Ryedale for raising the issue.

John Greenway (Conservative, Ryedale)

I think that the Minister is about to invite me to withdraw the amendment. I entirely understand why he may not wish to accept it, but can he assure me that if the outcome of the discussions—I am grateful for his offer that we should continue to be part of them—is that an amendment to the legislation is required, there would not be a bar to making such a legislative change?

George Howarth (Labour, Knowsley North and Sefton East)

The hon. Gentleman makes a reasonable point, and I am anxious to be as constructive as possible. Once all the consultations with the Data Protection Registrar, ACPO and others are complete, we shall be required to take some action. The Government, particularly the Secretary of State, have made it plain that we are committed to taking whatever action is sensible and necessary to eradicate the problem. If data protection principles are involved, that necessarily implies some action in that direction as well. I do not know exactly what the vehicle would be and I do not want to give assurances on that, but the Government certainly wish to take action and I am sure that the whole House would support us. On that basis, I hope that the hon. Gentleman feels able to withdraw the amendment.

John Greenway (Conservative, Ryedale)

I am grateful to the Minister. Clearly, there is consensus across the Chamber that what can be done should be done. Given what the Minister has said, I beg to ask leave to withdraw the amendment.

HEALTH AND SOCIAL WORK

Geoff Hoon (Labour, Ashfield)

I beg to move amendment No. 83, in page 18, line 47, at end insert— '(1A) The Secretary of State may by order exempt from the subject information provisions, or modify those provisions in relation to— (a) personal data in respect of which the data controller is the proprietor of, or a teacher at, a school, and which consist of information relating to persons who are or have been pupils at the school, or (b) personal data in respect of which the data controller is an education authority in Scotland, and which consist of information relating to persons who are receiving, or have received, further education provided by the authority.'

Alan Haselhurst (Deputy Speaker, Saffron Walden)

With this, it will be convenient to discuss Government amendments Nos. 84 to 91 and the Government new schedule.

Geoff Hoon (Labour, Ashfield)

Amendments Nos. 83 to 91 and new schedule 1 complete an exercise that was begun in Standing Committee. The Government tabled amendments to bring within the scope of the Bill the records currently covered by the Access to Personal Files Act 1987 and the Access to Health Records Act 1990. The main purpose was to ensure that the arrangements made by the Bill to give effect to the European Court judgment in the case of Gaskin applied to the records covered by the 1987 and 1990 Acts. The Gaskin judgment deals with subject access requests that are refused because giving the information would identify third parties who have not consented. The judgment says that there must be an independent mechanism for reviewing such refusals. The Bill provides that mechanism by allowing data subjects to go to the commissioner or the courts in such cases. The purpose of the amendments is to ensure that the judgment is adhered to in the case of records under the Education (School Records) Regulations 1989 and the corresponding Scotland and Northern Ireland legislation. Such records are held by schools on pupils and former pupils. The new schedule gives rights of access to information held in certain unstructured manual records, to which the provisions of the Bill would not otherwise apply. The amendments will bring those records within the scope of the Bill, and thereby give effect to the Gaskin judgment. I hope that the House agrees that the amendments serve a useful and important purpose.

John Greenway (Conservative, Ryedale)

The Gaskin judgment required the Government to introduce a range of amendments to the Bill, most of which were dealt with in Committee. As the Minister said, these are the outstanding amendments. I hope that, when the Bill returns to the other place, they will be accepted as speedily and as graciously as they have been by the Opposition parties tonight and in Committee.

REGULATORY ACTIVITY

JOURNALISM, LITERATURE AND ART

INFORMATION AVAILABLE TO THE PUBLIC BY OR UNDER ENACTMENT

Harry Cohen (Labour, Leyton and Wanstead)

I beg to move amendment No. 4, in page 22, line 30, at end insert— '(2) The Secretary of State may by order, where personal data are held on a public register, lay down conditions which shall be complied with by any person who has access to the register. (3) An order under this section may make specific provisions with respect to a particular public register.'.

Alan Haselhurst (Deputy Speaker, Saffron Walden)

With this, it will be convenient to discuss amendment No. 5, in clause 67, page 41, line 3, at end insert 'section 34'.

Harry Cohen (Labour, Leyton and Wanstead)

The purpose of the amendments is to enable the Secretary of State to impose statutory conditions to protect lists of shareholders, the electoral roll and other public registers. Publicly available registers are unprotected. They are wide open to abuse, and, in most cases, there is no control over who has access to them or how they are used. On 22 April 1997, The Times noted that the Mayfair rapist selected his rich victims from the electoral roll. I note from my recent parliamentary questions to all Government Departments that several Ministries are not sure for what public records they are responsible. The Department of the Environment, Transport and the Regions said that information on what public records it was responsible for was not held centrally. That is astonishing. Several public registers are not actually publicly available. The Home Office keeps a register of forensic pathologists that is available to the public, which is useful information for criminals to access. Public registers get scant protection under the Bill. The most familiar example of a public register is the electoral roll, copies of which can be obtained by any person for any purpose. Electoral registration officers have no discretion on whether to provide information, even to the most disreputable of characters. The position on data protection and the electoral roll is intolerable.

Richard Allan (Liberal Democrat, Sheffield, Hallam)

Is the hon. Gentleman aware of the recent confusion about whether electoral registration officers can give access to the register in computerised as opposed to paper form? It is a problem for political parties if they cannot obtain access to the computerised form. We are interested to know how that will be dealt with in the Bill. Both the paper and the computerised form will be covered by data protection principles.

Harry Cohen (Labour, Leyton and Wanstead)

The hon. Gentleman makes a good point. The way things are going, I suspect that the computerised form and other forms will be available to whoever wants them. Data subjects are obliged by law to provide names and addresses; failure to do so could result in a hefty £400 fine. Any person can obtain a copy of those details without the data subject being informed. Under clause 34, the electoral returning officer, as data controller, has no obligation to inform data subjects about who has accessed. the register. A clear condition could be imposed that those who access the register should be required to identify themselves, and that list could be publicly available. I am in favour of certain limits on public registers. For example, the electoral roll should be used only for electoral purposes, unless the elector consents to its use for other purposes. However, I recognise that many organisations have developed goods and services businesses on the basis of this publicly available information. My amendment would not stop any misuse directly: it would merely provide a mechanism to permit the Secretary of State to protect the public should the need arise, and to introduce new rules gradually, so that, if appropriate, such organisations could adjust their practice and be weaned off public sources of information over a period. Paragraph 11(c) of schedule 8 delays the implementation of the eighth principle on the transfer of personal data abroad for personal data currently processed from the electoral register. As far as I can see, that provision negates any protection afforded by paragraph 14 of part II of schedule 1. If the eighth principle does not apply, it is difficult to see how the Secretary of State can define restrictions by order. MPs usually live and vote in their constituency. Under the provision in schedule 8, there is nothing to prevent Saddam Hussein or any terrorist or malicious person from being able to purchase copies of the register, in computerised form, to find out where MPs or other well-known individuals live. Admittedly, it is a crude method. Because of his common surname, my right hon. Friend the Member for Islington, South and Finsbury (Mr. Smith) might evade detection. However, one wonders how many people appear on the electoral roll with the surname of my hon. Friend the Member for Wellingborough (Mr. Stinchcombe) or of the hon. Member for Montgomeryshire (Mr.Öpik). Someone might even look up the name Beckham for malicious purposes. Will the Minister explain why data protection legislation seems to expose MPs and others in the public eye to that risk? After the passage of the Bill, the Minister should take a co-ordinated look at how public registers are kept, who has access to them and what uses are permissible.

Geoff Hoon (Labour, Ashfield)

I thank my hon. Friend the Member for Leyton and Wanstead (Mr. Cohen) for allowing us to have this short debate, which will be of assistance. He is concerned about clause 34, which performs an important function. It ensures that certain key provisions of the data protection regime do not conflict with the rules relating to information that is required by statute to be made public. As my hon Friend's amendments recognise, the provision is essentially about public registers. He gave a number of examples: the registers of births, marriages and deaths, registers held by Companies House, the electoral register, and so on. The essential feature of all those registers, which is recognised in clause 34, is that they are all governed by their own discrete legislation. Those statutes will determine the detailed conditions that apply to the information contained in the registers. They will cover matters such as the nature of the information contained in the registers, the conditions governing access to the registers, the accuracy of the information, and so on. The purpose of clause 34 is to ensure that the detailed rules of the specific statutes, rather than the general data protection rules governing the registers, determine those matters. I hope that my hon. Friend will accept that that is sensible. The information contained in the registers is collected for a specific and particular purpose. It is much more appropriate for the specific statute to determine the relevant conditions that apply than for the general data protection legislation to do so. That is not to say that the data protection rules do not apply at all. To the extent that the data protection principles, and other provisions of data protection law, are not dealt with expressly in the specific statutes, they will apply. That is the position under the 1984 Act, and it will be maintained in the Bill. 8.30 pm I remind my hon. Friend that clause 34 does not provide an exemption for the subsequent use of data collected from the registers. To the extent that any of those who obtain personal data from public registers process those data in a way that would be caught by the Bill, they would have to comply in full with the requirements set out in the Bill. My hon. Friend wants to go a little beyond that. He wants to provide the Secretary of State with the power to specify conditions governing access to specific public registers. I hope that I have made it clear why the Government do not believe that that is the right approach. Moreover, I invite my hon. Friend—who I know is extremely knowledgeable on this matter—to consider how his proposed new arrangements would be enforced. Not all those seeking access to the registers would become data controllers, so the conditions could not be enforced through the various mechanisms set out in the Bill. Again, that argues for the conditions applying to particular registers to be set by the parent enactments—if I may use that phrase—which will be able to make suitable arrangements for enforcement. I hope that my hon. Friend will accept that that is the right way forward, and that it is better for these issues to be dealt with in the specific context of the Acts that deal with registers rather than in the context of wider data protection legislation. I am grateful to my hon. Friend for bringing the matter to the attention of the House, but I invite him, in the light of what I have said, to withdraw the amendment.

Harry Cohen (Labour, Leyton and Wanstead)

My hon. Friend is right in saying that I want to go further and impose more general data protection controls on public registers. However, I acknowledge that he has made some good points, so I beg to ask leave to withdraw the amendment.

ENFORCEMENT NOTICES

Harry Cohen (Labour, Leyton and Wanstead)

I should like to speak to amendment No. 1, in page 23, line 32, to leave out "the fourth" and insert "any". However, I welcome the Government amendments that have been grouped with it, which, I think, accept the points that I wanted to make. The rights granted by article 12 (b) and (c) of the European directive, as established by the Bill, should apply to all the data protection principles, and not only to the fourth principle, as originally proposed, so that unlawful and unfairly obtained data—not only inaccurate data—are covered. There was a danger that the Bill would not implement the data subject's rights under those two articles of the directive, which would also have meant a lessening of protection for data subjects under the Data Protection Act 1984. I welcome the Government amendments.

Michael Martin (Deputy Speaker, Glasgow Springburn)

Is the hon. Gentleman saying that he is not moving amendment No. 1?

Harry Cohen (Labour, Leyton and Wanstead)

Yes. I am prepared not to move it, as I accept the Government amendments. Amendments made: No. 33, in page 23, line 33, leave out 'may' and insert 'which requires the data controller to rectify, block, erase or destroy any inaccurate data may also'. No. 34, in page 23, line 34, leave out 'any inaccurate data and'. No. 35, in page 23, line 36, leave out 'or' and insert— '(3A) An enforcement notice in respect of a contravention of the fourth data protection principle'. No. 36, in page 23, line 39, leave out from 'party' to second 'to' and insert 'may require the data controller either— (a) to rectify, block, erase or destroy any inaccurate data and any other data held by him and containing an expression of opinion as mentioned in subsection (3), or (b)'. No. 37, in page 24, line 2, leave out from 'notice' to 'or' in line 4 and insert 'requires the data controller to rectify, block, erase or destroy any personal data'. No. 38, in page 24, line 6, leave out 'were inaccurate' and insert 'had been processed in contravention of any of the data protection principles'.—[Mr. Hoon.]

Richard Shepherd (Conservative, Aldridge-Brownhills)

I beg to move amendment No. 15, in page 24, line 28, at end insert— '(7A) The Commissioner shall maintain a register containing— (a) a copy of every enforcement notice issued under this section; (b) such other particulars relating to such notices as the Secretary of State may by order prescribe. (7B) The provisions of sections 19(6) and (7) shall apply in relation to the register maintained under this section as they do in relation to the register maintained under section 19(1).'.

Michael Martin (Deputy Speaker, Glasgow Springburn)

With this, it will be convenient to discuss the following amendments: No. 16, in clause 42, page 25, line 20, at end insert 'and may, if he considers it appropriate, inform any other person'. No. 17, in clause 59, page 36, line 44, leave out 'necessary for reasons of substantial' and insert 'in the'. Government amendment No. 46. No. 18, in page 36, line 44, leave out 'substantial'.

Richard Shepherd (Conservative, Aldridge-Brownhills)

The amendments reflect concern about a new prohibition on the release of information in clause 59, which would make it an offence for the Data Protection Commissioner or her staff to disclose information about any identifiable business or individual other than in very limited circumstances. The offence would be committed even if the disclosure caused no harm to commercial confidentiality, for example. No such offence exists under the Data Protection Act 1984. The provision is likely to prevent the commissioner from publicly identifying businesses that have been found to be misusing personal data about individuals by obtaining data through deception, for example, or by selling private information for commercial purposes. The commissioner may be unable to reveal that she has received large numbers of complaints about a particular company, that a company has failed to respond to requests to improve its practices or that an enforcement notice has been served against a firm. Equally, it may be an offence to reveal that a business has agreed to correct a problem without formal action, or that a complaint had proved unfounded. The registrar has expressed concern at the new provision, which she says may require her and her staff to be unnecessarily guarded in future. The result may be both to deny the public information that they should have and to undermine public confidence in the commissioner's work, by preventing her from explaining what action she has taken to deal with complaints relating to matters of public concern. The offence is not limited to disclosures likely to cause actual harm, but will be caused by any disclosure of any information about an identifiable business. That contradicts the policy established by the previous Government, whose 1993 White Paper on open government provided that, in any new offences involving the disclosure of information, the presumption will be in favour of the inclusion of a harm test". It is also inconsistent with this Government's proposals for a freedom of information Act. The freedom of information White Paper proposes that information should be withheld only where disclosure would cause either harm or substantial harm to specified interests. Existing statutory restrictions on disclosure are being reviewed with a view to repealing or amending those that do not reflect the proposed harm test. In Committee, my hon. Friend the Member for Ryedale (Mr. Greenway) tabled an amendment to restrict the offence to information that is potentially damaging. The amendment was not accepted. The Government say that the new offence is required by the European data protection directive, which states that national supervisory authorities must be subject to a duty of professional secrecy". However, the registrar's view, as expressed in January, is that that obligation can be met without the creation of a new criminal offence. Moreover, the directive contains a number of pro-disclosure provisions, which would permit a far more balanced approach. They include recital 72, which states that this Directive allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Directive", and recital 63, which states that supervisory authorities must help to ensure transparency of processing". The Government maintain that the restriction is not as serious as it seems, as the commissioner has a discretion to release information under clause 51(2), which states: The Commissioner shall arrange for the dissemination in such form and manner as he considers appropriate of such information as it may appear to him expedient to give to the public about the operation of this Act, about good practice, and about other matters within the scope of his functions under this Act". However, precedent under similar provisions suggests that that may be of limited value. For example, the Health and Safety Commission and Executive are prohibited from disclosing information unless it is for the purposes of their functions, but they are required to ensure that people concerned with matters relevant to the purposes of the Health and Safety at Work Act, etc. 1974 are kept informed of, and adequately advised on those matters. The HSC and HSE interpret those two requirements restrictively, and say that they are prohibited from revealing information about individual premises unless to do so would directly prevent risk, or is necessary to protect health and safety. Requests for information about identifiable premises from people who are not themselves in danger, including Members of Parliament, researchers and journalists, are usually refused. The explicit prohibition on releasing information about identifiable businesses is therefore likely to override the commissioner's general discretion to release information, unless, under clause 59(2)(c), the disclosure is made for the purposes of, and is necessary for, the discharge of…any functions under this Act". It would be extremely difficult to demonstrate that a particular disclosure was necessary for any function under this Act. If the function can be discharged without the disclosure, the disclosure will not be necessary, and, indeed, will be illegal. Clause 59(2) permits disclosure in certain other limited circumstances—for example, when the information is already publicly available, when the individual or business concerned consents to the disclosure and when disclosure is made in connection with legal proceedings. The subsection also provides for a limited, highly restrictive, public interest defence. The amendments would require the commissioner to maintain a public register of enforcement notices, whose disclosure might otherwise constitute an offence. They would permit—but not require—the commissioner to reveal the results of an assessment of whether a particular business was complying with the legislation. At present, that information can be revealed only to the person who asks for the assessment, and its disclosure to a Member of Parliament or a journalist could be an offence. The amendments also attempt to strengthen the public interest defence available to the commissioner or her staff. Let me deal first with amendment No. 15. Under clause 41, the commissioner may serve an enforcement notice when it appears to her that a data controller is contravening any of the data protection principles. The notice may require the controller to take specified action or to stop processing data. The amendment requires the establishment of a register of such notices, as is made clear in new subsection (7A), which would have to be available to the public, free of charge, at all reasonable times. Certified copies of entries could be obtained on payment of any prescribed fee. That is provided for by new subsection (7B), which applies the existing provisions of clause 19(6) and (7), relating to the data protection regime. The amendment would bring the Bill into line with existing legislation, such as the Environment and Safety Information Act 1988 and the Environment Protection Act 1990, which require the establishment of public registers of enforcement notices about environmental and safety hazards. Paragraph (b) of new subsection (7A) would allow the Secretary of State, by order, to require other information relating to such notices to be included in the register. That would allow the fact that a notice had been cancelled under clause 41, or was the subject of an appeal under clause 48, to be recorded; it might also permit the person on whom the notice had been served to add a statement of explanation or mitigation to the register. Amendment No. 16 refers to clause 42. Under clause 42(1), a person who believes that he or she has been directly affected by any processing of personal data may ask the commissioner for an assessment of whether that processing breaches the Act's requirements. After carrying out the assessment, the commissioner must inform the applicant, to the extent that she considers appropriate, of any view formed or action taken as a result". That is in clause 42(4)(b). 8.45 pm However, while the applicant must be informed of the outcome, the commissioner may commit an offence under clause 59 by revealing the same information to any other person. Thus, although there may have been a well-publicised complaint about a particular practice, the commissioner may not tell anyone—including a journalist, a Member of Parliament or another potentially affected person—about her findings. The amendment allows, but does not require, the commissioner to make such disclosures; however, a requirement may arise under the proposed freedom of information Act. The discretion is appropriate in this instance. When a complaint relates purely to the circumstances of an individual applicant, wider disclosure may not be appropriate; but when the issue is of general concern and affects a large number of people, disclosure may be justified—if, for example, it reveals that a bank is failing to safeguard personal data about its customers. There is no reason why the level of disclosure proposed in the amendment should be thought to contravene the obligation of professional secrecy required by the directive, given that the directive also provides that supervisory authorities must help to ensure transparency of processing". Let me now deal with amendment No. 17. A public interest test is available under clause 59(2)(e) should the commissioner, or a member of her staff, be prosecuted for an offence relating to the disclosure of information. The test is particularly restrictive, and amendments Nos. 17 and 18 seek to remove some of the restrictive features. Clause 59(2)(e) provides that no offence is committed if having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary for reasons of substantial public interest. That means that it would have to be established that the disclosure was "necessary", not just desirable, in the public interest, and that the public interest related to the rights and freedoms or legitimate interests of others. That term does not, on the face of it, acknowledge the public interest in the accountability of the commissioner's work. Moreover, the public interest itself would have to be "substantial". It is hard to see why that public interest test should be set down so strictly, particularly as most of the Bill's other public interest tests are less demanding. For example, there is no requirement that the public interest be "substantial" before a newspaper can publish personal data under the public interest test in clause 32(1)(b). Amendment No. 17 would remove the requirement that the disclosure be "necessary" and that the public interest be "substantial". The defence, as amended, would read: having regard to the rights and freedoms or legitimate interests of any person, the disclosure is in the public interest. Amendment No. 18 and Government amendment No. 46 cover similar ground. Amendment No. 18 is an alternative to amendment No. 17. It would delete the word "substantial" in clause 59, but would retain the word "necessary". The amended clause would then read: having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary for reasons of public interest. The wording is effectively identical to amendment No. 46, tabled by the Home Secretary. Under that amendment, the clause would read: having regard to the rights and freedoms or legitimate interests of any person, the disclosure is necessary in the public interest. I hope that the Government will withdraw their amendment and support mine, because the word "necessary" would remain a problem with both amendment No. 18 and amendment No. 46. A disclosure that was "desirable" in the public interest, but not "necessary", would not be permitted under those amendments. There is an important distinction between the two, and I hope that the Government will accept my amendments.

John Greenway (Conservative, Ryedale)

My hon. Friend the Member for Aldridge-Brownhills (Mr. Shepherd) very adequately set out the concerns of the Data Protection Registrar. I tried to impress on the Government the importance of several concerns about the provisions that create the offence of unlawful disclosure of information by staff. People who are only doing their job may find themselves committing a criminal offence. The House must be sure that the legislation provides for that criminal offence only when it is strictly necessary. I was disappointed in Committee that the Government did not accept the harm test to which my hon. Friend the Member for Aldridge-Brownhills referred. There seems to be an inequality in the public interest test, in that the word "necessary" will apply to this provision, even when the Government amendments are made, but not to other exemptions in the Bill. I cannot for the life of me understand why staff who are only doing their job should be subject to a greater hurdle than others when disclosure is accidental, especially as some of the exemptions, as in clause 32, are extremely wide. I hope that the Minister will acknowledge that those are genuine concerns. If Government amendment No. 46 is made, it would at least allow the other place to return to the matter when it considers our amendments. With that in mind, it may not be too late for the Government to reconsider the word "necessary", to which my hon. Friend the Member for Aldridge-Brownhills so rightly referred.

George Howarth (Labour, Knowsley North and Sefton East)

I pay tribute to the hon. Member for Aldridge-Brownhills (Mr. Shepherd) for his hard work and the good advice that he often takes on these matters. His concern about confidentiality of information is well recognised and respected, and he moved the amendment very much in that spirit. Clause 40 is a key part of the Bill. It enables the commissioner to issue enforcement notices requiring compliance with data protection principles. Amendment No. 15 would require the commissioner to maintain a register of enforcement notices, to be accessible in much the same way as the main register of data controllers' notifications provided for in clause 19. The idea of keeping a public record of enforcement notices has been suggested in the past, and we are not unsympathetic to it in principle. I understand that the Data Protection Registrar herself has expressed some interest in such a record, as the hon. Member for Aldridge-Brownhills said. It was with such an idea in mind that the Government tabled an amendment in Committee to add clause 19(2)(b), allowing the Secretary of State, by notification regulations, to authorise or require the commissioner to include in the register of notifications maintained under that clause certain information in addition to the basic registrable particulars. It would be possible to use the provision to add information about enforcement notices to the register. Under clause 25, the commissioner can make proposals for the content of notification regulations. The Government look forward to hearing the commissioner's views and will consider the issue further in that context. Against that background, I invite the hon. Gentleman to withdraw the amendment. Amendment No. 16 would explicitly allow the commissioner to tell any other person, as well as the originator, the outcome of a request for assessment of the compliance of any particular processing with the provisions of the law. I recognise that the provision is discretionary, but I do not think it appropriate for the legislation to be framed in that way. Requests for assessment may deal with essentially private matters—that is, private either to the data subject or to the data controller. More fundamentally, such requests are at most preliminaries to enforcement action, and they may come to nothing, as there may be perfectly good answers to the questions. I am not in favour of any general presumption in favour of releasing the results of assessments. That is not to say that they might not emerge in one form or another under other parts of the Bill. Clause 51 places general duties on the commissioner to promote good practice and to disseminate material that she considers appropriate, about the operation of the Act, good practice and any other matters within the scope of his functions. Anonymised information from assessments may appear in one of those contexts, and the result of any assessment may be quoted in enforcement proceedings. I do not think that a power at large, qualified only by the general term "appropriate", fits what we need in this targeted legislation. Release of information when it serves a particular purpose is fine; but otherwise, just as we have to be careful with the interests of data subjects, we have to be careful with the interests of data controllers. I invite the hon. Member for Aldridge—Brownhills to reflect on the provisions of clause 51 and not to press to a vote amendment No. 16, which is a general amendment to clause 42. Clause 59 is an important and, I accept, difficult provision. It is important because it discharges the obligation on us to ensure that the supervisory authority—the Data Protection Commissioner and her staff—are subject to a duty of what the directive calls "professional secrecy", in respect of the confidential information to which they have access. We have found it difficult to get the provision right. Our original proposal in another place was criticised by the Data Protection Registrar, and we revised it on Report there, but we could not, and still cannot, accede to pressure to remove it; the directive requires us to have a statutory provision, which needs to be enforceable through a criminal sanction. We have considered the detail further in the light of representations, not least from the hon. Members for Aldridge-Brownhills and for Ryedale (Mr. Greenway), and of the Government's own commitment to freedom of information legislation, which the former hon. Gentleman rightly prayed in aid for his argument. Clause 59 states that one way in which a disclosure may be made with lawful authority is if, having regard to the rights and freedoms or legitimate interest of any person. the disclosure is necessary for reasons of substantial public interest. Government amendment No. 46 replaces that with a simple test of necessity in the public interest. I hope that the hon. Member for Aldridge—Brownhills will accept that that goes further in the direction of freedom of information, while still complying with the directive. That is a difficult balance, but amendment No. 46 achieves it. Amendments Nos. 17 and 18 go in much the same direction, as the hon. Gentleman said. I prefer the Government's wording, for two reasons. First, it maintains the necessity test, which is important for an exemption from the directive's requirements. Secondly, our words are simpler. "In the" rather than "for reasons of is a simpler way to express the point. I hope that the hon. Gentleman will be willing to withdraw his wording in favour of ours. The hon. Gentleman argued that clause 59 could, perhaps, go further, and we did consider whether there was further scope for easing the restrictions that the clause imposes, while keeping it consistent with the directive. So far, we have been unable to find a way to do that, but we shall certainly continue to have regard for that point as we continue our work on freedom of information. If we can identify any way in which restrictions can properly be eased, we shall bring forward any necessary amendment in freedom of information legislation. There is scope to revisit the point within that framework, provided that we can find a suitable way to achieve what the hon. Gentleman and the Government want. I hope that the hon. Gentleman will agree that that is a considered response to his concerns, and that he will feel able to withdraw the amendment, safe in the knowledge that we recognise his concerns and are aware of the possibility of revisiting the point at a later stage.

Richard Shepherd (Conservative, Aldridge-Brownhills)

I am extremely disappointed by that reply. I took the trouble to provide the Government with my notes for the debate, and I thought that they would address the issues raised in those notes. However, they have not done so. I thought that there were some benefits in my approach. I was being helpful on the White Paper. There is a muddle, and there is grave concern about how matters interrelate, so I was trying to set out the position. I was also trying to state clearly the anxieties expressed by the Data Protection Registrar, Mrs. France, and by professionals in the field. I was trying to assist the Government by preventing the need for this business to return to the House once the Lords have amended the Bill along my lines. There is one simple problem in both the Government's amendment and my amendments. My argument is that "necessary" would remain a problem under the amendments. Amendment No. 18 was my fallback position, and I was pleased to see the Government withdraw the substantial point. However, "necessary" is being retained, and that reminds me of my experience under Governments of my own party and their unwillingness to yield once Government amendments had been set out. "Necessary" will remain a problem. A disclosure merely desirable, but not necessary, in the public interest would not be permitted under amendment No. 46. The Minister simply has not addressed that point, although it is of the essence. Perhaps he will consult his colleagues and the civil servants in their Box. I would gladly not press amendment No. 18 if the Government would not press amendment No. 46. Then we would have a good raft of amendments that would satisfy the House of Lords. We could prevent the need for the matter to come back.

George Howarth (Labour, Knowsley North and Sefton East)

I have listened carefully to the hon. Gentleman; I hold him in the highest regard. I did not have the opportunity to read the notes that he sent to the Home Office, and I apologise for that. I do not believe, however, that his concerns need to be dealt with in the way he states, because the Government amendments go far enough. I will be sorry if the hon. Gentleman does not feel able to withdraw his amendment. He will be able to revisit the matter, as will the House, under the general heading of freedom of information. I am loth to say more because I sat through long hours of debate on the Maastricht treaty, and I know of the hon. Gentleman's enormous potential to speak again with alarming frequency and great lucidity. I am desperately anxious not to tempt him to do so.

John Greenway (Conservative, Ryedale)

The House is in a dilemma. We have only the prospect that the Government's amendment is likely to be carried, and we have to face that reality. Yet that amendment includes the word "necessary" and I agree with my hon. Friend the Member for Aldridge-Brownhills (Mr. Shepherd) that that word is not required. I am being helpful to the Minister when I say that the House can only accept the Government amendment, but the Government must expect that amendment to be amended in the other place because my hon. Friend's arguments are extremely valid. The word "necessary" is unnecessary. It is not applied in other parts of the Bill. The only opportunity open to us now is to accept the Government amendment. If the House does so, I ask the Government to think again so that when the Bill goes to the other place the word "necessary" can be deleted.

Richard Shepherd (Conservative, Aldridge-Brownhills)

I am grateful to my hon. Friend the Member for Ryedale (Mr. Greenway), and I am concerned. I made out a case which I tried to get to the Whips because I understand the urgency with which the Government have to manage their programme. These were detailed arguments, but they were not addressed in detail. I am genuinely disappointed by the points made about the word "necessary". I hope that the House will have to return to the matter; the Lords will take an interest in this. The Government moved favourable amendments—I congratulate them on that—as a consequence of the Lords taking a view on certain parts of the Bill. I have no doubt that our liberty is in the interstices of the details of Bills such as this. The matter is extremely important which is why I should have liked a more sympathetic response. The Government have moved some of the way, but I ask them to reflect on what that simple word "necessary" means to the burden of the argument as contained in the clause. Accordingly and with the advice and guidance of my good and hon. Friend, I beg to ask leave to withdraw the amendment.

INFORMATION NOTICES

SPECIAL INFORMATION NOTICES

GENERAL DUTIES OF COMMISSIONER

ASSISTANCE BY COMMISSIONER IN CASES INVOLVING PROCESSING FOR THE SPECIAL PURPOSES

AVOIDANCE OF CERTAIN CONTRACTUAL TERMS RELATING TO HEALTH RECORDS

CONFIDENTIALITY OF INFORMATION

PROSECUTIONS AND PENALTIES

MEANING OF "ACCESSIBLE RECORD"

SUPPLEMENTARY DEFINITIONS

INDEX OF DEFINED EXPRESSIONS

SHORT TITLE, COMMENCEMENT AND EXTENT

'Meaning of "educational record" for purposes of section 68

England and Wales

Scotland

Northern Ireland

England and Wales: transitory provisions

THE DATA PROTECTION PRINCIPLES

David Atkinson (Conservative, Bournemouth East)

I beg to move amendment No. 14, in page 48, line 40, at end insert— '9A. The data controller must take reasonable steps to ensure that any computer system used in processing the personal data is capable of dealing accurately with dates later than 31st December 1999.'. The amendment is a response to the situation facing many computer systems in Britain, and even more so world wide, on the failure to recognise the year 2000, which the Prime Minister has dubbed the millennium bug. It seeks to introduce a statutory obligation on data controllers to ensure that computer systems are millennium compliant, thus ensuring that the personal data that they contain are fully protected from any problems arising from the century date change and the year 2000 being a leap year. [Laughter.] I do not know why that is funny, but no doubt the Minister will enlighten me when he replies. I hope that the House knows what I am talking about. This is an issue to which I have drawn attention and about which I have warned on several occasions since my initial question to the then Prime Minister in December 1995, following which I introduced an Adjournment debate and have since introduced two private Member's Bills on the issue.

Brian White (Labour, North East Milton Keynes)

The hon. Gentleman will know that a number of dates in 1999, including 31 December 1999, may cause problems to certain computers. Why does not the amendment cover all the problem rather than just part of it?

David Atkinson (Conservative, Bournemouth East)

The hon. Gentleman is obviously an expert on the issue, so he will know that for computer systems to be millennium compliant they will also take account of the problems anticipated before the turn of the century. The office of the Data Protection Registrar has produced a two-page paper entitled "The Millennium Bomb" which states that there are two problems whenever a two-digit year, represented as 99, changes to 00. It says that personal data may be interpreted as relating to 1900 rather than 2000—that is, the date is out by 100 years—and that the year 2000 is a leap years which is not usually the case for a centenary year. If computer systems are not millennium compliant, a number of basic data protection issues emerge. Inaccurate personal data may be processed. Obviously, therefore, the provisions of the Bill that relate to accuracy—the fourth principle—and those relating to compensation for damage caused through the use of inaccurate personal data, come into play. There may be unfair processing. If the processing is date dependent—for example, age-dependent calculations—it may give inaccurate results and lead to the deletion of personal data before the planned retention time has expired. Such eventualities would appear to breach the first principle in the Bill—providing for personal data to be processed fairly. It can result in the irretrievable loss of data, destroyed prematurely, as well as circumstances in which personal data are lost temporarily—for example, personal data that are unavailable for processing while the problem is being fixed. That appears to breach the seventh principle, relating to the loss, destruction of or damage to personal data. Many more concerns were drawn to the attention of the Science and Technology Select Committee during its investigation of this issue, on which it reported to the House on 7 April. The report was called, "The Year 2000—Computer Compliance". The Minister may argue that my amendment is unnecessary.

Geoff Hoon (Labour, Ashfield)

Very good.

David Atkinson (Conservative, Bournemouth East)

It appears that I have anticipated the Minister. He may argue that because the seventh principle requires: Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. I hope that he does not use that defence, which would be an inadequate response to a unique issue relating to computer systems and the data that they process and the protection of that data for which the Bill provides. Nor would it reflect the Government's clear warnings that the problem is serious and must be addressed if we are to avoid serious difficulties. As the need for computer systems to be millennium compliant is so obvious and serious, it should be mentioned in as many words in the legislation. That is why I propose a new paragraph in schedule 1 which states: The data controller must take reasonable steps to ensure that any computer system used in processing the personal data is capable of dealing accurately with dates later than 31st December 1999. I hope that the Government will have the foresight to accept my amendment.

Geoff Hoon (Labour, Ashfield)

The amendment raises an issue of great topicality. The House is grateful to the hon. Member for Bournemouth, East (Mr. Atkinson) for allowing us to have this brief debate on the data protection implications of the year 2000 problem. He is worried that there may be a risk to personal data processed in computer systems that have not been not programmed to cope properly with the change of date at the end of the millennium. If the problem is as serious as he warns, there could be a risk of corruption of data held on computer systems. The hon. Gentleman invites the House to amend the Bill expressly to deal with that risk. As he anticipated, however, the Government do not believe that such an amendment is appropriate. We believe that the seventh data protection principle and paragraph 9 of part II of schedule 1, already make adequate provision. They ensure that the data controller must take appropriate technical and organisational measures to ensure the required level of security. The requisite level has to be appropriate to the harm that might result from, among other things, accidental loss or destruction of, or damage to, personal data. That appears to cover the entire range of eventualities that might occur to personal data as a consequence of some failure of a computer system because of the year 2000 problem. Problems of this sort could presumably occur for reasons other than the ending of the millennium. The formulation in paragraph 9 is intended to cover the unfortunate consequences that might occur from any failure of a computer system, whether or not it occurs as a consequence of the year 2000 problem. In the light of what I have said, I hope that the hon. Gentleman will agree that his amendment is unnecessary and will feel able to withdraw it.

David Atkinson (Conservative, Bournemouth East)

I am disappointed that the Government have not recognised the value of my amendment and surprised at the flippant way in which the Minister responded. I am surprised because of the prominence that the Government are trying to give the issue, especially since the Prime Minister's speech on 30 March warning of the consequences to the nation if we do not get it right. I am especially surprised because the Minister has been aware of the issue for longer than any other Minister because he was Labour's spokesman on it before Labour became the Government on 1 May last year. If computer systems are not millennium compliant, there will be problems. The privacy of information contained in computer systems will be at risk if they crash because they are not millennium compliant. That is something which few people realise. It appears from what the Minister has said that he and the Government have not yet grasped the issue with the seriousness that it deserves. By ignoring the opportunity that my amendment provides, the Government have missed a valuable opportunity. They are showing amazing complacency on the issue. I appreciate that my amendment was tabled only early this week, so perhaps Ministers have not given serious thought to this aspect of the Bill. I hope that the Government will give my proposal further thought in the other place. I clearly have not persuaded the Government, but I hope that they will give it further thought. I beg to ask leave to withdraw the amendment.

CONDITIONS RELEVANT FOR PURPOSES OF THE FIRST PRINCIPLE: PROCESSING OF SENSITIVE PERSONAL DATA

John Greenway (Conservative, Ryedale)

I beg to move amendment No. 10, in page 51, line 7, at end insert— '4A. The information contained in the personal data has been obtained by the canvassing of data subjects by registered political parties.'. It may come as a surprise to you, Mr. Deputy Speaker, to learn that the Bill would make the processing of personal data obtained from political canvassing illegal. There are some of us who think that if all political canvassing were banned, it would save us an awful lot of toil and sweat at election time, but in reality—the Under-Secretary and I have discussed the matter—we appreciate and recognise that it is important that the problem that the Bill presents is tackled. I am grateful to my right hon. Friend the Member for North-West Cambridgeshire (Sir B. Mawhinney), who first drew attention to the matter when we were considering our response to the Bill. As a former chairman of the Conservative party, he understands and appreciates the importance of electoral law and of ensuring that the data protection legislation does not unnecessarily restrict or prohibit proper canvassing of political opinion by political parties. When we discussed the matter in Committee, the Minister acknowledged that there was a problem, and agreed to do something about it. We have two choices. Our preferred route is to put something in the Bill, and to do it now. That is what amendment No. 10 would do. It is entirely in keeping with the other provisions in schedule 3. That would leave the matter beyond doubt. The alternative is to do what the Minister said that he would do in Committee—use one of the Secretary of State's order-making powers within the Bill to exempt the processing of data from political canvassing. The problem that the House must ask the Minister to address tonight—it is a serious point—is whether any order-making power will be introduced after the Bill receives Royal Assent and while the transitional provisions that introduce the various clauses that give rise to the difficulty are in force. In other words, if we take the order-making power route, can we be certain that there will not be a period during which processing of data obtained from political canvassing will be illegal? It is a straight question that we ask the Minister. I think that I know what his preference is, but he understands that this is a serious problem. It would have been wrong of us not to draw the House's attention to the problem. It is all very well discussing a matter such as this in Committee, but, unless it is debated on the Floor of the House, colleagues might not be aware of how serious the problem is. I ask the Minister, in all fairness, whether he can give us a categorical assurance that the provisions relating to sensitive data, such as political opinions, membership of trade unions, religious beliefs and so on, to the processing of which people must give explicit consent—clearly, we cannot take an answer to the question "How are you going to vote?" as explicit consent—will not come into force until the Government introduce an order to tackle that serious problem.

George Howarth (Labour, Knowsley North and Sefton East)

The hon. Gentleman raises an important subject. It is not a partisan issue, but one of which all of us in the House have an understanding and in which all of us have a vested interest. We have to get the process right if we are to be able to conduct our politics properly in future. Article 8 of the directive requires member states to establish a special regime for the processing of what the directive defines as sensitive personal data, which includes information about an individual's political opinion. If the hon. Gentleman will forgive me, I shall not deal in any detail with the amendment, because he has referred to the approach that we undertook in Committee to adopt and it would be as well if I were to give him some idea of how we intend to proceed on that basis. The Government's preferred option, as the hon. Gentleman rightly acknowledged, is to deal with the matter through subordinate legislation. Paragraph 10 of schedule 3 permits the Secretary of State to make an order specifying further circumstances in which sensitive personal data may be processed. When the matter was debated in Committee, my hon. Friend the Parliamentary Secretary, Lord Chancellor's Department explained that the Government intended to make an order under that provision that would allow the processing of political opinions data collected for canvassing purposes. I repeat that undertaking today. As I said, the amendment is not a party political issue, but one which affects all Members of the House, and the Government expect to approach the matter on a cross-party basis when bringing forward the necessary order. In response to the hon. Gentleman's specific question, I cannot say when we shall be in a position to introduce the order; however, preliminary work has been started and we hope to make swift progress. I can assure him that the restrictions on the processing of sensitive data set by the Bill will not be brought into force until the order is ready. In view of that undertaking, I hope that the hon. Gentleman will feel comfortable in withdrawing his amendment.

John Greenway (Conservative, Ryedale)

We should have liked a date, but the Minister has given me the assurance that I sought. The whole House will be gratified to learn that we can go trundling up and down the streets, canvassing our constituents. I suppose that I should ask the Minister whether what he promises will happen before the European elections, but I wonder how much canvassing will be done, given that no one will have a clue whom they are voting for—but that is another story. We are grateful to the Minister and, in that spirit, I beg to ask leave to withdraw the amendment.

MISCELLANEOUS EXEMPTIONS

TRANSITIONAL RELIEF

EXEMPTION FROM SECTION 22

Harry Cohen (Labour, Leyton and Wanstead)

I beg to move amendment No. 7, in page 65, line 9, at end add—

CHANGE TO THE DEFINITION OF RELEVANT FILING SYSTEM AFTER 23RD OCTOBER 2007.

Geoff Hoon (Labour, Ashfield)

I am grateful to my hon. Friend for explaining the purpose of his amendment. I hope that I shall be able to reassure him about the specific examples that he has given. As hon. Members will be aware, the Data Protection Act 1984 does not apply to manual records; it is concerned only with the automated processing of personal data. However, the 1995 directive, to which the Bill gives effect, requires member states to apply their data protection laws to certain manual records. Article 2 of the directive attempts a definition of the manual records that it intends to cover. That definition is accompanied by a more detailed commentary in recitals 15 and 27. The definition of a "relevant filing system" in clause 1(1) is based on those provisions of the directive. The Government's purpose has been to cover all the manual records that the directive requires member states to cover, but to go no further than the directive requires. The purpose of the directive is to bring within the scope of data protection law the manual records that lend themselves to easy manipulation of the information contained in them, as computerised records do. The Government support that approach. The greatest risk of infringement of privacy comes from manual records held in such a way that specific information about particular individuals can be easily identified and extracted. I hope that my hon. Friend will accept that his example of a card index held, by the Economic League, would be covered by the Bill, because with each card there would be the possibility of identifying information about a particular individual. Such a system would be included under the Bill. To that extent, I hope that my hon. Friend will be satisfied that the Government have had regard to his concerns. Where manual records are not structured in such a way as to permit the easy manipulation of specific information, the risk of infringement of privacy is much less. The directive does not require data protection law to be applied to such records; nor does the Bill. My hon. Friend's amendment would extend the application of the Bill to such records; the Government do not believe that necessary or desirable. To do so would be to impose additional burdens on business and others who use manual records in circumstances in which there is little or no threat to privacy. It would put UK data controllers at a competitive disadvantage. I agree that the amendment would not come into force until 23 October 2007, but deferring implementation does not necessarily remove the difficulties of substance that I have identified. I must tell my hon. Friend that the Government cannot accept the amendment. I hope that, given my assurances, my hon. Friend will feel able to withdraw it.

Harry Cohen (Labour, Leyton and Wanstead)

I accept the Minister's assurances and beg to ask leave to withdraw the amendment.

ACCESSIBLE PUBLIC RECORDS

MODIFICATIONS OF ACT HAVING EFFECT BEFORE 24 OCTOBER 2007

TRANSITIONAL PROVISIONS AND SAVINGS

MINOR AND CONSEQUENTIAL AMENDMENTS

Frank Dobson (Labour, Holborn and St Pancras)

Hear, hear.

George Howarth (Labour, Knowsley North and Sefton East)

I beg to move, That the Bill be now read the Third time. I congratulate my right hon. Friend the Secretary of State for Health on the important role he has played in the passage of the Bill. His presence was not felt in Committee or on Second Reading, but between Report and Third Reading he made a significant contribution.

John Greenway (Conservative, Ryedale)

Yes, but does he understand the Gaskin amendment?

George Howarth (Labour, Knowsley North and Sefton East)

My right hon. Friend's stalwart work on the health service shows that he has the wisdom of Solomon—so I am sure that he does. The House knows that the principal purpose of the Bill is to give effect to the 1995 EC data protection directive, which has the worthy aim of improving the single market by establishing a common standard of protection of the highest order for individuals. But it is not always an easy instrument to make sense of; the subject matter with which it deals is technical and complex—those who sat through the Committee can only assent to that. The Government have always had in mind as a target date for implementation 24 October of this year—the date by which the directive requires member states to have implemented its provisions. If, as the Government hope, the Bill reaches the statute book before the summer recess, we shall have made good progress towards meeting that target. The passage of the Bill is not the end of the matter, however. The Bill provides for a large amount of subordinate legislation. Some of its powers have been put in place at a fairly late stage of the Bill's progress through Parliament; many of them will need to be in place before the new data protection regime will work. We have made a start on that work at the same time as the Bill has been progressing through Parliament so as to minimise the interval between Royal Assent and commencement. Some progress has been made, but we are not as far forward as we would have wished. With just over three months to go to the due implementation date, a great deal of work on subordinate legislation still needs to be done. The Government have a choice. We could rush forward in an attempt to meet the target date, which would mean no public consultation, even on important matters, and little or no opportunity for those affected to make the necessary changes to their systems.

Clive Soley (Labour, Ealing, Acton and Shepherd's Bush)

During the consultation period, will it be made clear to the public that they can complain about inaccurate material that appears in the press; that they have a right to see those files, subject to the conditions in the Bill; and that the press has a duty to correct inaccurate information that it holds on people in its files? It is important not only that the public know that, but that editors and owners know it.

George Howarth (Labour, Knowsley North and Sefton East)

I am grateful to my hon. Friend for those comments. I can confirm that we debated the matter at length and that we attach great importance to the arrangements that have been drawn up. I know that my hon. Friend has a long and distinguished history of raising such concerns. There is no guarantee that we would be able to meet the 24 October implementation deadline. The alternative approach, which the Government strongly prefer, is to proceed in a more considered way, carrying out public consultation, as appropriate, and allowing reasonable periods for those affected to prepare for the new regime. That means, of course, that the 24 October implementation date would no longer be a realistic target. Although that is regrettable, the Government believe that it is undesirable to rush through the next phase, at the risk of giving imperfect consideration to important matters, and possibly producing a defective regime. We may miss the target by a short period, but, in the Government's view, it is more important that the Bill should be properly implemented. From information available to us, it seems that a number of European partners are unlikely to meet the 24 October target, and some major countries are likely to be well behind us. I hope that there is as much understanding on that point as has been shown in all our debates on the substance of the Bill. On Second Reading the right hon. Member for North—West Cambridgeshire (Sir B. Mawhinney) agreed with my right hon. Friend the Secretary of State that the best way of taking forward the work of the Bill would be in a non-partisan manner. For the most part, that has been the central feature of the Bill. The Government welcome the positive and helpful spirit that representatives of all parties have contributed to our debates. I pay a particular compliment to the hon. Member for Ryedale (Mr. Greenway), who throughout has been constructive in his approach. That applies also to my hon. Friends. I am sure that the detailed consideration and attention given to the Bill and the amendments that have been made mean that it is in good shape as it returns to the other place. I commend the Bill to the House.

John Greenway (Conservative, Ryedale)

I am grateful to the Minister for his remarks. The Bill takes the issue of data protection considerably further than the Data Protection Act 1984. It is a complex Bill, but, as the hon. Gentleman said, we have dealt with it in a co-operative spirit, as the Second Reading debate promised. I thank my hon. Friends the Members for Esher and Walton (Mr. Taylor), for Poole (Mr. Syms) and for Cheadle (Mr. Day) for their help and support in the Standing Committee, and my right hon. Friend the Member for North—West Cambridgeshire (Sir B. Mawhinney), who was a great source of help and encouragement to me in preparing for the Committee stage. I shall now introduce a less co-operative note. It ought to be a matter of concern that, notwithstanding the complex nature of the legislation, both in Committee and on the Floor of the House tonight we have dealt with an extremely large number of amendments—well in excess of 200. This evening, we agreed no fewer than 74 amendments to the Bill, which has only 75 clauses. The Minister says that a delay in implementation is likely. The Bill will give rise to a huge amount of subordinate legislation, which will undoubtedly have an even greater impact on organisations and individuals than some of the structural legislation that it contains. Given the choice of rushing to meet the implementation date set out in the Bill or doing it properly, I would have taken the same decision as the hon. Gentleman. I think that it should be done properly because this measure will have far-reaching implications for every commercial and voluntary organisation in this country. That is why it was so important to conduct detailed scrutiny of the Bill. I believe that that will be necessary also when the subordinate legislation comes forward. Time will tell whether everything works as intended and complies with the directive in every respect. I have two more points. We have dealt with the first satisfactorily, but I still have concerns about the second. When the Bill came from the other place, two issues had caused the Lords concern. The first involved the then clause 28, now clause 29, and the exemption that we discussed earlier in relation to crime, taxation and Government Departments. The Government have dealt entirely adequately with the issue raised in another place when an important subsection was deleted, and we supported in Committee the inclusion of new clause 29(4). The second issue of concern involved the then clause 31, which is now clause 32. That clause is unamended, so it will be difficult to amend it in another place. Notwithstanding that fact, we place on the record our lingering concern that the scheme in that clause, which deals with the important issue of journalistic, literary and artistic purposes and seeks to balance press freedom with individuals' freedom—the House debated that issue at some length during consideration of the Human Rights Bill—will not do what the Government expect it to. Time will tell who is right. We had this debate in Standing Committee—I see the Minister nodding. When proceedings are stayed so that individuals may seek to obtain information, rectify inaccurate data or block processing and they come up against an organisation that claims exemption for journalistic, literary or artistic purposes, it is clear that proceedings will be stayed pending a determination by the commissioner and subsequently, on appeal, by the tribunal. However, the Bill does not say that publication will necessarily be allowed to continue. My impression is that that will happen in the majority of cases, and that is the spirit in which both sides have proceeded both in Committee and on the Floor of the House and during our earlier consideration of the Human Rights Bill. I believe—this is very much a personal view—that, given the scope of the exemption in clause 32, some people may seek to abuse the provisions of that clause by claiming that they are processing data because they wish to publish something that they believe to be in the public interest. That will be true in the majority of cases, but some people will seek to abuse that position. That will prompt lawyers to challenge whether the legislation says that publication must be allowed to go ahead pending determination of the concern. At that point, the Government will need to sit up and think whether they have dealt with the problem as adequately as they think they have. We could have improved that provision by amending it, but we failed to persuade the Minister of the case for so doing. I have a feeling that we shall return to the issue, perhaps in several years, and it is on the record that I am not satisfied. Apart from that, we have done a pretty good job of scrutinising the Bill, and I hope that those who take the trouble to read the report of our debates will find it helpful in understanding the Bill's provisions.

Harry Cohen (Labour, Leyton and Wanstead)

I have presented four data protection Bills to the House, and I congratulate the Government on presenting this Bill. However, I was not selected by the Whips to serve on the Standing Committee that considered the Bill because, obviously, there was great interest from other Labour Members. The Government have made a worthy attempt to improve data protection and to implement the European directive, although they have not been altogether successful in some aspects. Recital 10 of the directive requires that 'approximation' of the laws of the Member States 'must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community'. A lot of the Bill achieves that higher level of protection, but several aspects fail that test. The Government have been unduly influenced—and, I think, misinformed—about the possible costs of implementing data protection in relation to the directive. In her briefing note on the Bill, the Data Protection Registrar says, in respect of the —1,892 million estimated costs, that she cannot see why data controllers should have to incur increases in compliance costs of this kind". I think that a false figure has been put out. Time is short and I do not want to delay the House, so I shall run through a few items to signal where I think that there may be problems and a lessening in rights. I have already referred to the relevant filing system. On enforced subject access, the Bill provides less protection than the Police Act 1997 in respect of employers obtaining criminal conviction certificates, and they will be able to see spent and unspent convictions, bindings over and cautions against would-be employees under enforced subject access, until it is got rid of. On sensitive personal data, the Bill has worrying aspects. Genetic data should have been regarded as sensitive, and the confidentiality of medical records is a concern. Aspects of the Bill effectively allow for the increasing of data processing without the patient's consent, and some of those contradict what the General Medical Council recommends. I am concerned that protection for patients, especially that associated with their consent, is not going according to what the GMC advises. Ministers should give some thought to an explanation of why they have moved away from the GMC, at least in that respect. The second data protection principle is weakened by being linked to a notification procedure. That was not required under the directive, and I do not know why the Government weakened that area, but I am concerned most about the exemptions. The scope of a number of exemptions has been widened, or new exemptions have been introduced. No explanation has been given, and there should have been an explanation if the current law had created any problems. It did not seem to be creating problems, so I do not know why those new exemptions have been introduced. There are powers in the Bill for data controllers to delay the giving of information. That proposal will not be in the freedom of information Bill, but it will be in this Bill, and it will cost a lot of money. The Data Protection Registrar has expressed concern about clause 59, which has been described as a "gagging clause", preventing staff from discussing cases of interest with the press. I have outlined some of the aspects of the Bill which I fear will result in a reduction in the rights of data subjects. I suspect that, in future, the European Commission may require the United Kingdom to modify the legislation to deal with some of the problems that I have mentioned.