Serious Crime Bill [HL]

We have heard some very interesting points, not least the powerful statement made by the noble Lord, Lord Crickhowell, about the banking approach. I hope that your Lordships will find that we are not outwith the concerns that have been expressed. It may be helpful at this stage if I outline what the safeguards are and how they will work. The noble Baroness, Lady Carnegy of Lour, is absolutely right that we have to be very sensitive to how people feel about this matter and make sure that data sharing is done in a safe, appropriate and sound way. That has been very much at the forefront of our minds when we have looked at the provisions. I hope that, as we go through them, the Committee will feel increasingly comfortable that we have taken these issues very seriously indeed. As I tried to say earlier, the usual data protection requirements will continue to apply, and we will continue to work with the Information Commissioner and consult him on the codes of data-matching practice for the implementation of the proposals.The national fraud initiative provisions contain an offence of unlawful disclosure of data, which carriesa maximum two-year custodial sentence. The safeguards can be summarised as follows; I will run through them because it is important at this stagethat we bear them in mind. First, only the Audit Commission can decide which data should be matched. Secondly, the Audit Commission and other bodies are permitted to disclose information only for defined purposes. Tough criminal sanctions for breaching the disclosure provisions are provided. There is a statutory requirement for the Audit Commission to prepare a code of data-matching practice. Those are very much some of the issues that the noble Lord, Lord Crickhowell, touched on in his recitation of the banking approach. The data-matching practice is a code to which all participating bodies must have regard. Under the existing code, the Audit Commission restricts itself to using sets of data where it has been established that fraud is known to be prevalent or to involve significant sums of money. The Bill restricts the purposes for which patient data, such as name, address and date of birth, can be used. They can be used only to combat fraudulent activity in the NHS. The Data Protection Act will continue to apply in full to data-matching exercises. All the protections that currently exist in relation to the Data Protection Act will apply with full force to these provisions, without exception. The issue of what safeguards will apply to specified data-sharing organisations has been raised. All the existing legislation, principally the Data Protection Act 1998, will continue to apply. We have talked about the safeguards in other Bills, and they will still be there. The noble Baroness asked about the cost of the national fraud initiative. The Audit Commission charges each body about £2,000 to match its data. That currently happens once every two years, and all bodies keep the data needed in electronic form. The noble Baroness foreshadowed what I was going to say about this matter. It is providing a resource that people will be able to use, and it will be available. We expect all bodies to be using electronic databases. Information would be shared electronically through anti-fraud organisations, and bodies would need access to the internet to be able to share in that way. Bodies are charged relevant to their size and their assets. I have dealt with sensitive personal data, because their use is already moderated by the Data Protection Act. I hope that noble Lords will see that those protections are very real indeed.