Data Protection Bill [H.L.]

§ Lord Elton

My Lords, I beg to move that the House do now again resolve itself into Committee on this Bill.

§ The Lord Chancellor (Lord Hailsham of Saint Marylebone)

This amendment seeks to limit the entitlement under Clause 21 of access to personal data so that it applies not to all data held about the subject 630 but only to such as are requested by the data subject. The unfortunate part about this suggestion (if my noble friend will forgive my saying so) is that many subjects will not know what data are held on them or, indeed, whether data are held on them. That is why the Bill is drafted in its present form. To accept his suggestion would be to wreck completely the protection given to the data subject and would disable us from ratifying the European Convention, for the European Convention speaks of individuals being entitled to gain confirmation of whether data about them are held and communication of such data in an intelligible form". This amendment, were it to be pressed, would destroy much of the protection given by the Bill.

§ Lord Swinfen

May I ask my noble and learned friend this question: What would be the position if a data subject were to ask the Government, as opposed to a particular department, what information was held? Would they have to supply the information held by every single department—the health service, criminal records, motor vehicle licensing, the lot?

§ The Lord Chancellor

The Government are not a corporation. I take it that the Bill applies to Government departments, and presumbly they are the data users for the purposes of the Bill.

§ Lord Mottistone

I understand very much the point that is made by my noble and learned friend. I am not going to press this amendment. It may be possible to so cast this amendment that if the data subject wants to ask for particular information only, then he should be allowed to convey his own limitation. I shall look at the matter from that point of view. In the meantime, I beg leave to withdraw the amendment.

§ The Lord Chancellor

I think I can best answer the noble Lord. Lord Mishcon, whose reasons for moving this amendment I can understand, by referring back to Clause 1 of the Bill, which reads as follows: 'Data' means information recorded in a form in which it can be processed by equipment operating automatically in response to instructions given for that purpose. 631 In other words, it consists of a number of holes punched in a card or a floppy disc, or perhaps a series of asterisks and matters of that kind, put in a technical form in which it can be processed automatically. That, to the ordinary subject, is probably totally unintelligible. What the subject wants to know is what is held about him in an intelligible form; and Clause 21 provides that on request in writing he is to be given the information constituting the data in a form in which he will understand it. My advice is that the removal of the reference to "information" could actually undermine the protection given to data subjects, because what he wants is not data in the technical sense, as I have quoted it from Clause 1, but knowledge of the information which has gone to make up the data.

Thus the Bill as drafted compels the data user to provide a copy in writing of the information and not a roll of magnetic tape, a floppy disc or whatever. I believe that this is a question of draftsmanship and that the draftsman on this occasion is right. But I make no apology to the noble Lord, Lord Mishcon, for taking the advice I have received. If there is anything wrong in what I have said I shall be told and shall hope to be able to correct it later. But in the circumstances in which I have spoken to the Committee this is not an amendment which I could ask the noble Lord to press.

§ Lord Wigoder

May I ask the noble and learned Lord to reflect in due course on whether he is satisfied that the present wording of this clause deals adequately with the situation in which information requested by one data subject is found to contain, as an integral part of its existence, information about other data subjects? For example, in the case of a husband and wife, what would the position there be, when a data subject applied for data about him? Would he also be entitled in the circumstances to obtain data about other data subjects who may not have given their permission for the release of that information?

§ The Lord Chancellor

I can see very well that such a situation can arise, and I will make inquiries as to what the answer is. It seems clear that under the terms of the Bill as drafted he is not, as such, entitled to that information, but, speaking off the cuff and without prior notice, I can conceive that circumstances could arise in which the mere fact that he was given the information about himself might make it difficult not to disclose other information to which he was not otherwise entitled. Therefore, if I may, I will take that point up, though I shall not have time to seek the answer this afternoon. I am told by my ever ready noble friend Lord Elton that some clue to the answer to this question of the noble Lord. Lord Wigoder, is that the point is dealt with in Clause 21(4)(b). I quote: A data user shall not be obliged to comply with a request under this section—… (b) if he cannot comply with the request without disclosing information relating to another individual who can be identified from that information, unless he is satisfied that the other individual has consented to the disclosure of the information to the person making the request. It is a perfectly valid point and I will make inquiries as to whether what I have given is an adequate answer. Perhaps the noble Lord will take it that it is, unless I tell him to the contrary.

§ Lord Swinfen

In my noble and learned friend's original answer he referred to punched holes as being a method of providing information held on the data subject. Is the scope of the Bill then greater than just dealing with computers; or are we talking about all mechanical forms of storing and retrieving information?

§ The Lord Chancellor

I think that for once I have the answer offhand, which is contained in Clause 1(2) of the Bill. It says: 'Data' means information recorded in a form in which it can be processed by equipment operating automatically in response to instructions given for that purpose. I think that is the definition. My noble friend is so much more of an expert than I am in the actual technology involved that he will probably be able to answer his own question from that material. At any rate, that is the best I can do.

§ Lord Mishcon

I wish that everyone could be as pleasing and as witty as the noble and learned Lord when dealing with questions. It makes it almost a pleasure to withdraw an amendment! But perhaps I may just say this to the noble and learned Lord: it could be that I am on a bad point; on the other hand, it could be the odd occasion on which I am on a good one. In the circumstances, I would ask him to be kind enough to consider at least the point that I am now about to make but about which I have no intention of making heavy weather. He answered me by saying that there was a definition clause in Clause 1. Indeed there is, but there is no definition there of "information". The definitions in Clause 1 are of "data" and "personal data"; and, with respect, it would not make it any more obvious that one is entitled, or only entitled, to the odd punched holes by merely saying that he is entitled to a copy of the information. The information could still be the punched holes. What we all want, of course, is what the noble and learned Lord was referring to; that is, an intelligible translation of the punched holes.

What I am trying to secure—and, with great respect to the noble and learned Lord, I do not think he has completely answered the point—is that a data user is not limited under this subsection merely to supplying his idea of the information contained in the entry relating to the data subject. What he is supposed to do is to translate the entry and let the person concerned, the data subject, have a copy of that literal translation without its being a paraphrase, a précis or whatever.

As I say, that is either a bad point or a good point. It cannot be made either at the present stage of the discussion before the Committee because obviously advice has to be sought. If it is a bad point I will drop it; but if it happens to be a good point I know that the noble and learned Lord, with his usual courtesy, will take note of it.

§ The Lord Chancellor

Of course I will take note of what the noble Lord has said. My first and instantaneous reaction to the question now raised is that what is proposed to be left out in the suggested amendment is the word "constituting", and I think that word does effect the position which the noble Lord, Lord Mishcon, desires to see effected—that is to say, a 633 paraphrase or summary will not do; it has to be the information which constitutes the data. But again, if I turn out to be wrong I know that others will put me right and I will instantaneously, or forthwith, or as soon as practicable inform the noble Lord.

§ Lord Mishcon

In the light of what has been said, I beg leave to withdraw the amendment.

§ Lord Swinfen

May I support the noble Viscount on this amendment? Also may I remind our Front Bench of the reply given to me by my noble friend Lord Elton to a question on the first day of the Committee stage—I forget to which amendment—when he confirmed that it would be necessary for the information to be in good plain English or Welsh.

§ The Lord Chancellor

I do not know that at the moment there is anything in the Bill about Welsh. But as regards the amendment, I had divined the fact that the noble Viscount had drawn his amendment from the wording of the Consumer Credit Act 1974 which uses the term "plain English". It is a conception which I heartily support, but which I would be in some difficulty in defining. That Act requires credit reference agencies, as the noble Viscount tells us, to provide "a copy of the file". The "copy of the file" is the actual thing which, by the terms of the Act, is required to be provided. In that context, it clearly was necessary to require the copy of the file to be translated into English of an intelligible kind, because of the way in which it might have been recorded.

But a moment ago we were talking about the danger of allowing a data user to paraphrase or to bowdlerise, in some form, the information which the data actually contains. This is what the noble Viscount is, in substance, asking me to do. It is, in fact, the other side of the coin to the amendment which was proposed a moment ago by the noble Lord, Lord Mishcon. What has destroyed the analogy of the Consumer Credit Act 1974, if the noble Viscount will forgive me for saying so, is the wording of Clause 21(1)(b), because under this clause, as at present drafted, what the data subject is entitled to be supplied with is, a copy in writing of the information constituting any such personal data held by him". In other words, it must be a copy in writing, it must be reduced to writing and it must contain the information and nothing else.

I am bound to say that the advice I have received, which for the moment, at any rate, convinces me, is that to compel the data user to provide the information by means of a copy in writing is exactly what is wanted. If I did less than that, I should not be satisfying the noble Lord, Lord Mishcon. If I did what the noble Viscount has suggested, I should be falling into the trap which was posed to me on the last amendment. I think, therefore, that, as at present advised, the Bill as drafted is better than the amendment as proposed.

§ Viscount Craigavon

I appreciate what the noble and learned Lord has said. But the way in which he tries to 635 reassure me does not exclude someone from producing the most horrendous jargon and technical expressions which an ordinary data subject would need a computer expert to interpret to him. That is part of what I am trying to avoid. Also, may I point out that my amendment includes the word "together", so that the data subject is receiving all the information which he would receive under the Bill as it now stands. In other words, I am not offending the noble and learned Lord in any way, but, in addition to that, I want to add some helpful information.

Finally, on the previous amendment the noble and learned Lord spoke about the word "intelligible", assuming that the information coming out in this way would be intelligible. I think that he quoted the European Convention which—I stand to be corrected—might also mention the word "intelligible". But there is nothing in the Bill that requires the information under this paragraph to be intelligible to a layman. I am grateful for the noble and learned Lord's answer. If I may, I will withdraw the amendment and consider it again later. I beg leave to withdraw the amendment.

§ Lord Wigoder

Without these amendments is there not a probability that the maximum might be charged as a matter of routine on every single occasion without any limitation on it?

§ The Lord Chancellor

There may be something rather ironic about a member of the present Administration resisting an amendment which would allow the higgling of the market place to determine the price of the service provided. None the less, that is the position in which I find myself. The purposes of the Bill are to protect the data subject and to enable us to ratify the convention. The convention provides that access should be available without excessive expense to the data subject. The words "without excessive expense" are written into the convention. It follows from that that we must be able to control the maximum which may be charged and we cannot permit the data user to set his own fees and leave it to the courts to decide ex post facto what is a reasonable amount having regard to the amount of trouble to which he has been put. In fact, I understand that it is not the practice elsewhere in Europe to allow users to set their own fees in the way suggested in the amendment. If I were to accept this amendment, it would jeopardise our ability to ratify.

I quite understand that there might be a tendency to charge the maximum, but the maximum will be arrived at with a view to ensuring that excessive cost will not be allowed and certainly it will be in line with what other signatories to the Convention are in fact doing.

I do not know that I can give any better answer at the moment, but it is quite clear that, if we are to ratify the convention and to protect the data subject, we cannot allow the data user to charge his own fees. We must set a maximum. That is the answer which I must give to my noble friend.

§ Lord Swinfen

Surely this amendment does not prevent the prescribing of a maximum fee. That, I should have thought, was outside the description of "reasonable". "Reasonable" can be a fee which is lower than the maximum fee, it does not have to be higher. That would be nonsense.

§ The Lord Chancellor

I think my noble friend has misread the amendment. There are two amendments, the second one omits the words "not exceeding the prescribed maximum".

§ Lord Mottistone

I must apologise to my noble and learned friend for not having mentioned that I was talking to Amendment No. 112A and Amendment No. 112B.

I take the point of my noble and learned friend. Of course data principle No. 7(a) talks about a limitation of expense. However, I think there is room here for somehow meeting the points that have been made by my noble and learned friend and the underlying point of this amendment and the one I had before. I shall read with interest what has been said and perhaps come back on Report. In the mean time, I beg leave to withdraw the amendment.

§ Lord Digby

The implications of this amendment are that, if a data subject applies to, say, one local authority for information about himself and that local authority holds many different files, such as social service files, education and many other files, he would be allowed on one payment to get all the data available in all departments. Even if this information is on one computer, the administrative burden caused by this would be great because very often the information will be on different files. The fact that the data are on the same computer does not mean that there will not be considerable administrative expense in providing the data. If there is one single fee, I feel that local authority resources will be used up to quite a large extent and the revenue intended to finance meeting the requirements of the Bill will be lost.

§ The Lord Chancellor

Again I have to walk a tightrope between the legitimate requirements of the data user and the necessary protection of the data subject. The first point I would make is that on the whole we hope that we shall not be compelling local authorities, as my noble friend Lord Digby suggests, or big organisations like BP or ICI, necessarily to concentrate all their various computer-contained data in one central organisation. That would impose upon them the kind of expense which my noble friend Lord Mottistone was seeking to avoid in his last amendment.

Let me take, for instance, a personnel roll. The noble Lord, Lord Mishcon, gave this as an example, and I thought that it was a happy choice. Let us suppose that an employee is also a customer and that the customer is held on a different roll from the personnel file. If there is a simple request for access to all the data held about the individual, even assuming that it would be easy to identify the individual as the same person from the different particulars which would be contained in the two separate files, it would be necessary to have a single, central organisation containing all the possible rolls upon which any file of a personal character could be held, for whatever purpose.

638 I believe that, as drafted, the Bill provides reasonable and adequate protection for the data subject. If one looks first at Clause 6(4), we encourage—and I think properly encourage—the keeping of separate purposes on separate files. It is there provided that: Where the alteration would consist of the addition of a purpose for which personal data are to be held, the person"— that is, the applicant for registration as a data user— may, instead of making an application under subsection (3) above, make a fresh application for registration in respect of the additional purpose". If one turns to Clause 7(2)(a), one sees there the protection which is given to the data subject. The registrar is there clearly encouraged to refuse applications for registration or for the alteration of registered particulars unless, he considers that the particulars proposed for registration or, as the case may be, the particulars that would result from the alteration", will give sufficient information as to the matters to which they relate.

Although I fully understand the point which the noble Lord, Lord Mishcon, and his noble friends have put forward, our view is that this provides a correct balance between the legitimate needs of the data user—not to have to keep an all-embracing central file like that which the Department of Health and Social Security keeps on all of us at Newcastle but to be entitled to keep separate ones—and those of the data subject, who is protected by the joint provisions of Clause 6(4) and Clause 7(2)(a) against the kind of misuse which gave the noble Lord, Lord Mishcon, cause for apprehension. Therefore we believe we have struck the right balance. I hope the noble Lord, Lord Mishcon, will accept this somewhat confused explanation.

§ Lord Mishcon

Obviously there are arguments both ways. I should like to read what the noble and learned Lord has said, digest it and see which way the balance appears to me to go; then I shall act accordingly. I am most grateful to the noble and learned Lord for what he has said. I beg leave to withdraw the amendment.

§ The Lord Chancellor

I now tilt my balancing pole on the opposite side and the tightrope, I hope, remains beneath my feet—if somewhat precariously. The 639 noble Lord would curtail the right of access if a request is exercised in a manner which by reason of its frequency or nature is frivolous, abusive, vexatious or malicious. These are lovely words. I am not sure that in practice they would be easy to construe. A request which is abusive may nonetheless be a perfectly intelligible request, and what we require is a request in writing. That gives to the data user the absolute right to access to his personal data. I hope that the shade of APH is not listening to me and that no noble Lord will ask me whether, if the request in writing were to be written on the back of a cow it would be effective for the purpose. My noble friend will remember that somebody in Misleading Cases wrote a cheque on the back of a cow. The question was whether it could be endorsed and whether the holder in due course could recover on the cow.

These points can cause difficulty, but the straightforward view of the Government is that the convention requires that, provided the data subject makes an intelligible request in writing, he is entitled to access to the information contained in his personal data. The fact that he may be ill-disposed towards the data user is not necessarily relevant. That he may be frivolous, by which I can only assume is meant that he may not have any real need for access, is disposed of by the fact that he has to pay for it, up to a maximum. That it may be abusive is irrelevant. And I am not quite sure that it is necessarily relevant that the data user may be vexed.

In its present form the Bill seems to me to be clear and to protect both parties by demanding that the request should be in writing and that it should then give absolute access to the data. But in order even better to protect the data user, we have provided by Clause 21(8) that when it is applied the remedy of the data subject is in the discretion of the court. If, therefore, the court considers that the remedy should not be granted, the court could so order. It is provided expressly in Clause 21(8) that, a court shall not make an order under this subsection if it considers that it would in all the circumstances be unreasonable to do so. I hope that with this explanation my noble friend will agree we have done our best to protect both sides.

§ Lord Elwyn-Jones

I confess that I sympathise with the motivation of this amendment, but the problem of definition is very difficult. One man's frivolity is another man's levity. I remember Dean Sydney Smith's famous observation that his successful brother, Bobus, had descended by gravity; he had descended by levity! The term "vexatious" is well known in the courts, as the noble and learned Lord the Lord Chancellor knows. As Attorney-General, it fell to me more than once to have a litigant declared vexatious to the great benefit of the hapless defendant, who would otherwise have been at his mercy. It may well be that we should give power to the registrar to give a ruling if one was sought by the user, who might be constantly plagued by a vexatious demander. Perhaps the noble and learned Lord will be willing to look at this. The data user does not have a court that he can run to, and it may be a useful thought to give the registrar power to give advice in a situation such as this. I only put this forward for what it may be worth.

§ Lord Wigoder

I believe that the noble and learned Lord the Lord Chancellor has inadvertently misled your Lordships by omitting to remind your Lordships that the gentleman who wrote the cheque on the back of a cow did make the whole matter entirely legitimate by also affixing a 2d stamp to one of its ears. May I venture to suggest that the amendment of the noble Lord, Lord Mottistone, has much to be said for it in principle. One can criticise the adjectives which have been chosen, in the way that the noble and learned Lord has criticised them; this I can understand. But will the noble and learned Lord not consider looking at the principle, to see whether suitable language could be devised in order to discourage applications which are, quite obviously on the face of them, totally unmeritorious?

§ Lord Campbell of Alloway

Does my noble and learned friend not agree that there is within this amendment at least one intrinsic point of value; that is, "frequency" and "vexatious"? This is quite apart from the other aspects with which my noble and learned friend has dealt, which were covered by the observations made. There still rests the residual point of "frequency" and "vexatious" which could perhaps warrant treatment along the lines suggested by the noble and learned Lord, Lord Elwyn-Jones.

§ The Lord Chancellor

The answer to that is, once one has given access and a copy of the information in writing, one has given access and therefore discharged one's duty. So I do not consider that that last point is a residual point of substance, although I will try to see whether between now and Report stage there is more to this than at first meets the eye. I will of course consider seriously that which has been put to me by the noble and learned Lord, Lord Elwyn-Jones, about the functions of the registrar. However, the general philosophy of the Bill—which I tried to outline at our last meeting—is that the registrar is the user's friend, and is the "policeman" there to enforce the obligations, but the court is the authority under Part III—which is the part we are now discussing—which gives the remedy to the data subject.

I myself think that the discretion given by Clause 21(8) is probably the right answer to this question. But in the light of this discussion I shall ask any advisers who may be available to look at this aspect of the subject to see whether something more can be done. I must point out to the noble Lord, Lord Wigoder, that the omission of the 2d stamp—although he is perfectly right in referring to it in Misleading Cases—is now obsolete or archaic because some benevolent Government (whether it was Labour or Conservative I cannot remember) abolished the need for stamps on cheques.

§ Lord Elwyn-Jones

I believe that the noble and learned Lord the Lord Chancellor inadvertently said that the registrar was the data user's friend. Unless that should remain on the record, I am sure that the noble and learned Lord meant that the registrar was the data subject's friend.

§ The Lord Chancellor

I am much obliged to the noble and learned Lord, Lord Elwyn-Jones.

§ Baroness Wootton of Abinger

Will the term "frequency" relate only to repeated applications for data referring to the same person; or might it not be that, having obtained data referring to one data subject, the inquirer might have his interest stimulated in certain others? This might go on for quite a long time, quite legitimately; he might find that six or seven people were involved in whatever it was that interested him, and that as he proceeded from one copy of the data to another, he would be quite justified in pursuing his case.

§ The Lord Chancellor

I think that, like St. John at the end of St. John's Gospel, what happens to Peter is nobody else's business except Peter's.

§ Baroness Wootton of Abinger

I would suggest, with respect, that that does not answer my question.

§ The Lord Chancellor

I think it does, if the noble Baroness will study her Holy Scripture, which I know entrances her at every moment, because the fact is that the data subject is only entitled to his own data.

§ Lord Mottistone

I thank my noble and learned friend and also other noble Lords, particularly the noble and learned Lord, Lord Elwyn-Jones, for their contributions. I would particularly ask that my noble and learned friend examines this point in the way suggested by my noble friend Lord Campbell of Alloway, because I too would make the point that out of all these words in my amendment "frequency" is the most important. I can think of some people with whom I have had to deal in a personnel role who have been very troublesome in just that sort of way. It is remarkable how ingenious people can be if they are frightfully clever but not very competent. This is a point which needs to be watched.

As to the cost, which is of course a restraint, this is really in the lap of the gods at the moment because my noble and learned friend did not accept my amendment that this should be the costs actually incurred, because there has to be a limitation—which I accepted under Principle 7(a). It could be that the costs are not enough to discourage the sort of person who might need to be discouraged. With that in mind, if my noble and learned friend will look at this matter, as he said he would, I shall be most grateful. I might also do so with the CBI, who proposed this amendment, and perhaps come back at another stage. In the meantime, I beg leave to withdraw the amendment.

§ The Lord Chancellor

In this case I can give my noble friend Lord Mottistone at least modified rapture. If he will withdraw his amendment, I will consider this matter again. I believe that a period of 28 days is probably too short but that 60 days is probably too long. I think that we may be able to do business on those lines.

§ Lord Renton

I hope that when my noble and learned friend the Lord Chancellor considers this matter further he will bear in mind that it would be wrong to keep the data user waiting longer than is reasonable. When one is trying to fix a period of this kind, it is partly a matter of guesswork—and one could call it judgment. My judgment is that 28 days is a reasonable period in which to assemble information and that the data user should not be kept waiting any longer.

§ The Lord Chancellor

I believe that my noble friend meant that the data subject should not be kept waiting any longer.

§ Lord Renton

I am most apologetic. Of course, I meant data subject.

§ Lord Swinfen

Where there is a monthly run system or something of that sort where a period of 28 days is possibly too short and a longer period is necessary, would it be possible to ensure that the data user has to inform the data subject that he will have the information by a particular date?

§ Lord Mottistone

That remark of my noble friend Lord Swinfen seems to me very reasonable. Perhaps my noble and learned friend, in the most accommodating way in which he has agreed to strike a balance, would take that suggestion into account. I would suggest to my noble friend Lord Renton that perhaps he did not understand fully the technicalities involved in this. Though 28 days might be all right for dealing with a quill pen, in the world of computers and data, systems get seriously upset if they are not run in an orderly fashion, and 28 days can create great difficulties and indeed much expense. I am delighted with what my noble and learned friend has said. I beg leave to withdraw the amendment.

§ The Lord Chancellor

I have two speeches to make in reply to this amendment, one short and one long. The short one is, "I accept this amendment" and the long one is, "I accept this amendment with thanks to my noble friend for moving it". I have now made both.

§ The Deputy Chairman of Committees (Lord Jacques)

I should point out that if Amendment No. 117 were agreed to, I would not be able to call Amendment No. 118.

§ The Lord Chancellor

As I am going to accept Amendment No. 118 I hope that the noble and learned Lord in his courtesy will not press this amendment, because otherwise I shall not be able to accept No. 118, which goes with No. 116. This is touching on a problem which we discussed a moment or two ago. The amendment applies to Clause 21, which gives the right of access. We were rather puzzled to know at first what the purpose of it was. In the interests of efficiency almost all data users plan very carefully the way in which their workload—that is the data to be processed—is matched to their human processing resources. One of the effects of this is that particular activities tend to be scheduled in daily, weekly, or monthly processing cycles, as my noble friend was telling us a moment ago.

For example, most organisations process payroll data in the middle of each month in order to enable pay to be distributed to staff at the end of each month. In these circumstances most users would be unable to respond to spontaneous requests for subject access. To do so would interrupt their scheduled procedures and so lead to operational difficulties. The preferred approach would normally be to schedule the process of subject access, perhaps by accumulating requests until some predetermined convenient point in the operational cycle when they can all be dealt with at the same time. The need to avoid interrupting the scheduled operations of data users has been addressed in the Bill by allowing a certain number of days—in the Bill as drafted, 28—in which to respond to a request for access.

However, it is recognised that this will create a situation in which data users will need to continue processing personal data during the period between receiving a request for access and responding to it, and that this could, on occasion, result in the data being amended before they are supplied to the subject. The qualification at the end of subsection (7) has therefore been introduced to prevent users from taking the 644 opportunity in those circumstances to frustrate subject access by laundering the data, or as my brief says, sanitising them, before they are supplied. The qualification effectually restricts the amendments which the data user can make to those which he would make in the normal course of events. I hope that that covers the subject matter. The noble and learned Lord has noted that this is intended to explain what the qualification in subsection (7) is for, and this shows the purpose of the words proposed to be left out in the amendment.

§ Lord Elwyn-Jones

This is obviously a complex matter, as indeed is so much in this Bill. I would like to consider the complexity, try to understand it, and if necessary return to the matter again. In the meantime, I beg leave to withdraw the amendment.

§ The Lord Chancellor

My noble friend is like a barrister with numerous clients of somewhat incongruous and incompatible kinds. He reminds me rather of a cuckoo chick fed with a bundle of incompatible worms by two or three rival sets of meadow pippets. The Consumer Credit Act is not, I would respectfully say to him, a guide to the Data Protection Bill of this year; the analogies are not always good ones, as we have already had reason to see this afternoon and as I think we adverted to last time.

I had thought that my noble friend would move his amendment with his earlier group establishing a procedure for the correction of wrong information and that this amendment would have been seen as consequential upon that. It is, of course, in theory free standing, but it is now orphaned and as orphan I do not believe it will stand.

The obligation which it seeks to impose would apply only once access to data had been granted by a data user, so that it can hardly be about that particular aspect of the rights which Part III provides that the information would be given. The obligation on data 645 users would amount, therefore, simply to informing data subjects of their entitlement to seek compensation under Clauses 22 and 23 and about the power of the courts to order correction or erasure under Clause 24.

I suggest that a data subject who has got as far as exercising his right of access under Clause 21 will scarcely need this additional information. I am bound to say that the person from whom I would seek it, if I had any special desire to know my rights, would not be the data user from whom the Bill is designed to protect me. This would probably give more trouble and provide more opportunities for argument than it would give information.

Informing the data subject of his Part III rights could have the effect—and this would be an additional disadvantage—of distracting him from the alternative assistance available through the officer of the registrar, whose powers might in certain circumstances be just as relevant to the data subject in question as the remedies for which Part III provides and to which the data subject would be confined under my noble friend's proposed amendment. I do not see why one should turn data users into a general information point regarding the provisions of the legislation and I am not sure that I would not say, in regard to them, timeo Danaos et dona ferentes.

§ Lord Mottistone

I take all the points made by my noble and learned friend, including the fact that I have perhaps taken on rather more than I should. But, apart from that particular point, there is a side to this which my noble and learned friend has not touched upon. It is quite common in personnel departments to provide general information of the sort that I have been describing to all who are employed and it would seem reasonable when this Bill becomes an Act that the sort of information which is within Part III of the Bill should be the sort of information which would be automatically provided to new employees when they start work. But that, of course, might happen anyhow in a good company without the need of the law to give them a nudge to do so. I take the points made by my noble and learned friend and I beg leave to withdraw the amendment.

§ The Lord Chancellor

I do not think that the amendment is defective in the particular way which the noble Lord, Lord Wigoder, suggests because, in fact, the registrar already has power to do what this amendment would require him to do. If it had not been for Amendment No. 75, which was a Government amendment proposed by my noble friend Lord Elton, there would have been some purpose in this amendment. Now that we have given the Committee Amendment No. 75, which was, I think, passed at our last Committee sitting, the only effect of this amendment would be to deprive the data subject of the right to go to the courts at all and compel him to go to the registrar, who already has, without the amendment, the power to do what the amendment proposes. It therefore restricts the rights of the data subject and does not add to them. For those reasons, I hope that the noble Lord, Lord Wigoder, will accept our view that the amendment does not add to the powers of the registrar nor give the data subject facilities which he would not otherwise have.

§ Lord Wigoder

I see that point and I am grateful to the noble and learned Lord for making it so clear. I confess that I had not considered the effect of Amendment No. 75 in relation to my amendment. It might still be that there is no purpose to be gained by this subsection in giving the data subject the right of access to the courts if, in fact, the registrar is competent to deal with the whole matter himself, and it may be that that is a wholly unnecessary luxury that is being afforded to the data subject in these circumstances. I should like to reflect on that, and for the moment beg leave to withdraw the amendment.

§ Lord Elton

I wonder whether I may take a second of your Lordships' time to put right a misconception which may have risen from an exchange earlier in our proceedings? At an earlier stage last week the noble Viscount, Lord Bledisloe, made the point that legal entitlement to the receipt of information—subject access to information—only arose once the person in question had established that such data existed. Therefore, there was no means of discovering, by asking for information from a computer, whether or not one was a data subject because there would be no right to get the information if one was not a data subject. I merely wanted to put on record at this stage that, of course, the legal entitlement actually subsists 647 in Clause 21(1) and that that relates to an individual, not to the data subject. Therefore, the difficulty which the noble Viscount pointed out does not exist, and it would be a pity to pursue it on Report, as I think he intended to do.

§ Lord Wigoder

I should like to support this amendment moved by the noble Viscount, Lord Craigavon. When we discussed Clauses 10, 11, and 12 a little earlier, I endeavored to find out what, if any, was the meaning of the word "distress" when added to the word "damage". I received a somewhat ambiguous answer, but it was quite clear from the answer that the word "distress" does add something to the word "damage" and is not to be taken as being included in the word "damage", hence the use of the words "damage or distress' in Clauses 10, 11 and 12. It appears only consistent now in Clauses 22, 23 and 24, when one is considering the harm that may come to a data subject in various ways, that the same phrase should be used and the words "or distress" should be included.

§ The Lord Chancellor

The question of whether and when you turn subjective feelings of unhappiness into money is one which has puzzled lawyers for centuries. Indeed, those of us who had the privilege of practising at the common law Bar for donkeys years, know that we have often underlined or sought to minimise, according to which side we were on, the amount of distress and what its value in hard cash is likely to be. I myself have always viewed the right to compensation in money for distress on rather conservative lines, and I have also always associated it with conduct which is blameworthy. I want to emphasise that in what I am going to say.

This is a clause which gives a right to compensation for damage arising out of an act which is virtually—subject to a qualification which we shall be coming to shortly—an absolute liability. In other words, it is not based—subject as I say, to one qualification—on either intentional wrongdoing or negligent wrongdoing. It is an absolute liability which is being imposed upon a data user. I do not feel that this is a fair burden to place upon the data user.

I draw attention to the fact that on Second Reading I pointed out that these remedies given by Clauses 21, 22, 23 and, I think, 24 are additional to, and not in place of, the ordinary common law remedies for defamation, or the statutory remedy for racial or sexual discrimination which would give rise to a claim for damages against the wrongdoer—whether it was a data user or a third party—for these subjective feelings of distress. I do not feel that where there is strict liability one is entitled to more than the damage that has actually been lost. There is nothing I think in the eight principles to compel us to include that type of consideration in our definition of compensation for the purposes of this particular clause, Clause 22.

It would of course add very significantly to what used to be known, and probably still is in some reaches of the Bar, as speculative litigation. Once you can start proceedings where there is no financial loss at all but one can simply say, "I was very distressed to learn that somewhere on the data file" or, "in the information contained in the data there was something which caused me distress" it seems to me that with the use of legal aid there is an almost infinite field for speculative litigation in the broader sense of the word "speculative". I myself would not favour that. I would favour, of course—but the Bill, the common law, or statute law already provides for it—compensation from the wrongdoer in cases of moral fault.

649 I think that this is going too far and for that reason I would invite the Committee not to go along with the noble Viscount or with the noble Lord, Lord Wigoder. I can remember a lot of litigation when I was much younger and before the days of legal aid, which I felt was not always reputable but in which I played a part on one side or the other, sometimes with success.

§ Lord Perry of Walton

Proving damage from the unauthorised disclosure of medical records would be extraordinarily difficult and stressful for the majority of patients and would effectively discredit the concept of data protection in this way. Would the noble and learned Lord consider the possibility of having a penalty imposed for unauthorised disclosure alone without recourse to asking for damages? That would not prevent an action for damages being taken in addition.

§ Lord Mishcon

I wonder whether the noble and learned Lord would bear with me for a moment if I put this to him because I think it may be of interest to other members of the Committee. Of course, if the inaccurate information constituted a defamatory statement, then the normal rules of libel would apply. There are a number of occasions, one would have thought, where inaccurate information is not defamatory and where it would be very difficult to prove actual damage but where the distress may be very great indeed.

Let me give just two examples, which may not be the best examples to take but they are the first two that occur to me. If it is on the record that the husband of a certain lady died of senile dementia, and it be in fact completely inaccurate that her husband died of that disease because he was in possession of his senses and faculties to the very day he left this world, it is a very harmful thing to be on the record. It would not be defamatory; she would not have been caused damage as such; she would have been caused distress.

Before I leave the examples, perhaps I could choose not so morbid a topic but a happy one for some people. Suppose it is on the record that, for example, the noble Lord, Lord Mottistone, had won the football pools and, as a result, has become a millionaire. That may be completely inaccurate.

§ The Lord Chancellor

It would not cause him much distress.

§ Lord Mishcon

If the noble and learned Lord would allow me—and I think that the noble Lord, Lord Mottistone, would agree with me—it would cause him the utmost distress, because he would be approached by all the charities that exist in the United Kingdom and by many individuals who would ask him to invest in their businesses, and so on. Knowing the noble Lord, Lord Mottistone, as we do, such approaches would cause him the utmost distress.

As I have said, the examples that I have chosen may not be happy ones, but there is no doubt at all that there is an area where defamation is not there, where inaccuracy is not there, and where damage is not caused, but where infinite distress is caused.

§ The Lord Chancellor

I respond to all noble Lords who have taken part in this short debate. It is, of course, true that there is a kind of falsehood which can cause either damage or distress, but which is not defamatory. But at common law at any rate that is actionable only when it is malicious, and I had that very much in mind when I made my initial response to the amendment.

To be quite honest—and curiously, we had this argument in the last Session on, I think, the Administration of Justice Bill—having suffered a certain amount of distress in the course of a misspent life, I have never felt very much satisfaction in trying to turn it into money. I think that probably the common law has gone too far in turning human feelings—sometimes of a most sacred kind—into money. I think it leads to all sorts of impossible equations to work out, and in my own mind I am quite sure that I would give that right only where there had been some moral turpitude on the part of the person who had caused the distress. The cases of libel and slander are instances in which I feel quite confident that it is rightly given.

But there are other cases where it is done. I do not think that this is an appropriate field for damages for subjective pain for discovering that one's own personal data contain, in fact, an inaccuracy which has not caused damage but which nonetheless upsets one a good deal. There are many cases where it causes damage even though it is not defamatory, and it is with that sort of case that this clause is designed to deal. But it is very much a question of the way in which one approaches these matters. I do not think that one can argue about it very much. I have stated my position; I stick to it. I respect that of' others who do not agree with me.

§ Viscount Craigavon

I am grateful to the noble and learned Lord for his remarks. While I should perhaps defer to the noble Lord, Lord Wigoder, in this very legal field, possibly the noble and learned Lord can reassure us that there is no contradiction in the Bill when it refers to damage and distress at one point and simply to damage at another point, because I gave the example of the evidence at a tribunal where solely distress had been caused, and there was no way in which this could be compensated for in the courts. Would the noble and learned Lord like to answer that?

§ The Lord Chancellor

I must apologise to the noble Lord, Lord Perry, on the Back-Benches because I answered neither the point which he made nor the point which the noble Viscount made. To deal with the medical point first, the ultimate remedy for that must be deregistration and enforcement notice, and not compensation unless it causes damage. But I entirely agree with the sentiment that the noble Lord expressed.

As regards the more subtle point which I forgot to answer which the noble Viscount made in moving the amendment—and I apologise to him—as I understand it (maybe wrongly, but I think rightly) he suggested that there was an inconsistency between Part II and Part III of the Bill in that causes of action in Part III are limited to damage in the strict sense whereas the registrar, in considering whether to exercise his notice powers under Part III, is required to reflect upon the 651 probability or actuality of damage or distress. However, I would respectfully submit that there is no inconsistency here. The registrar's powers are discretionary and the requirement upon him, for example in Clause 10(2), is simply to consider the possibility of damage or distress for the purposes of that clause, which has nothing to do with compensation but which is in relation to his regulatory powers by means of an enforcement notice, which of course also bears very strongly on the point made by the noble Lord, Lord Perry.

There is no obligation upon the registrar in such circumstances to take action or not to take action merely because the distress element is present or not. He will be able to consider whether the distress, which may have been caused to an individual, was of a kind which might have affected any reasonable person in the circumstances, or whether the distress was more personally related to the circumstances of the individual concerned. He will be able, moreover, to consider how much distress has been caused or is likely to be caused. In other words, he would be able to take a broad view of the likely effect on individuals of the data use in question.

I do not myself see that, in protecting the individual, there is any inconsistency in giving the registrar power to issue an enforcement notice or the ultimate sanction of deregistration in cases where distress has been caused, but not giving monetary compensation under Clause 22, which is the compensation for inaccuracy. I would therefore suggest, with an apology (which I repeat to the noble Viscount) for not having dealt with his perfectly reasonable point in my first reply by sheer inadvertence, that my argument stands.

§ Viscount Craigavon

I am grateful for that full reply. Perhaps between now and the Report stage we should all look at Hansard to decide what to do. Unless the noble Lord, Lord Wigoder, wants to add anything, I beg leave to withdraw the amendment.

§ The Lord Chancellor

I very much agree with the noble Lord, Lord Mishcon, except on one important particular. I agree that if the word had simply been "inaccurate" or "incorrect" in subsection (3) it would be open to Lord Mishcon to say, "There are plenty of things which may be accurate but which may none the less be incomplete". But the phrase used in the draft is "inaccurate or misleading" and our view is that any information which in a material particular is incomplete and is calculated to deceive—which would certainly be the case in the example he gave—is misleading because it leads to a false conclusion, and that is what I understand "misleading" to mean.

"Incomplete", on the other hand, is a word which is not, I think, capable of very precise definition because different views may be taken as to what should be included in any statement of fact. The test, which I suggest is an objective one, about whether it should give rise to compensation for inaccuracy under Clause 22 is whether the incompleteness is such as to lead a possible recipient of the information to a false conclusion, and that is capable of measurement and judgment by an objectively-minded tribunal. But in a sense no information is absolutely complete, least of all that which is contained on a computer.

I submit therefore that, so far as the point is a valid one—and I think it is a valid one in the sense that I have conceded it—it is already covered by the draftsmanship as it is. If the noble Lord feels any lack of ease about my reply, I shall certainly give the matter back to the draftsman and see what he says, but that is the view I personally take and the view which, at the moment, the Government take.

§ Lord Mishcon

If the noble and learned Lord would kindly consider possibly altering the words to, inaccurate or incomplete so as to be misleading", then I should have thought we might have covered the point. However, I do not want to take it any further at this stage, and I ask leave to withdraw the amendment.

§ The Lord Chancellor

Again, we are dealing with the question of balance, and I think we have it right. The point is, however, worth discussing and I am grateful 653 to the noble Lord, Lord Wigoder, for tabling the amendment, the effect of which would be to increase considerably the range of circumstances in which the data would be subject to a strict test of accuracy. I fear that, if passed, the amendment would place a vast and wholly irredeemable burden on data users, would in most instances prove unworkable, and I doubt if it would add much, if anything, to the protection being provided for data subjects.

The purpose of Clause 22(3) is to apply the accuracy test strictly to matters of fact where the information comes from the data user himself, while recognising that in a great number of instances it would be quite impossible for the user to verify the accuracy of information coming into his possession. Sometimes it might be possible to check the accuracy of information received, but on most occasions that would not be possible. Take, for instance, something we have, if we are householders, as I suppose all noble Lords present today are, tilled up every year ourselves—the electoral register. The data user in that case will be the keeper of the register. He will act on our information and we shall be committing, for that purpose, a criminal offence if we deliberately deceive him. But he does not check the accuracy of what we tell him at all, and it would be quite unrealistic to expect the returning officer, let alone someone making use of the electoral register, to check the details submitted by each householder so that they were accurate in every respect.

In this, as in life in general, we must take a good deal on trust, and if we are—as my noble friend Lord Mottistone has consistently reminded us since Second Reading—to take the burden which is being placed on data users by the Bill as representing the limits on one side, and the rights of the data subject as the purpose of the Bill on the other, then that is why we have deliberately drawn the line at this point. The Bill abstains from placing an impossible responsibility on each data user, but it provides—and here is the protection for the data subject—that where the data accurately records information received or obtained by the data user from a third party, it should not be regarded as inaccurate for the purposes of the clause (notwithstanding that it may have been supplied in an inaccurate form) provided that the data are recorded as having been received in that particular way and as depending on information from a third party.

To qualify for the saving in subsection (3), data must accurately record the information which the user has obtained or received, but it must indicate that the data consists of such information. The real risk to data subjects from inaccurate data is where inaccurate statements, perhaps from some third party not in a position adequately to judge the case in hand, are placed on the computer and are thereafter treated as though they were Holy Writ. That is when they can lead to mischief.

The Bill therefore provides that such statements must be qualified in order to secure immunity by a note recording that the information obtained from a third party has passed into the possession of the data user from that source, and we think that the risk of harm will thereby be substantially minimised. I fully acknowledge that we are balancing one factor against another. I only submit to the Committee that we have 654 the balance about right and that the alternative would be to impose an impossible burden on the data user.

§ Lord Avebury

May I ask the noble and learned Lord to explain what happens in a case of information collected by a subsidiary of a company and then fed into a computer used by the parent? If that counts as information coming from a third party, it would be an easy way for somebody to give himself an absolute safeguard against the provisions of Clause 22, because he could merely record that the information came to him from a subsidiary, so exempting himself from any claim for damages which an individual might otherwise be able to formulate.

§ The Lord Chancellor

I should like to consider that question at greater length, because instant law is almost always bad law, but I should have thought that there was a point to be made there. However, beyond any question of doubt, the subsidiary company would be liable for any defamatory material that the computer contained.

§ Lord Avebury

Does that mean that if the information had been collected in manual form and it did not go into the computer until it got to the parent company, there would be no right of action?

§ The Lord Chancellor

That I do not agree with. There would be a publication if it was published to the holding company in any form. But if the noble Lord, Lord Avebury, wants a longer and possibly more considered reply, perhaps he would forgive me for the moment. However, the last point I feel no doubt about.

§ Lord Perry of Walton

I should like to ask a connected question. It seems to me that the wording of the clause does not state specifically that the nature of the third party shall be disclosed. If it states simply that the data have been received from a third party, there will be no ability to go back to the original data supplier.

§ The Lord Chancellor

The point is that in Clause 22 we are dealing only with compensation against the data user. We are not dealing with other questions, such as damages for libel, and there are of course remedies for that. All that one can tell here is that, as regards the claim for compensation referred to in Clause 22(1), the data user has a defence if he uses in good faith material from a third party which turns out to be inaccurate. If the noble Lord thinks that there should be some further qualification to subsection (3), I should certainly be prepared to ask my advisers whether it is necessary to identify the source more particularly than is provided for in the subsection, and either I shall let the noble Lord know, or he can return to the matter on Report.

§ Lord Perry of Walton

I thank the noble and learned Lord very much.

§ Lord Wigoder

I am grateful to the noble and learned Lord for his careful answer to this matter. I had been reflecting on the question of the electoral register a little earlier this afternoon. I am not sure that 655 I can envisage circumstances in which one voter will suffer damage as the result of inaccurate information put upon the electoral register by another voter, but I suppose that it is conceivable that there are circumstances in which that might happen. I accept that the effect of the amendment might be to add a substantial burden for data users, and on reflection I would agree that in the Bill there are already enough burdens placed upon them, and it might not be desirable to seek to increase them in this way. I beg leave to withdraw the amendment.

§ The Lord Chancellor

I think that the fatal flaw in the amendment is that it would not include use by the dater user's own staff. Whereas under the Bill as drafted the inaccuracy leading to damage would render the user liable to pay compensation if the information was used by his own staff, under the proposed amendment the liability would arise only when it was disclosed, and that, I assume, means disclosed to a third party. That would, I think, enable the staff of the data user to use the information as if it were substantiated fact and cause all the damage that the data user might thereby cause without being liable to pay the data subject compensation. I think that this is a fatal flaw in the amendment.

§ Lord Mottistone

I had great difficulty in understanding the amendment itself, and I shall have to read with great care my noble and learned friend's reply to see whether there is anything more that can be pushed in this direction. In the meantime, I beg leave to withdraw the amendment.

§ Lord Avebury

I should like to ask one brief question about Clause 22 before we leave it. Does the right which is conferred on a data subject under the clause depend on the access provisions of Clause 28? In other words, does the computer have to be other than a computer which is exempt from the subject access provisions there defined? I am thinking in particular of the Home Office computers which, as the noble and learned Lord may recall, have already figured in our discussions on one or two occasions during the Committee stage.

I should like to refer to an answer that I received yesterday from the noble Lord, Lord Elton. It alarmed me very considerably because it showed that in the Immigration Service Intelligence Unit computer it is intended to hold no fewer than 300,000 names. The names are not to be simply those of persons refused entry clearance, or in certain other cases, deported from the United Kingdom, but also the names of persons considered to be involved in abuse or attempted abuse of the immigration laws. Obviously those form by far the largest category within the 300,000 persons whose names are to be held in the computer, and it is a matter of opinion whether or not those persons have been engaged in abuse. But if they have not, and yet their names are recorded, clearly they may suffer very serious damage indeed. For instance, they might be members of the Civil Service and come up for promotion. If there was automatic access to the computer to see whether a particular name was held on it, it might be discovered that Mr. Shah, who works for the DHSS, is a person who is alleged to have been involved in abuse or attempted abuse of the immigration laws. I suppose that therefore he would become ineligible for promotion and would thus suffer very serious damage.

It may well be that he never discovers that his name is so recorded, but there are occasions when incorrect facts are held by the Home Office—at the moment in manual form, and no doubt in future they will be in machine readable form—in such a manner as to cause very serious damage indeed to the subject. I should like to mention just one example which springs to mind. It is the case of a Nigerian lady who is alleged to have been engaged in abuse or attempted abuse of the immigration laws. The reason given by the Minister for the allegation was that she claimed to have had a child at a time when it would have been impossible for her to have conceived it by her husband because she was not in Nigeria at the material time and her husband had not visited England at the material time. But in the end, on closer scrutiny of the lady's passport, the Minister had to agree that she had indeed visited Nigeria nine months before the birth of the child. The Minister was good enough to apologise most handsomely for the error that had been made and for the slur that had been cast on the lady's honesty. Fortunately, that was something that could be corrected because the facts came out in the course of correspondence with the Minister—as they may in future, in spite of the fact that the same information will be held on a computer instead of in manual form. Would it be possible in the circumstances that I have 657 outlined, supposing that this lady had suffered damage—and there is no doubt in my mind that she had—for her to bring an action against the Home Office for that purpose? I think it extremely important that, if 300,000 names are to be recorded in this computer, they will not be used to the detriment of many innocent people.

§ The Lord Chancellor

This is a very highly technical question, but I will give the best answer I can on the draftsmanship of the Bill. The noble Lord asked me a question about Clause 28. I think that we shall probably be holding quite a long discussion on Clause 28 when we come to it. Whatever Clause 28 does, it provides only that the personal data therein prescribed in subsection 1 are exempt from subject access provisions. That is not Clause 22. Personal data are exempt from the non-disclosure provisions in two cases which are not the same as the cases prescribed in subsection (1) but they are exempt from the nondisclosure provisions. However, they, again, do not affect the right to compensation. Personal data are exempt from the provisions mentioned in subsection (4) of Clause 28 in any case in which the application of those provisions to the data would be likely to prejudice any of the matters mentioned in subsection (1). Subsection (4) provides that the provisions referred to in subsection (3) are the provisions in Part II of the Bill conferring powers on the registrar to the extent to which they are exercisable by reference to the first data-protection principle.

My reading of that clause, not having had previous notice of the question, is that there is nothing in Clause 28 which abrogates the right to compensation in Clause 22. I have said that quite categorically, not being 100 per cent. sure that I am right. If I turn out to be wrong, or am advised that I am wrong, I shall retract my words and eat humble pie.

§ The Lord Chancellor

I think I might best answer this argument by an example. Supposing all the data in a computer were destroyed, and therefore lost, by a devastating fire or a devastating flood, without any fault whatever on the part of the data user, it would surely turn proceedings for what is, under Clause 23, a breach of the eighth principle in the First Schedule 658 (that is to say, appropriate security measures should be taken) into an inquisition as to whether the data destroyed had been fairly obtained or whether they had ever been inadequate or excessive, whether there was any inaccuracy in them or whether they had been kept longer than was necessary. In other words, a number of totally irrelevant considerations for the protection of the data subject in accordance with Principle 8 would have been introduced although the data had been lost simply by an act of God.

It seems to me that to make the data user a guarantor of all the principles when you are providing protection to the data subject in respect of a breach of one of them, is clearly unjust and, for the reason that I have given, although I can understand the concern of the noble Lord, Lord Mishcon, to see that all the principles are kept in every case, I do not think it would be a just result in the case which I have posited. The reason which I have given applies to all other possible cases, I think, where the damage is not due to the breach of a principle other than No. 8, the relevant principle. In a case of unauthorised disclosure, that gives rise to compensation for damage. That is quite intelligible; but it does not necessarily mean that that you then have to enter into a complete inquisition as to whether the other seven principles have been kept or not—because they are, for that purpose, irrelevant. I am afraid that I am not putting this very well but the noble Lord, Lord Mishcon, is so intelligent that I am sure he has got the point.

§ Lord Molloy

I wonder if the noble Lord, the Lord Chancellor can help me. Normally, one can follow the submissions of the noble and learned Lord in general debate and understand precisely what the noble and learned Lord has to say, one does not have to agree with the noble and learned Lord but at least one understands what he is saying. But there are exceptions to every rule. I listened to his submission just now. I can follow it as far as a lay person can, but when he says, "Let us suppose that all the data has gone by fire or flood"—or for some other reason has vanished, that, in my judgment would be a good thing, for it would have gone for good and for ever.

But there is another possibility. What happens when somebody is listed and entered in that data and that one person departs this earthly realm and then later somebody is hauled before the courts for some reason or other and part of the case against him submitted by the Crown would be a connection with someone in that data which the Home Office would reveal? The deceased, of course, would be in no position to say whether what was kept in the data was true or untrue. This is the converse argument to that submitted by the noble and learned Lord. I do not know whether it is particularly relevant. I should be grateful to have a more authoritative view of that point.

§ The Lord Chancellor

I will do my best. I do not think it is because it is difficult to understand; it must be because I put it badly that the point is not immediately apparent to the noble Lord. Clause 22, which was the last clause we discussed, gives compensation for inaccuracy. We are not concerned with that in the present amendment. Clause 24 gives a right to rectification and erasure. Again, we are not concerned 659 with that. We are concerned with Clause 23, which gives a right to compensation for loss or unauthorised disclosure. Of course, it is only the person who has suffered damage who is entitled to the compensation. That in principle gives rise to a right of damages.

Perhaps I ought to say by way of introduction that that is an absolute liability subject to the qualification contained in subsection (3). That is to say, it is not for the complainant to prove negligence or to prove wrong-doing, but the respondent to the complaint is entitled to set up a defence which is set out in subsection (3): In proceedings brought against any person by virtue of this section"— that is the one that we are talking about— it shall be a defence to prove that he had taken such care as in all the circumstances was reasonably required to prevent the loss, destruction or disclosure in question. The burden of proof is on the defendant.

The position is this, as I understand it. If somebody suffers damage by reason of unauthorised disclosure, loss or destruction of the data, he will get compensation unless his opponent, the data user, can prove that he was not negligent. I am using broad terms now. If he can prove that he was not negligent then he gets away with his defence. I think I have that more or less right.

The point at issue in this amendment—I think that to some extent I have answered the point that the noble Lord, Lord Molloy, raised—is that there are eight principles. We have called them the "eight commandments" after the Decalogue. They are contained in the first schedule to the Bill and they are very generally expressed. That is to say, they are in some ways much more like the Decalogue than like an act of Parliament. They say that personal data shall be obtained and processed fairly and lawfully. That is the first. Then one goes down through the eight of them.

The point at issue in this amendment is that the noble Lord, Lord Mishcon, wants it to be said that if for any reason you would have a right to compensation for loss or destruction or unauthorised disclosure under Clause 23, in addition to proving no negligence, you have to prove that you have kept all the "eight commandments" and not simply the relevant one. I was trying to explain to the noble Lord, Lord Mishcon, that I thought that went too far because it may be that the other seven were totally irrelevant and therefore ought not to be counted against the respondent in a claim for compensation under Clause 23. I hope that I have put it better this time.

§ Baroness Platt of Writtle

May I ask for clarification from my noble and learned friend? He says that if a data user proves that there is no negligence then that is his defence. But supposing an external person cracks the computer and gets in from outside? Can the data subject prove an offence against an illegal entry, as it were, to the data information?

§ The Lord Chancellor

That will depend upon the question of fact. The question of fact is appropriately set out in the "eighth commandment" of Schedule 1. In order to establish his defence in such circumstances, he would have to show that he had taken appropriate 660 security measures. If, without any fault of his own, he had been broken into, there would be no liability. But unless he could prove that there was no fault of his own, if he left the door unlocked or the window unlatched or had done any of the things the police tell us not to do, or left undone any of the things that they tell us to do, then he would not make out his defence. That is the general answer to my noble friend.

§ Baroness Platt of Writtle

I am sorry, but may I go one stage further? Would the data subject then be able to prove offence against the person who had broken into the computer?

§ The Lord Chancellor

Clearly if he suffered damage I would think en principe yes, but not under this Bill.

§ Lord Mishcon

The noble and learned Lord was kind enough to call me intelligent. Anybody who does that causes me to give in right away. Seriously, I only want to say this. The arguments that the noble and learned Lord advanced as well as the examples that he gave are of such weight that I obviously would want to consider this amendment. At this stage I should like to ask the Committee's leave to withdraw the amendment.

§ Lord Wigoder

One small query on Clause 23(1)(b): the destruction of any such data without the authority of the data user". One's first instinct on reading the Bill was to think that "data user" was a mistake for "data subject". I accept in the context of the clause as a whole it clearly is not and it ought to be "data user". May I ask the noble and learned Lord whether he can confirm, as a result of that, that the data user is free to destroy personal data without first of all obtaining the authority of the data subject under the Bill?

§ The Lord Chancellor

I am being submitted to cross-examination but I think that I have the answer, which again is in the "eighth commandment": Appropriate security measures shall be taken against unauthorised access to, or alteration, disclosure or destruction of, personal data and against accidental loss or destruction of personal data".

§ Lord Wigoder

That is unauthorised. If it is authorised by the data user, then the data subject has no complaint. Is that right?

§ The Lord Chancellor

I think he has. I will consider the matter again. I take it that in the "eighth commandment" the unauthorised access covers this position: if there is not a lawful authority to destroy, security measures must be taken and therefore it would follow that if the data subject said to the data user, "You may not destroy this valuable material about me" I suppose he could not do it. Perhaps I ought to think about that a little longer.

§ Lord Wigoder

May I therefore make the problem clear and leave it to the noble and learned Lord to reflect upon it? I refer to organisations that contain records of millions of people with hundreds of millions of items of information amounting to personal data, who frequently want to bring their records up to date and to dispose in one way or another of data which are for their purposes entirely obsolete. I am only anxious to make clear, if that is so, that such an organisation is not going to need to secure the authority of each and every data subject at each and every time before so disposing of it.

§ The Lord Chancellor

I apologise for what may have seemed denseness. The noble Lord is perfectly right in what he has just said.

§ The Lord Chancellor

For some reason—and I must apologise for it—I have this amendment grouped with No. 119. I thought it was the same point—that the Bill as drafted allows alternative lines of approach by the then subject either to the registrar or to the court, in the circumstances of Part III. The amendment, which I had originally thought of as grouped with No. 119, would deprive him of one of them and therefore would not be to his advantage. But if I have misunderstood the point, owing to the way in which my papers are arranged, I will come back to it.

§ Lord Wigoder

As the amendment is similar and as the answer appears to be similar, I think the course I should take ought to be similar. I therefore beg leave to withdraw the amendment.

§ The Lord Chancellor

The difficulty is, to my mind, that there are things in respect of which the data subject is undoubtedly entitled to go to the registrar in order to complete the material which he requires to be able to bring his proceedings under this part of the Bill. He can, of course, go to the registrar, as I explained in answer to the last amendment, to enforce the right of access and the various rights given, which the registrar can do either by an enforcement notice or ultimately by deregistration. In that sense he can get assistance.

What other assistance is required in order to complete his application to the court is not altogether clear. His application to the court presumably will be be for damages for inaccuracy. He will have been able to go to the registrar to get the data. He will have been able to go to the registrar for an enforcement notice to erase inaccuracies and he will then be able to go to the court for compensation. He will have had the assistance of the registrar in the relevant ways in which I should have thought assistance was required. For the purpose of an application to the court, he is also entitled to visit the registrar's office and get papers and advice of a general kind; but I think he would have to take his proceedings in court in the ordinary way, either with legal aid or without it if he is not entitled to it. Until the amendment defines what is meant by "assistance", I think I would rather be on the side of the noble and learned Lord, Lord Gardiner, in a previous debate that we had, because the registrar would have to be told what he had to do before he had to do it.

§ Lord Wigoder

I am grateful for that explanation and I beg leave to withdraw the amendment.

§ Lord Elton

I respond to this amendment looking over my shoulder at Amendment No. 141. I had half thought that No. 141 was the one that we would struggle with at great length, and that the noble Lord would then substitute "the Secretary of State" for "the registrar" in a swift and scarcely perceptible movement and I would fall exhausted into his arms. That, it seems, will not be the outcome.

This is another amendment, one of so many which the noble Lord has moved, with which one has substantial sympathy but which on closer examination does not appear to be necessary nor to achieve its desired object without also carrying substantial disadvantages. The noble Lord's basis was that, in the circumstances in which the Bill reduces the general safeguards available for data subjects, the Secretary of State ought to be required to put some compensating protection in their place; and that seems a most worthy aim. But I am not sure that it is necessary to spell this out on the face of the Bill.

First, data affected by the provisions to which this amendment relates will not be left without any form of protection at all, as I think is sometimes implied by the critics of this area of the Bill. Such data will still remain subject to the oversight of the registrar, and there will be nothing whatever to prevent him from looking with particular care at the data to which these exemptions relate, to ensure that such of the principles as still 664 apply in the circumstances of the case are being complied with.

It would be wrong for me to anticipate how the registrar will choose to exercise his discretion. He will be dealing face to face with problems at which I can only guess. But I can see no reason at all why he should not decide that where, for example, the element of "self-regulation" which subject access provides is absent, it might be appropriate for him to look with particular care at other aspects of the activities in question.

To go further, however, and to require the Secretary of State to prescribe additional safeguards in such areas would carry a number of disadvantages. It would mean, for one thing, that he was obliged to prescribe such safeguards—which must, in the nature of things, take the form of formal procedures to be followed—even in cases in which there appeared to him to be no such procedures which could materially affect the situation in question. He could impose them, too, where it was more appropriate to rely upon the normal exercise of the registrar's powers. Going down this road might actually inhibit the registrar from exercising the sort of particular care in regard to such data that I referred to earlier. And I would remind your Lordships that the requirement would apply even to the most innocuous of data.

Perhaps at this point I ought to remind your Lordships that the Secretary of State already has a power in Clause 2(3) to provide enhanced protection in the sensitive areas to which I think he is addressing himself, and I do not think that a further provision here would add anything to the general protection which the Bill provides. I think that I will leave it at that at this point, and see whether the noble Lord wants to respond now.

§ Lord Mishcon

Indeed, I do. I hope that the brevity of my remarks did not mask the importance that we ascribe to this amendment. We here are the guardians of the people who may be affected by exceptions to this Bill. Anybody who is responsible takes the view that there must be exceptions, for the sake of the detection of crime and so on. That is admitted. But if you grant those exceptions you cannot just leave it to the discretion of the Secretary of State as to whether or not he will apply further safeguards by virtue of having added to the exemptions.

I keep on hearing, as your Lordships do, about what this poor registrar is supposed to do and be. If I may declare it to your Lordships, I am not available for the position, if the noble Lord the Minister is calling for any nominations or volunteers. It is impossible. This registrar is supposed to have the qualities of a High Court judge, he is supposed to be the protector of the subjects of the realm, he is the drafter of regulations, the person who can think in terms of guidance on codes of practice, and he is knowledgeable in engineering and computers. He is a remarkable person and I hope that one day he will join your Lordships' House—

§ The Lord Chancellor

He quite certainly will.

§ Lord Mishcon

I ought to say that I hope he will be in a fit state, at the end of his term of office, to join your 665 Lordships' House. But this is an important amendment and I do not think it is answered by what the noble Lord the Minister has said. I hope the Committee will feel it is important enough that it should have the opinion of the Committee attached to it, and I trust that it will be a favourable opinion.

§ Lord Elton

I wonder whether the noble Lord will now permit me to come back, because what he said was that I had not sufficiently covered the ground; and I did not deploy all my distaste for his amendment on the basis that he had not deployed all his enthusiasm for it. The fact is that the provision which the noble Lord proposes would be likely to entail the Secretary of State prescribing very detailed requirements in regard to every possible set of circumstances. In other words, it would take us back into the realm of codes of practice, which, as I have already said, we believe cannot sensibly be imposed from above. Indeed, the sort of codes of practice being suggested here are, if anything, even less attractive than those postulated in the noble Lord's earlier amendments. He must recognise this, since there is no requirement for them to be devised in consultation, for instance, with the users who will be affected. We have heard considerable criticism during the debate in Committee up to now of the functions which the Bill gives to the Secretary of State. In theory, the Secretary of State would be able to use his power to impose sweeping additional checks on data which enjoyed the exemption provisions, and Parliament's intentions in providing for exemptions would be nullified. If the noble Lord reads the Bill, he will find that Parliament has power to nullify the order which the Secretary of State would bring, but he is required to bring it by the amendment, regardless of that process. So even if he is quite confident that Parliament will withhold the order which he is required to lay, he still has to bring it before Parliament. Maybe that is going too much into the detail of the amendment and I am prepared to argue it later. But the fact is that this is giving to the Secretary of State, who, the noble Lord has often said, has too many powers under this Bill, a whole sweeping area of new responsibility, and in this I see a certain inconsistency.

§ Lord Mishcon

I will not detain the Committee, save to say that the reason for Amendment No. 141A, as against No. 141, is that we were told before by the noble Lord the Minister, and quite correctly, that you should not give the registrar power to make orders by way of safeguards or anything else because they would not be subject to the will of Parliament. Then, if you alter that to the Secretary of State in order to meet that argument, you are told that it is a wrong power to give to the Secretary of State, because you are giving him too much power or because Parliament cannot negate. I think that the quickest and most effective course, on what I think is a necessary safeguard for the subject in these exemption clauses, is to ask the Committee kindly to divide.

§ Lord Mottistone

It might be for the convenience of the Committee if I not only commented on what the noble and learned Lord has just said, but invited the Committee to consider at the same time my Amendment No. 144A. Although I have much sympathy with the underlying reason behind the noble and learned Lord's approach to the problem, I do not find myself in agreement with the bulk of his amendments. My own solution to the problem is Amendment No. 160, which takes a somewhat different line.

669 I am sure the noble and learned Lord is aware that in the case of national security there must be provisions which are not dissimilar from those contained in Clause 27. Whether or not the safeguards are sufficient, the safeguard of national security is of prime importance. However, I agree with the noble and learned Lord so far as the small point covered by my Amendment No. 144A is concerned. It is somewhat distasteful that an unspecified official who may or may not be—we are not told—of particularly high rank in the Civil Service can sign certificates on behalf of a Minister of the Crown. If for the purposes of subsections (2) and (3) a certificate is to be provided, the Minister ought to sign it himself. That is the one point in the noble and learned Lord's argument with which I entirely agree. Whatever the Government may think about the other points—I have given my own views—I hope that they will accept, at least for serious consideration, the principle which underlies Amendment No. 144A.

§ Lord McIntosh of Haringey

The objection which I and a number of others have to this clause, and why I rise to support my noble and learned friend's amendment, is because of the definition of the words "national security". If they meant what all Members of this House have by oath or affirmation solemnly sworn to adhere to and support, there would be no problem. The difficulty arises from the fact that over the years national security has increasingly come to mean internal surveillance. For example, it means surveillance of political and trade union activists. It means a great deal more than the words in the Bill. This gives rise to very severe problems about the liberty of the subject in this Kingdom, which are put right only to some extent by my noble and learned friend's amendments. I believe that the issue goes even further.

Secondly, I take issue with this clause because of the inclusion of an exemption from the obligation to register. In genuine cases of national security it may be necessary for the data subject not to have access to the contents of a data file, but the case for registration is even stronger when there is a file which concerns national security. Surely it is the right of all citizens to know that a file is being kept for national security purposes. Indeed, it is in the interests of those keeping such files that people as a whole should know they exist.

§ Lord Avebury

Nobody would disagree with the noble Lord, Lord Mottistone, that the requirements of national security are paramount. In this Bill, as in the rest of our legislation, we have to take good care that what we do upholds the powers of the Government to ensure that national security is properly taken care of. At the same time we should be jealous of arguments which are deployed in favour of secrecy and in favour of an extension of the powers of Government under the guise of national security, when in fact the records to which they refer may embrace a far larger category of subjects. And we can see from the files which are kept by Government on other matters, apart from national security, that they may extend into areas which are connected with the main purpose of the operation but are not directly germane to it. Therefore 670 we may have persons whose names are recorded in these files which have to do with national security but who themselves are not a risk to national security or in any way involved in violations of national security.

Therefore I agree with the noble Lord who has just spoken that we need to know what these files are. It is quite wrong for the exemption to extend so far as the registration provisions of Clause 9, which would at least enable the public to know what these files were, even though we accept that in some cases there should not be access to them.

Another feature of this clause which needs to be looked at carefully falls in subsection (1) where it states that there shall be exemption if … a Minister of the Crown certifies that the exemption is required for the purpose of safeguarding national security. This is in the case of personal data held by a Government department, but no such requirement is found in subsections (2) or (3). There, exemption in respect of data held otherwise than by a Government department, and in respect of data held otherwise than for the purpose of safeguarding national security which are disclosed for that purpose, can operate in the absence of a ministerial certificate certifying the exempt status of such data, although it is provided in subsection (4) that, … a certificate signed by or on behalf of a Minister of the Crown and certifying that personal data are or have been held or disclosed for the purpose of safeguarding national security shall be conclusive evidence of that fact. This does not mean that subsection (4) makes it obligatory for such a file to be covered by a ministerial certificate, and I think that it should be, just as the files which are covered by subsection (1) should be covered by a ministerial certificate, and that the clause should say so.

Subsection (3) relates to the exemption from non-disclosure provisions, and I question why it is put into this clause rather than into Clause 28(3), where all the other non-disclosure provisions are found. It would seem more appropriate and easier for people to follow if all the non-disclosure provisions were held in the same clause so that they can be evaluated together.

§ Lord Somers

This is purely incidental, but I cannot find anywhere in this Bill where it is defined who the Secretary of State is. We all assume that it is the Home Secretary, but as I have not discovered where this is defined in the Bill, perhaps the noble Lord will be kind enough to tell me.

§ Lord Gibson-Watt

I support the amendment of my noble friend Lord Mottistone, and I very much hope that my noble friend the Minister can meet this amendment. As I read the Bill, it is the case that civil servants in the office of the Secretary of State can make these decisions without the Minister. If that is so, I cannot go along with it very easily and I support this particular amendment.

§ Baroness Macleod of Borve

I too should like to support this amendment because it is, perhaps, more important than some of us in this Chamber may realise. It might have very wide repercussions.

§ Lord Elton

When I first rose to disappoint your Lordships by appearing instead of my noble and learned friend the Lord Chancellor, whom noble Lords expected, and neglected to endorse his opinion that the noble Lord, Lord Mishcon, would be an ideal candidate, in view of the qualifications required, for registrar, the noble Lord, Lord Mishcon, disarmed me by cleverly associating Amendments Nos. 141 and 141A together when I had expected them to be separate. I left all my rhetoric behind in Amendment No. 141 and had to stumble through my notes on Amendment No. 141A.

Pleased with the obvious success of that manoeuvre, the noble Lord has moved smartly onto the opposite tack and his noble and learned friend has put together so many amendments that I am afraid your Lordships will find my reply in this case conversely unsatisfactory; not thin and short but thick and long. But I will do my best.

I will start by saying that Clause 27(1) is, I quite agree, a very important provision. It enables personal data held by a Government department to be exempt from the provisions of Parts II and III of the Bill if a Minister is satisfied that an exemption is required for the purpose of safeguarding national security. The Government recognise the heavy responsibility which this provision will place on those who must determine whether the risk to national security from not applying an exemption justifies the removal of the data from the Bill. It is clear that the only people in a position to weigh the various considerations are senior Government Ministers. Moving this amendment, the noble and learned Lord, Lord Elwyn-Jones, has implicitly accepted this approach but, as we have heard, he and others want to ensure that the responsibility for certification of exempt data is exercised only at the highest level, by Secretaries of State only rather than by any Minister of the Crown.

To the noble Lord, Lord Somers, I will say that it is quite customary to leave the actual identity of the Secretary of State unfixed in legislation; that is a convention. It is usually implicit in the Bill, and in this Bill it will normally be the Home Secretary, although in certain areas—where one is talking about exemption, for instance, for data held in the Ministry of Defence—it would be expected to be the Secretary of State for Defence, and that is to be read from the Bill.

I understand the desire to see that this authority is at the highest level and at the highest level of answerability. As I have said, the act of certification is a heavy responsibility and that is where it should be, but the adoption of this amendment will present very real difficulties. Personal data which may need to be exempt might be held in Government departments which are not controlled by Secretaries of State. Thereby is the relevance of the question asked by the noble Lord, Lord Somers.

Your Lordships will understand if I do not go into too much detail, but let me say that certain data are held by departments such as the Treasury, which is not under a Secretary of State; by the Attorney General, who is not a Secretary of State; and under the Prime Minister, who is not a Secretary of State. In all these cases, on rare occasions data might need to be made exempt, and it would be absurd for a Secretary of State 672 in another department to have to take responsibility for certifying exemptions in those circumstances. It is for that reason that the Bill places responsibility on Ministers of the Crown rather than on Secretaries of State.

I am aware, however, that by enabling all Ministers of the Crown to sign certificates, the Bill allows all members of the Government, including junior Ministers, to certify an exemption. I appreciate the concern which many will have about this and I hope to dispel that concern by giving a firm assurance that the intention is that certificates will be signed only at the highest available level. Where a department is headed by a Secretary of State, any certificate under this subsection will normally be signed by the Secretary of State. Another Minister will normally sign certificates only where there is no Secretary of State exercising departmental responsibility. In the light of that assurance, I hope that the noble and learned Lord will be prepared to let us move on to the next amendment in the group which he moved.

I believe I can be confident that all your Lordships acknowledge the importance of safeguarding national security and wish to be assured that all possible steps are taken to that end. Yet we also must recognise that the more that is said about what those steps are, the less effective they will be. It is clear that the responsibility here must rest with Ministers accountable, at the end of the day, to Parliament. I have already given an assurance that it will only be Ministers at the most senior level who will discharge this duty.

When we come to subsection (2), there the test for exemption is slightly different. Subsection (2) is of application only to data held by users who are not Government departments, but who may nevertheless hold certain data for the purpose of safeguarding national security. That aspect caused the noble Lord, Lord Avebury, some concern and it may concern other noble Lords. But it is not surprising that, for example, defence contractors, or in certain circumstances—as has been suggested—the police, may be included in that category. Where that is the purpose for which the data are held, the data are exempt, supported if necessary by ministerial certificate, if one should be needed, to put beyond doubt the purpose for which they are held.

We have taken this approach with non-governmental users because with them it is only the purpose for which the data are held that is the test that needs to be applied to obtain exemption. Under Clause 27(1) it is the certificate itself that creates the exemption. Under 27(2) it is the purpose of holding the data that exempts the data and the certificate is only needed as confirmation of that purpose. That is why we took the two-pronged approach which your Lordships find in the first two subsections of Clause 27.

In view of what your Lordships have said, I wonder whether we have been over-subtle in our approach. I should like to reflect on that. Are we labouring after a distinction without a sufficient difference? Certain things are clear. We must have an exemption for national security purposes. It must be an exemption from the requirements of the Bill as a whole and it must be backed by ministerial certificates. It would be 673 wrong for me to suggest that there is room for movement in any of those criteria, but I do feel that I should offer to look again at the different approach we have taken to those two subsections in case what we have gained in precision we have lost in clarity.

I will now leap on, if I may, to Amendment No. 144. On the previous amendment I did undertake to think further on points that had been raised. I am afraid I cannot but harden my heart—my head and my brief are hard enough already—against this amendment. Subsection (3) of Clause 27 is a vital provision if national security is to be fully protected. I believe this is the subsection that the noble Lord, Lord Avebury, expected to find elsewhere. It is, of course, this part of the Bill that deals with national security, and I think it proper that exemptions for national security should be put together with national security and not with exemptions. The authorities for safeguarding national security, like any law enforcement agency, rely on information. Some comes to them, some they must seek from others. On occasions, an increasing number of occasions nowadays, the information they seek is held on a computer. They may need to know about the international movement of a certain person, the name of someone who has hired a particular car. I need not give exhaustive examples, but those two are sufficient. The kind and range of cases are self-evident.

The holder of the information will be a registered user, but I should have thought that quite obviously he will not have registered those responsible for national security as prospective recipients of the data. Almost everybody would have to do that at some stage, otherwise. Faced with a request for information needed for the purpose of safeguarding national security, he would be in a dilemma. He might wish to disclose the information, but he would know that to do so would be an offence. That is where subsection (3) comes in. It allows data to be disclosed in those circumstances without the user running the risk of prosecution or a notice from the registrar. To complete the reassurance to the user, a certificate may be issued under subsection (4) providing conclusive evidence of the fact that the disclosure was for the purpose of safeguarding national security. I must stress that the provision places no obligation on the user. It merely frees him from constraints that the Bill would otherwise exercise.

Then we are clear on this. Those responsible for safeguarding national security must be free to go out and seek information without hindrance. Where a data user is willing to give information, it would be a dangerous misordering of priorities to prevent him from doing so where national security may be at stake. There is recognition in the European Convention of the need to derogate from the principles where national security is concerned. There is recognition of its supreme importance in all European laws. It is no good talking of secret transfers as if national security can be looked after in a blaze of publicity before an invited audience. Information must be freely and discreetly available in this area, and we are determined to ensure that that continues to be the case.

My noble friend Lord Mottistone directed our attention in this great group to Amendment No. 144A. We have already considered the need for the signature of a Minister of the Crown rather than a 674 Secretary of State to appear on certificates under Clause 27(1). Of course precisely the same considerations apply to Clause 27(4), so I will not go over that ground again. Instead I will address the second point raised by the amendment, and the principal one to which my noble friend spoke. That is whether a certificate should be signed personally by a Minister or should be capable of being signed on his behalf. I recognise the perfectly understandable concern right round the Committee on this matter. May I concentrate here on two interlinked points? First is the reason why slightly different arrangements are envisaged for the signing of the two different kinds of certificate provided for in Clause 27; and, second is the reason why the certificates available to non-governmental users can be signed on behalf of a Minister unlike those in the first leg. I have explained the difference between the tests under the two subsections. Under subsection (1) it will be whether the exemption is required to safeguard national security. In those circumstances it can be expected that the necessity to avoid endangering national security, for example by a data user registering data, will be clearly visible in advance. There will be time for the certificate to be signed personally by a Minister, and, once the certificate exists, and indeed only then, so too does the exemption.

The situation in which the certificate may be signed in the case of users who are not Government departments may be rather different. The signed certificate will not be the precondition of the exemption. As long as data are held for the purpose of safeguarding national security the exemption applies. But it may be that the purpose for which the data are held is challenged, and a certificate is needed rapidly to put the purpose beyond doubt. It has, therefore, been thought right that, when a Minister cannot himself physically sign the certificate at the precise time that it is required, he can authorise its signing by somebody on his behalf. I stress that his personal authority has to be given even though his is not necessarily the hand that holds the pen.

There lies the reason for the difference between the provisions for signing the certificates, and also the reason for the words "on behalf or appearing in Clause 27(4) only. It is a question of practicalities. If certificates are needed rapidly, we must not set up a procedure which could slow down the necessary signature being obtained. But, having said that, I have said that I am willing to consider further the dual approach to Government departments and other users in subsections (1) and (2), and it seems to me natural and proper, particularly in view of the considerable anxiety your Lordships have expressed, to include within that consideration the distinction that exists in Clause 27 between the ways the different certificates are signed. I hope noble Lords will find that a satisfactory position for the time being.

This is turning into a long speech, but your Lordships put forward many separate points. I have two more amendments to which to address myself, Nos. 146 and 147. Amendment No. 146 is relatively short, I am glad to see. In our discussion of the previous amendments I have emphasised that the free flow of information is vital to the task of safeguarding national security. I will not, therefore, dilate on that, 675 and it will not be necessary, therefore, to take too much time explaining why we cannot accept this amendment. Clause 27(3) exempts data from the non-disclosure provisions where the data are disclosed for the purpose of safeguarding national security. I have explained why that is necessary. Clause 27(4) allows a Ministerial certificate to confirm either that data are held for that purpose, thus supplementing subsection (2), or that they are disclosed for that purpose, thus supplementing subsection (3). The amendment is aimed at denying us that latter provision. Yet we must be able to reassure users willing to provide data for this purpose that they will be free from challenge, and that is what the certificate does. It can be issued to confirm that a disclosure did take place for the specified purpose and that therefore the exemption applies. The knowledge that such a certificate is available in the event of challenge will be a valuable reassurance to users with information needed for national security purposes that they can disclose it safely. We cannot, therefore, offer to do anything on that amendment.

Would it be to your Lordships' advantage if I held my horses on Amendment No. 147, because I do not doubt that your Lordships will get as confused as I will if I go on responding to all the major points put to me in the group?

§ Lord Strabolgi

The amendment—

§ Lord Elwyn-Jones

I did not speak to Amendment No. 147.

§ Lord Elton

I think that both the noble and learned Lord and the noble Lord, Lord Strabolgi, simultaneously, but not in unison, are saying that Amendment No. 147 is not in the group, and I am vastly relieved to hear it.

§ Lord Strabolgi

Would it help the noble Lord to consider giving an interpretation of "a Minister of the Crown"? As far as I can see there is no interpretation of this office in the interpretation clause. The noble Lord talks about taking decisions at the highest level. This, of course, means very little. All Ministers, all Members of the Government, work at the highest level. There are about 100 of them. In this House, at Question Time, Questions may be answered by the Leader of the House, a member of the Cabinet, or may be answered by a Lord in Waiting, but we all refer to whoever is answering the Question as "the Minister". I think it would help if we could have some interpretation of "a Minister of the Crown". I am talking about putting this in the Bill, perhaps at a later stage.

The noble Lord talked about practicalities. Here, of course, I come to the amendment of the noble Lord, Lord Mottistone, with which I have great sympathy. First of all, one has very little definition about who a Minister of the Crown is and then one has very little definition about whoever can sign this certificate on his behalf. It could be anybody. Does a Minister of the Ctrown include a civil servant, or an official of some kind? Who is to sign it on the Minister's behalf? Nothing is clear.

676 I can remember—and I do not want to remind your Lordships of an unhappy period—that during the Cyprus crisis in the mid-1950s when there were a great many internment orders being signed and a great many Cypriots being interned for long periods without trial (it may have been necessary at the time, I do not know) in theory all the internment orders had to be signed by the Governor and the Commander-in-Chief. In fact, those of us who took an interest in these matters and visited the island discovered that many of these internment orders, for purposes of practicality as the noble Lord, Lord Elton, said, were being signed by officials, some of them quite junior, because the Governor himself was too busy.

That is the sort of thing that happens if one does not define who is responsible for these matters. Therefore, there is a further erosion of the liberty of the subject. For that reason, I hope that the Government will pay attention to the amendments of both my noble and learned friend and the noble Lord, Lord Mottistone, because I believe that they are important from that point of view.

§ Lord Avebury

May I raise a further point which I hope can be dealt with by the noble Lord at the same time? It relates to the disclosure of personal data held otherwise than for the purpose of safeguarding national security. I take the example that he postulated of how this might operate in practice. In pursuing an alleged breach of national security it might be necessary to find out the name of a person who has hired a car—perhaps a terrorist who has hired a car for the purpose of committing an act of terrorism. The noble Lord explained that the person who holds this data would need to be sure that he was not liable to proceedings for a breach of the Act if, when someone asks him to disclose the name of this person for the purpose of national security, he accesses the computer and gives out that information.

I want to ask the noble Lord whether at that stage the data user would normally demand the production of a certificate such as is mentioned in subsection (4). I ask that because the noble Lord did not quite deal with the point I made in my earlier contribution that neither in subsections (2) nor (3) does it say that a certificate from a Minister of the Crown is required. Only later on in subsection (4) does it say that a certificate will provide conclusive evidence if it is produced. Therefore, if a police officer approaches the rent-a-car firm and asks for such information and the owner says, am not sure that I can do that because, after all, under the Data Protection Act I might be liable to proceedings for disclosure of information", what if the police officer then says to him that the information is required for the purpose of national security and that he could get a certificate from a Minister of the Crown but does the owner of the firm wish him to take so much trouble? Would the owner then feel obliged to make him do so?

I know that the noble Lord says that even with these provisions there is no obligation on the data user, only that he will feel free from prosecution, but I suggest to the Committee that, under the circumstances I have described, the owner might well feel that it was a national obligation on him to give this information to a police officer. Unless the certificate signed by a 677 Minister of the Crown is proffered to him at that stage, he might be at a disadvantage, so why do we not say so on the face of the Bill instead of merely making it possible for a Minister of the Crown to certify that the information is required ex post facto?

§ Lord Swinfen

Has my noble friend any idea how many exemptions will be required in a typical year?

§ Lord Mishcon

I do not know whether the noble Lord the Minister wishes to answer that question and get it out of the way.

§ Lord Elton

I thought that I would first address myself to the noble Lord, Lord Strabolgi, who asked for a definition of "a Minister of the Crown". I am told that it is to be found in other statutes. Certainly our intention is that it should be of some significance. The noble Lord, Lord Strabolgi, said that many Ministers were in this House and that the term meant little. I can agree that, if it means such as I, then it means very little. On the other hand, if it means such as the noble and learned Lord the Lord Chancellor, then it means a great deal.

That links with his next question which I think illustrates the dangers of lumping too many amendments together. I have already undertaken to consider the point that he raised as being important in response to my noble friend's amendment, so I do not think it is necessary to respond again in those terms.

I think that the difficulty that the noble Lord, Lord Avebury, sees, and I quite understand it, is this: how is a data user to know that the information being required is genuinely needed for reasons of protecting national security? It would, I think, be in the first instance up to the police to make a statement to that effect and to say that a certificate would follow. The Bill allows for that. Of course, if the data user is not satisfied that the police are genuinely in search of this information for that reason, he is perfectly entitled to withhold the information. The point that I hope I emphasised sufficiently the first time round is that the Bill does not create a new obligation, it merely protects against the disincentive which could be damaging to the public interest. Those are the matters I wanted to pick up at this point and perhaps the noble Lord, Lord Mishcon, now wishes to, not return, but join the charge.

§ Lord Mottistone

Perhaps I may clear my amendment out of the way first before the noble lord on the Front Bench opposite comments on this. I am most grateful to my noble friend for accepting the principle of my Amendment No. 144A. I trust that perhaps he will be able to make some sort of amendment to subsection (4) to incorporate it.

I did notice that when he replied he said that a Minister of the Crown would always authorise a signature. The Bill does not actually say at the moment that he will. I am not quite certain that that is quite good enough and, quite frankly, I should much prefer that he go the whole hog and amend it on the lines I suggest in Amendment No. 144A. For all that, I accept his offer.

§ Lord Elton

Before my noble friend sits down, I must make clear that there are great difficulties and what I am undertaking is to look at them. The noble Lord should not count on my being able to resolve those difficulties. It is quite clear that neither I nor my noble friend would wish junior officials to be happily rubber-stamping illegible signatures on documents which perhaps expose people to influences which might make them very worried. That is what I am trying to avoid.

Viscount Bledisloe

Before the noble Lord, Lord Mishcon, speaks, I should like to seek some enlightenment about Amendment No. 142. I had understood that, because it referred to "the Secretary of State", it provided that all exemption certificates would be given by the specific Secretary of State in charge of all these functions—namely, I imagine, the Home Secretary. When the noble Lord, Lord Elton, spoke to the amendment, he assumed that, even if these words were included, the particular Secretary of State in the department concerned would give the exemption certificates and pointed out that there were some departments which did not have a Secretary of State. I must confess that I was attracted to this amendment by the theory that all certificates of exemption would be given by one person, and that therefore the practices of the varying departments would be standardised and one would not have, for example, one department that claimed that everything was national security and another department that took a more realistic view, but there would be a central and informed view addressed to the matter. I would like to know from the noble Lord, Lord Mishcon, and from the noble and learned Lord, Lord Elwyn-Jones, which of these they intended.

§ Lord Mishcon

Sometimes one endeavours to help the Committee and one finds in the end that it may not be of very great assistance. One tries to help the Committee very often by addressing the Committee on several amendments which relate to one clause, thereby saving the Committee various speeches. It can be confusing at times if one does that and I would rather like to make it clear, as I thought my noble and learned friend did, that although he was speaking to various amendments, they are in fact separate amendments and will be taken separately.

I would like to refer the Committee back to Amendment No. 142. I beg of the Committee to regard their duties—and I hope that this does not sound pompous—under this clause as very serious duties indeed. What they are doing is considering a clause which grants to certain data users, and to Government departments in particular, complete and absolute exemption from the whole effective body of this Bill—Part II of which relates to the: Registration and Supervision of Data Users and Computer Bureaux". and Part III relating to the: Right of Data Subjects". Before we take people out, before we take Government departments out of the whole real body of protection in the Bill, I hope that your Lordships will not think I am putting it too high when I say we must remember that 679 a great onus of responsibility rests upon the Committee.

As at present worded one can see precisely the position of the Bill. It is that under Clause 27 a Minister of the Crown can certify that something is of national security and, as soon as he does so, away goes Part II and away goes Part III of the Bill. I hope that I am not being offensive at all when I say that so far little consideration has been paid to the seriousness of subsection (1) and the use of the phrase "a Minister of the Crown". My noble friend Lord Strabolgi asked, "Please can you tell us who is a Minister of the Crown for the purposes of this Act? There is no definition". One would have thought that so much consideration had been given to this matter that the answer would come terribly readily from the Minister that, "'A Minister of the Crown' in this Bill means something which is defined in the interpretation clause or somebody, by a given Act that I can at once refer you to, who is a very senior Minister indeed". But the only answer given—and therefore one must assume that very little consideration has been given to this important matter—is that in certain Acts a Minister of the Crown is defined. Your Lordships' Committee at this moment remains uncertain about which are the Acts, what the definition is and whether they vary or whether they do not. Moreover, nothing has been put in the Bill at all to define it.

Even if that were not so, and even if this Bill carried a definition or a reference to another Act which says (if I may smile for a moment) "All Ministers except Lords in Waiting in your Lordships' House", I repeat that before this Committee discharges its duty to exempt from Part II and Part III—I repeat again, the whole body of protection in this Bill—surely there must be the protection of a certification by the Secretary of State. There is nobody in your Lordships' Committee on these Benches or any other Benches who would pretend for one moment that national security is not dear to all of us, and it has to be looked after by every single one of us—but with responsibility, not by opening doors that none of your Lordships intends to open; none of it by certification at a lower level.

The Minister says, "Oh, please do not worry, it is the intention that it should be by a Minister at a high level". He went on to say—and I quote his words—"It normally would be by somebody at high level". What the Minister says in this House is always regarded with great respect. But his utterances are not so monumental that they are remembered for years to come put in every Government department as a warning and plastered either outside County Hall or anywhere else for all those who pass over the Thames to see them. It is not written in this Bill, and I repeat for the last time—and I do not gain any force for my argument by repeating it again—that our onus is heavy; we must secure that before this certificate is granted for exemption from Part II and Part III (and that is all that my noble and learned friend and I are speaking about at this moment) it must be a Secretary of State or the Secretary of State. In answer to the noble Viscount who put a perfectly proper question to me, of course it can be the Secretary of State for Home Affairs. I cannot see the Secretary of State in charge of defence worrying that there should be—and putting to 680 the Secretary of State for Home Affairs—this obligation. I cannot envisage the Treasury, that has not got a Secretary of State, being offended at that being done; and the same might be said of any other department. It must be the Secretary of State, otherwise we are not fulfilling our duty.

§ Lord Elton

The noble Lord has moved into his customary eloquence and put before your Lordships the gravity of what we are dealing with, and I do not seek to detract from that. We need to recall that this is creating new safeguards which do not at present exist because of the different way in which information which is already held may be held in the light of technological advance. The noble Lord addressed himself to the very great importance of defending the national interest in the matter of security, and we are at one with him as regards that. He then tackled me, and quite justifiably, on my inabilty to define at my finger-tips the meaning of the term, "a Minister of the Crown"; and I take the point. As it happens I took the point some minutes ago when I last addressed your Lordships from this Box.

But what he has not taken is the purpose for which we use that term. It was the only term which appeared to us to embrace the very highest authorities in the departments in question. For instance, where the Prime Minister is involved, the Prime Minister is not a Secretary of State. I realise that the noble Lord has to consider what he is about to say, but perhaps he could consider what I am saying. The use of the term was deliberate in order to embrace the highest officers of Her Majesty's Government; that is to say, for instance, the Prime Minister and the Chancellor of the Exchequer; and I say only "for instance", because had we used the term "Secretary of State", they would have been excluded, and I think that that would be quite improper.

Then, at the invitation of the noble Viscount, Lord Bledisloe, the noble Lord said that, in fact, he would be content if this responsibility should be discharged on behalf of every department of Government by one Secretary of State. That is a new principle which I find a little disturbing, because I think it must be accepted that Secretaries of State are more closely aware of what goes on in their departments and what is needful for their departments than are other Secretaries of State. The intention is that it should be another Secretary of State who should, in the noble Lord's amendments, be the one who authorises the exemption.

The third matter about which I should remind your Lordships is that we are, indeed, now considering only subsection (1)—that is, Amendment No. 142—which is for a permanent standing exemption for parts of the information held by departments—not for everything held, but for the appropriate parts of information held by a department of state. That is not something done in haste and there is no question of it being handed down to someone to sign on behalf of the Secretary of State.

I hope that I have made that clear because I may have confused your Lordships by following the noble and learned Lord down the path of grouping these amendments together. Here we are talking of the personal data held by a Government department which are exempt from the provisions, as the noble 681 and learned Lord rightly says, of Parts II and III of the Bill on the certificate of, as we have put it, "a Minister of the Crown". Those are our motives; those are the consequences that will flow from it. I think that they are proper.

§ Lord Elwyn-Jones

In following the advice of the Table about the grouping of amendments and for the convenience of the Committee, I endeavoured to speak to a number of amendments together. I doubt whether I really rendered service to the Committee by doing so and, indeed, I may have weakened the force of the individual amendments to which we attach great importance by so doing. But if by zeal to assist the Committee and further business I have been in error, I regret it very much.

We now come to make a decision on Amendment No. 142. The terms of the amendment are to: leave out ("a Minister of the Crown") and insert ("the Secretary of State"). As I understand it in regard to the control of telephone intercepts, there is a similar kind of language that can be used, under the authority usually of the Home Secretary, the Secretary of State for Defence, or the head of the particular department which may be directly concerned. If there was a language which was sought to include the Prime Minister and the Attorney-General, certainly I would be willing to extend it as far as that.

I think that there was merit in the suggestion of my noble friend Lord Mishcon that the authority should be concentrated in the Home Secretary, but, knowing a little about inter-departmental problems, I can see difficulties about that. What we want to ensure is that the head of the department concerned in the particular matter should be responsible. Usually it will be the Secretary of State. Most of the cases arise from the Home Office or possibly the Ministry of Defence for that is where the important field of maintaining the security of the realm is to be found.

Therefore, as it stands, "the Secretary of State" means what it says. It does not identify one particular Secretary of State, but I am content that those words should remain. It may well be that, on further thought, we should add and possibly identify, if need be, the exceptional Prime Minister and the exceptional Attorney-General, for the reasons that they have responsibility and are not so easily classified. But because of the importance of, at any rate, dropping "a Minister of the Crown", which is what we are after, and ensuring that the top man—the top responsible person—has the responsibility, I now move the amendment and invite the Committee to come to a decision upon it.

§ Lord Elton

Can the noble and learned Lord tell the Committee whether in fact he will be returning to speak to each of those subsequent amendments separately and to move them separately, or do they all fall together with the present amendment?

§ Lord Elwyn-Jones

If I may do so, I propose to follow the same course as I adopted in regard to the earlier group of amendments. It may well be that when we come to the later amendments I shall be as brief as I was on the earlier occasion, and I shall indicate what in our opinion are the matters upon which we shall invite the Committee to divide.

As I was saying, the clause provides a blanket exemption from the non-disclosure provisions for all disclosures of information to third parties, relating to all the four categories to which I have referred. The exemptions are blanket exemptions. There is here no element of the judicial control which exists in the proposals of the Home Office in regard to the Police and Criminal Evidence Bill, which is now in another place. That adopts a totally different policy for exactly the same problem. Under Clause 10 of that Bill the police are also given power to obtain access to confidential records, but only on the order of a circuit judge, to be made only if he is satisfied that a serious arrestable offence has been committed and that evidence about it cannot be obtained in any other way. Amendment No. 149 is intended to deal with that very situation, and to provide that the disclosure must be made under compulsion of law. The question of whether it be through the authority of a circuit judge or some other judicial authority remains for further consideration.

As I say, the provisions that are set out in the Bill amount to blanket exemptions, and there is no element of judicial control over a matter which is of very great importance to almost each man in the land from the point of view of the security of his privacy, and indeed of his liberty.

The matters that are identified in subsection (1) cover not only … the prevention or detection of crime"— and that means crime over the whole field, not just serious crime—but also … the apprehension or prosecution of offenders; … the assessment or collection of any tax or duty; or … the control of immigration". We fear that the Bill will have a particularly severe impact on the ethnic minority communities. That is the particular mischief and danger of the inclusion of "the control of immigration" in the categories of blanket cover in the Bill.

The reference to immigration control is of course particularly and principally directed at the ethnic minority. An immigration officer is unlikely to have 686 any reason to try to obtain information from doctors, employers, social workers, or others about a white person born or settled in this country. That would arise only in a minority of cases. However, a black person may well be singled out for suspicion as an overstayer or illegal entrant, and inquiries may be made even though he or she may have been settled in this country since childhood.

This is a matter of very grave concern to the immigrants in this country and to the ethnic minorities. We believe that there is no justification for the present exemptions in the Bill from the non-disclosure provisions—certainly not in relation to the matters referred to in paragraphs (c) and (d) of Clause 28(1). I should have thought that only in the most exceptional circumstances, such as the investigation of a murder, kidnap, or rape, the police may require the power to obtain confidential information on any particular individual subjects. We believe that if the enlargement of the field to cover the assessment or collection of taxes and the control of immigration is included when the Bill becomes an Act, it may result in a non-compliance with the terms of the convention. We do not accept that reliance may be placed on Article 9 of the European Convention. That article allows only derogations which constitute a necessary measure in a democratic society in the interests of protecting State security, public safety, the monetary interests of the State, or the suppression of criminal offences". Those exemptions do not include, or bring within their embrace, immigration control. In our opinion they plainly do not, and certainly at the very least it is doubtful whether they include taxes or duties, either.

During the Second Reading I ventured to say that the European Court of Human Rights has always construed the word "necessary" in a very narrow sense. It would be difficult to argue that in a democratic society such as ours it is necessary for the police, let alone the Inland Revenue, the Customs and Excise, or the immigration authorities, to have secret access to all computerised personal information systems in the country. We consider that the clause is not only a very grave encroachment upon the privacy of the subject—the man in the street—in this country, but also threatens his liberty. I beg to move.

§ Lord Elton

Perhaps I may intervene at this stage, because I propose to avoid the difficulties into which I fell on the last amendment by addressing myself to the amendment on the Table before us at the moment. When the noble and learned Lord comes to subsequent amendments, he may feel that he can move them formally and rely on what he has already said. I can then bring forward my arguments against them without confusing myself and everyone else as well.

§ Lord Elwyn-Jones

They may well come on consideration of clause stand part also, in view of the observations that I have made generally. That will not surprise the noble Lord.

§ Lord Elton

I rather thought the noble and learned Lord had already delivered that speech and, therefore, that we were not to have it again. The noble and learned Lord concluded by suggesting that the exemption in Clause 28(1)(c) is incompatible with the 687 European Convention. Article 9 of the convention allows derogation from the principles in the interests of the monetary interests of the state. I know that the term "monetary" has certain emotive overtones for noble Lords opposite, but I am confident that the official commentary on the convention explains specifically that that term refers in particular to tax collection requirements and it is in that sense that it is here used.

As I understand the view of the noble and learned Lord, he accepts the need for an exemption from subject access data held for the purposes specified in paragraphs (a) and (b) of Clause 28(1). But he and his noble friends take exception to extending the exemption in this case to tax collection. They want to restrict the use of exemptions by the revenue departments to that which is available under paragraphs (a) and (b). In other words, the exemption would apply only in respect of data held about people suspected of committing criminal offences. But the practical consequences of the amendment would go much further and would create an impossible position for those who are responsible for administering tax collection.

I should like to explain. In many cases, failure to comply with tax obligations is not a criminal matter but is settled on a civil basis between the taxpayer and the revenue department concerned. The appropriate treatment in these circumstances will depend among other things on the gravity of the offence involved. Where a possible irregularity in a person's tax affairs comes to light, the revenue departments have to carry out an investigation to establish the position. In cases of serious fraud, it may be clear from the outset that the eventual outcome will be a criminal prosecution of the taxpayer (or the tax non-payer, as perhaps I should say) in which case the exemptions under paragraphs (a) and (b) would apply and" there would be no problem.

But in other cases, including many where a substantial loss of tax may be involved, criminal proceedings will not be competent or appropriate and the eventual settlement will be on the basis of the tax authorities seeking civil penalties against the person concerned. If paragraph (c) were omitted, the revenue departments would be obliged to give access to the data which they might use as a basis for an investigation in these cases. As a result the person involved could well be forewarned about the department's suspicions and take steps which would effectively thwart the investigation.

This amendment would, therefore, risk giving assistance to those who seek to dodge their tax obligations; and I cannot believe that that is what noble Lords opposite have in mind. Your Lordships may feel that there is a balancing need for safeguards for data subjects and, first, I would remind the noble and learned Lord that all the information would be registered and controlled by the registrar. We are not giving—to use his term—"blanket exemption". The vast majority of personal records on the revenue department's computer files will be fully open for taxpayers themselves to inspect the data which is held about them. Exemption from subject access would apply only where disclosure would prejudice the 688 assessment or collection of tax or duty. Moreover, the registrar can test the data to ensure that they comply with the other principles that apply.

It is just not true to suggest that exemption from subject access leaves the data wholly unprotected. The registrar can see them and can exercise his powers in relation to them by reference to the other principles. Secondly, I draw your Lordships' attention to the fact that even when subjects cannot obtain access, the provisions of the tax code would enable them to appeal against any assessment of tax which might be based on the data. Thirdly, the revenue departments apply very strict rules of confidentiality which, with a very few statutory exceptions, prevent the disclosure of data without the taxpayer's consent.

If I may say so, the question here is whether or not our revenue departments should be properly equipped to prevent evasion and fraud. Every taxpayer has a certain secret sympathy with those who share his wish to pay less to the state than perhaps he otherwise would, but we are talking about money which is rightly due to the state and money which pays for things which are as dear to the heart of the noble and learned Lord as they are to my own. Paragraph (c) is necessary to ensure that the money comes to hand. In our view, this amendment would impair the ability of the revenue departments to collect tax which is properly due, and would, therefore, add to the burden placed on the honest taxpayer such as the noble and learned Lord.

§ Lord Elwyn-Jones

I thank the noble Lord for that compliment but there is no mention at all of fraud in the subsection.

§ Lord Elton

As I tried to explain, fraud is a crime and crime is otherwise caught.

§ Lord Campbell of Alloway

May I raise a short point on Clause 28(1)(a)?

§ Lord Elton

With respect, that would come on clause stand part. There is no amendment on Clause 28(1)(a). The first amendment on Clause 28 is to subsection (1)(c), which we are now debating.

§ Lord Campbell of Alloway

I apologise to the Committee.

§ Lord Avebury

Strictly on the point of Clause 28(1)(c), the assessment and collection of tax and duty, may I draw the noble Lord's attention to the report of the Royal Commission on Standards of Conduct in Public Life which was published in July 1976 and which went into a great deal of detail in considering the use that might be made of information obtained in confidence by the Inland Revenue and also by other agencies; but that was one on which the Royal Commission concentrated. The evidence that was given to the Royal Commission was that, since the early 19th century, the information collected by the Inland Revenue was not to be divulged to any other authority for any purpose whatsoever with the exception that, in the case of homicide or treason, by custom and practice the Board of Inland Revenue was prepared to disclose its confidential information to the police.

689 Giving evidence to the Royal Commission, the Inland Revenue underlined the importance of these provisions in ensuring that people were completely frank in their dealings with inspectors of taxes because they knew that, whatever information they gave which might possibly have other implications, it would not be revealed for purposes other than the simple collection of taxes. This has resulted, they believed, in the collection of taxes being much easier than it would have been if people had not had faith in confidentiality.

In a way, I am supporting the noble Lord the Minister in saying that everything that Parliament can do to ensure that the state receives the revenue to which it is entitled it ought to do. Therefore, the inclusion of the assessment and collection of tax or duty in subsection (1) of this clause has to be looked at carefully because it leads then to exemption from non-disclosure provisions in subsection (2). Therefore, as I read it, the Inland Revenue would have the power to disclose information collected for the purposes of taxation for any of the other purposes mentioned in subsection (1); the prevention or detection of crime";— and not simply crime against the Revenue— the apprehension or prosecution of offenders … or the control of immigration …". It would be possible therefore, for example, for the Inland Revenue's tax records to be accessed for the purposes of immigration control.

That is something which would be a complete departure from the practice of the Inland Revenue and from the recommendations of the Royal Commission on Standards of Conduct in Public Life. They were considering the question of corruption in local authorities and whether or not the tax records should be disclosed to the police with a view to aiding in the apprehension of, for example, local authority officials and councillors who took bribes. They came to the conclusion that disclosure should be subject to very powerful safeguards, and they said that there should be a power available only on application by the Director of Public Prosecutions to a judge of the High Court, and on the corresponding procedure in Scotland, on proof of reasonable grounds for suspecting a corrupt act, for the police to inspect the financial records of persons or organisations before criminal proceedings are started. If we let this provision go through as it stands no such safeguards would be built in.

Although the Minister said in response to the previous amendment that there would be no obligation to hand over information as a result of this clause, is it not likely that once the Act comes into operation the Government will give instructions to civil servants that, whenever information was required for any of those purposes mentioned in subsection (1), it would be handed over by the Government department which owns that particular file.

Therefore people will no longer be able to have any confidence in the security of the tax records because they will know that for any of the other purposes mentioned here the information could be disclosed. I believe that this is dangerous and that if we were to take the advice of the people in the Inland Revenue they would strongly recommend that that provision 690 should be deleted. I should like to know from the Minister whether any consultations have been held on this matter, whether in drafting these clauses regard was paid to the recommendations of the Royal Commission that I have mentioned, and whether or not the advice of the staff of the Inland Revenue was taken in the drafting of this clause.

§ Lord Elton

If I may deal with this straightaway, as the noble Lord, Lord Avebury, has pointed out, this paragraph of this subsection is linked to the next, and that is and important consideration because in the next subsection there are two paragraphs and not one. This clause provides exemptions from subject access—that is, from people inquiring after information held about them—to data held for purposes among which is that stated in paragraph (c), the assessment or collection of any tax or duty.

The noble Lord has said, first, that there is an ancient and honourable convention in the Revenue that there should be strict confidentiality. I can tell him that the Bill does not affect the strict confidentiality rules of the Revenue departments which preclude the disclosure of information to a third party, except where this is specifically authorised by statute. Clause 28(2)—the linked subsection—only disapplies the provisions in the Bill. It does not create any new right to disclose. That is the important point. Needless to say, the Inland Revenue advice was sought and considered very carefully in the drafting of this part of the Bill.

The noble Lord will also notice—although I think that what I have already said is stronger than this consideration—that where the exemption in clause 28(1) (c) is actually applied to the collection of tax or duty information, as it is caught elsewhere in this Bill, it is not only in the light of subsection (2)(a) that the disclosure is for any of the purposes mentioned in subsection (1)—that is, the collection of tax or duty—but also the person so disclosing has to be satisfied that the disclosure would be likely to prejudice that. They would have, what is more, to prove reasonable grounds for that belief if the issue was ever tested in the courts.

So there are two echelons of defence here: the existing echelon in which the noble Lord already places his confidence, the confidentiality rules, and, beyond that, the echelon of likely to prejudice and reasonable grounds provided where this exemption is provided to the provisions within the Bill itself. I hope that reassures him.

§ Lord Mishcon

I wonder whether I may deal very quickly with what seems to me to be the essential matter that we are considering. It is, as the Committee knows, Clause 28(1)(c) and Clause 28(1)(c) alone. That relates to the assessment or collection of any tax or duty. Subsection (1) exempts from the subject access provisions matters related to the assessment or collection of any tax or duty when there is likely to be a prejudicial consideration in regard to the assessment or collection of any tax or duty.

The noble Lord the Minister has pointed out, as have others, that there is a link, too, with subsection (2) because that deals also with non-disclosure protection. In other words, you can disclose and you are 691 protected if any of these matters is likely to prejudice the assessment or collection of taxes. The last thing any Member of the Front Benches, or the Cross-Benches wants to do is to try to set up barriers against the Revenue discovering fraud in regard to Revenue matters. We are not dealing with that, and, with respect, the Minister confused the issue completely in his opening remarks by talking about tax fraud. Tax fraud is covered under paragraph (a). My noble and learned friend has not asked for that subsection to come out. That subsection deals with the prevention or detection of crime. It is a crime, quite obviously, if one attempts fraudulently to deceive the Revenue or fraudulently to deprive the Revenue of what they ought to have.

We are dealing with the ordinary assessment and collection of taxes. There are existing laws in regard to that matter. Why have we to bring it into this Bill? Are the Revenue saying that they are not content with the disclosures that they can now get? If so, would the Minister kindly inform us of any representations made by the Revenue as to what they propose to do under this clause which gives them any additional powers? If they have no additional powers under this clause, why is it in the Bill? Why is it necessary?

§ Lord Elton

If I can answer that question now, whereas records kept in manual form are subject to the normal law and conventions, we have been pressed by the public, Europe and noble Lords opposite to legislate for information which is turned into data and is kept on computer records. It is quite clear that if there is an absolute right to access to all that material which there is not when it is written, then certain things will have to be revealed by the Revenue which would not be revealed if they were kept manually. Certain things have to be kept confidential if there is a question of people not paying their taxes.

The noble Lord has rightly said that it is not only a question of fraud. What the noble Lord proposes is that the only means of proceeding for the Revenue should be by means of criminality. The only exemption remaining that the Revenue could use in these circumstances would be that in Section 28(1)(a) or (b). We are anxious that the Revenue shall continue to be able to deal with a large range of really substantial amounts by means of civil proceedings, which this amendment would make impossible.

§ Lord Mishcon

I take the point of the noble Lord the Minister but I am afraid that he has not followed through his own argument which relates to subsection (2) and subsection (1). This amendment goes to the root of subsection (1) by virtue of the fact that it is connected with (2). At the present moment, if the Inland Revenue go for collection or assessment purposes, be it to banks, to accountants or to anybody else who has information on computers, the answer is: "Please go away; we do not do things like that; we do not tell the Revenue the confidential information we have got even if it would help, as might be thought, in the collection or assessment of taxes."

If this provision were put into the Bill linked to No. (2), the Inland Revenue would be able to point to a provision in an Act of Parliament which says:"You are 692 completely protected in regard to non-disclosure and therefore Parliament has inferred that you have a duty to help us on this." There has been no such duty implied under any Act of Parliament except in regard to some very difficult Finance Act provisions where disclosures are made, and professional people have come within those provisions. This is a general blanket, which will be completely misunderstood. In my view and in the view of my noble friends, there is a vast difference when you are dealing with crime, including fraud on the Revenue, and dealing with the mere assessment and collection of taxes. I hope, in those circumstances, that the Committee will agree that this subsection should come out, and I am referring only to (c).

§ Lord Elton

The noble Lord seems to be shooting a couple of hounds when he only wants to get rid of one. Subsection (1) deals with subject access and subsection (2) with non-disclosure. All the concerns he is now voicing refer to non-disclosure. He has returned to that theme again and again. Surely what his amendment ought to do is to destroy the link between the two subsections, because otherwise what he will do will be to deny what I think on reflection he might regard as being something we cannot do without—and that is the exemption from subject access in matters which are not criminal. That would be the effect of the amendment. It may well be that we should test the mood of the Committee in any case at this stage.

§ Lord Elwyn-Jones

With that observation I agree. I beg to move.

§ Lord Glenarthur

I think perhaps now might be a convenient moment to break for dinner until 8.30. I beg to move that the House do now resume.