Indeed. It is entirely appropriate that if we have the ability to demand information, there should be an explicit corresponding responsibility to protect it. I did not feel that that was explicit enough when we discussed the matter in part 1. The Data Protection Act powers are there—speaking of long Committees, the Committee on that Bill was 10 times as long as this one, mentally, if not in actual time taken—but they are not in the common usage required for there to be immediate recourse for people if their data have been leaked.