Statistics and Registration Service Bill

My Lords, it is rare for a Minister to feel that all the problems at Third Reading are a consequence of what he said on Report, but I am beginning to get that feeling today, certainly as far as the noble Lord, Lord Newby, is concerned. He is wrong when he says that on Report I referred to the Information Commissioner’s satisfaction with the Bill. It was not only at the Report stage: in Committee, on Second Reading and all the way through I have maintained, with confidence and without contradiction, that the Information Commissioner is broadly satisfied with the Bill. How can I be specific and say that every single line and phrase in the Bill is endorsed by the Information Commissioner? Of course I cannot say that. But what I am indicating—and did so on those three separate occasions and I will do so again today—is that the Information Commissioner did not identify any part of the Bill with which he was dissatisfied or of which he was critical, otherwise we would not have prayed his name in support of the Bill. For obvious reasons, we were all too well aware that we could have been challenged at any stage where we took his name in vain. I reiterate, for the fourth time, the salient fact that the Information Commissioner is broadly satisfied with the Bill and is positive about it. He has welcomed the fact that it recognises the importance of ensuring personal information is used only where necessary and that confidentiality is respected. It will be recognised in the House, particularly with the high levels of expertise we have here about the operation of statistics in this county, that the Office for National Statistics already has a good working relationship with the Information Commissioner, and it is in the interests of the board, when it is established, to continue that good relationship to help ensure that people trust the board to hold its information securely. Noble Lords will recognise that that is a cardinal obligation upon the board, as it has been upon the ONS up to now. As I noted on Report and, as the noble Baroness indicated, spelt out in rather more detail in the letter I sent to noble Lords who participated in last week’s debate, the Government believe that the Information Commissioner already has similar powers in the Data Protection Act to carry out the activities set out in the amendment. In our debate on Report, there seemed to be some misunderstanding over the powers the commissioner already has. The noble Baroness, Lady Noakes, and the noble Earl, Lord Erroll, seemed to be under the impression that the commissioner required the consent of the board to assess the processing of personal data. The noble Baroness said that the commissioner, "““can assess the processing of personal data if, and only if, the data controller consents to the assessment, otherwise his powers ""are limited to cases where a request comes from the person affected by the processing of data””.—[Official Report, 18/6/07; col. 62.]" That is not so. Under the Data Protection Act, the Information Commissioner already has the power to request information from the board by issuing an information notice, if, as Section 43 of the Act says, he, "““reasonably requires any information for the purpose of determining whether the data controller has complied or is complying with the data protection principles””." The noble Earl, Lord Northesk, took the argument one stage further. He said, ““Ah, but Section 43 only comes into play if in fact there is a request for assessment made by someone under Section 42””. The commissioner can issue an information notice where he reasonably requires any information for the purposes of determining whether the data controller has complied. That is his right. It should be recognised that when we stated that the Information Commissioner is broadly satisfied with the Bill and that sufficient powers exist for examination with regard to the board, what I attested to last week also obtains this week and renders the amendment unnecessary. The commissioner does not need the consent of the board to issue such an information notice. His powers to issue a notice are backed up by sanction, in that a person who fails to comply with an information notice or provides false information in response to one is guilty of an offence. Moreover, if, on the basis of the response to an information notice or for another reason, the Information Commissioner believes that the board has contravened any of the data protection principles, the commissioner may serve on the board an enforcement notice requiring it to take specified steps to comply with the principles or to stop processing personal data. Not to comply with the Information Commissioner’s notice is an offence. I have already indicated that there is a very strong incentive for the board, when it is established, to co-operate with the Information Commissioner. I recognise that the motives behind the tabling of the circumstances, which would deal with the most extreme circumstances, are entirely worthy. If, in the extreme circumstances, the board continued to refuse to co-operate with him, the Information Commissioner could ultimately get a court warrant to operate and test equipment used by the board for data processing or seize any documents or other relevant material. These powers are not to be dismissed lightly. The Information Commissioner has them with respect to compliance with the eight data protection principles, a set of fundamental principles designed to ensure the proper processing of personal data. The Office for National Statistics and the board will be in possession of very important personal data. In brief, the data protection principles make sure that personal information is fairly and lawfully processed; that it is processed for limited purposes; that it is adequate, relevant and not excessive in relation to the purpose for which it is processed; that it is accurate and up to date; that it is not kept for any longer than is necessary; that it is processed in line with individuals’ rights; and that it is held securely and not transferred to other countries without adequate protection. The powers I have described give the Information Commissioner the ability to investigate any conceivable breaches by the board in so far as they are breaches of the data protection principles. In conclusion, it is hard to understand what powers the amendment would give the Information Commissioner that he does not already have or need with respect to the board. He can require from the board any information required for determining compliance with the data protection principles. The board must comply, otherwise the Information Commissioner can take steps to enforce compliance. The data protection principles provide an overarching framework which covers many aspects of data processing. The Information Commissioner’s power is not only with regard to specific cases where complaints have been made—a very important point. The Information Commissioner does not require the board’s consent to exercise these powers. The noble Earl, Lord Northesk, played a full part in the significant discussion in the proceedings of the Serious Crime Bill about the power of the Information Commissioner to assess data processing. That Bill was very different from this one. Even the noble Baroness, Lady Noakes, suggested that this Bill was a teddy bears’ picnic compared with the Serious Crime Bill. The data-sharing aspects of the Serious Crime Act have very different purposes to those in this Bill. The amendment in this form was not appropriate in the Serious Crime Bill, and it certainly is not appropriate here. I hope that the noble Earl will feel that he can safely withdraw the amendment on the clear assurance that we have thought through the very important aspect of the role of Information Commissioner with regard to the large amount of personal data that the board will inevitably control and that the House can be satisfied that the Bill adequately provides the necessary powers for the Information Commissioner to safeguard citizens’ rights.