Clause 151
9:00 am
David Howarth (Cambridge, Liberal Democrat)
The Committee now turns to the data-sharing provisions of the Bill. Later we shall discuss the highly controversial clause 152, which grants extraordinarily broad powers to Ministers to allow data sharing. Before that, however, there is an issue of great importance to the Information Commissioner that has not received as much publicity: the extent of the powers of the Information Commissioner to regulate the holders of data. It is often said that information is power. That starts with data; data are, to some extent, potential power. The regulation and proper use of data and upholding the safeguards in the Data Protection Act 1998 and the eight principles of data protection are important functions of the Information Commissioner.
Clause 151 helps the Information Commissioner by introducing assessment notices. An assessment notice is a method whereby the commissioner can require information from holders of data to ensure that they are complying with the principles of data protection. There are, however, two problems with the clause—problems that the Information Commissioner has pointed out. First, the power to issue an assessment notice covers only the public sector. Secondly, there appears to be a gap in the clause, in that it does not provide for any enforcement power.
Amendment 105 would remove the restriction whereby assessment notices apply only to Government Departments and public authorities. It should be removed because the power that holding vast amounts of data gives is not restricted to the public sector. We have only to think about Google, Tesco or the banks to realise that private organisations hold vast amounts of data, which could be misused, either deliberately or, as is more likely, accidentally. People who are locked out of their own bank accounts and unable to purchase utilities from privatised utility companies are in as bad a position as people whose data are interfered with in a way that removes them from, say, benefits lists.
The powers granted to the commissioner should apply to those vast private sector organisations as well. Over the past generation, we have seen a lot of privatisation of public services or at least contracting out of public services to either the private or voluntary sector. Under the clause, those organisations would not be covered because they are not public authorities or Government Departments.
The Information Commissioner points out that the majority of complaints about violations of the principles of data protection are not directly against Departments or public authorities, but the rest of the economy in the private or voluntary sector. Amendments 105 and 106 would deal with that problem.