We now come to the second, complementary side of arrangements for greater data sharing of administrative information and the confidentiality rather than the disclosure side of the equation. The clause is important because it sets out some of the safeguards for privacy rights that are fundamental to ensuring that people who provide their information can have confidence that the data will be held securely.
The clause specifies that personal information—information identifying individuals or businesses, whether held by the board or passed by the board to others, directly or indirectly—is confidential, with criminal sanctions for anyone found to have unlawfully passed personal information to others or to have revealed personal information.
We discussed in earlier sittings the benefits to be gained from data sharing, and we will return to it in more detail from clause 44 onwards. I shall concentrate on the protections that we need to put in place. Although there is strong public interest in the greater sharing of administrative data, there is an equally important public interest in ensuring that the confidentiality of such data is properly protected. We have attempted to ensure that the Bill strikes an appropriate balance between those two objectives.
As the Government move to a greater era of data sharing—an era, rather, of greater data sharing—to deliver better, more responsive—[Interruption.] There is a little scoff from the hon. Member for Sevenoaks. If one wants better, more responsive and more personalised public services, an element of greater personal data sharing is required and inevitable. What is important in the matter of statistics is the safeguarding and disclosure of those data.
The hon. Gentleman makes a fair point. He picked me up on a slip of the tongue; rather than a greater era, I meant to say—I think I did correct myself—an era of greater information sharing. I am grateful to the hon. Gentleman for giving me the opportunity to make that crystal clear to the Committee.
In the future, in such an era—greater or otherwise—it will be essential that people are confident that their personal data will be handled appropriately. Statistical surveys often rely on people giving their information voluntarily and even when that is not the case, statisticians need complete and truthful responses on which they can rely and, indeed, on which we can all rely for further analysis.
A statistical system, therefore, needs strong confidentiality safeguards to give individuals and businesses confidence that their personal information will not be disclosed improperly to other partiesfor other purposes. A crucial part of the board’s maintaining its credibility in collecting, analysing and publishing data is that there is the highest protection of such personal information.
The Office for National Statistics—indeed, the Government’s statistical service generally—has a long history of maintaining data confidentiality and already securely holds information including that from census returns, information on employees’ earnings and data on businesses’ profits. However, we are taking the opportunity in the Bill to increase the confidentiality safeguards and sanctions on personal data. On safeguards, the data-sharing arrangements that we propose will be permitted only for statistical purposes, only where they are judged in the public interest and only where permitted by the Bill, including the specific exemptions in clause 36, or by orders under theBill. Any proposed extensions by order must havethe agreement of Ministers and, most importantly,the further scrutiny and agreement of Parliament or the devolved Administrations.
The Bill introduces a criminal sanction for the unlawful disclosure of information concerning both individuals and businesses—whether held by the board, on members and employees, or by anyone to whom the board has passed the data on—where that information identifies an individual or business or where it might allow someone to deduce their identity. The criminal sanction, which could be up to twoyears’ imprisonment, is an important addition to the confidentiality regime for personal information collected by the board. The confidentiality provisions are structured to allow both the sharing provided for within the clause—whether current or new flows—and the necessary exceptions in subsection (4).
I strongly support my hon. Friend’s argument and the provisions in the Bill for the protection of individual data. They are absolutely right, as is the strengthening of the sanctions, but will the Minister confirm that it would not be right for people looking at the sharing of data in the public interest or for statistical purposes to say, “Oh, I was scared by the sanctions, so I thought it was safest not to bother considering how to share that information. It was safer to say no.”? Their obligation will be to balance the pros and cons and to consider the public interest adequately. The balance needs to be there, and should be tough on both sides of the equation.
My right hon. Friend is right. A balanced judgment and a tough examination of both sides of the equation, as he put it, is required from the board, from Departments with which the board is discussing potential future administrative data-sharing arrangements and, ultimately, from Ministers. Parliament will have to scrutinise and agree any proposed extension of data-sharing arrangements, as well as make judgments on such arrangements and hold to account the cumulative decisions of Ministers and the proposals and operation of the board.
My right hon. Friend the Member for Cardiff, South and Penarth has brought me neatly on to consideration of the exceptions in subsection (4). We have heard in Committee and beyond the House arguments for restricting the exceptions, such as removing exceptions for court orders or in criminal investigations, as was proposed in some earlier amendments. I hope that hon. Members will see such proposals as unrealistic and wrong, but I appreciate that they may have been confused and misled by some of the briefings that they have received.
For instance, the Royal Statistical Society seems to have altered its position at different stages. When we first published the Bill, the society suggested that the confidentiality clause should be substantially reduced and simplified:
“so that all personal information collected under the authority of the Board...or transferred to the Board...must not be disclosed nor used for other purposes.”
That clearly does not strike the right balance. It probably then reviewed and refined its position when it commented on the Opposition amendments. The Society’s view was that data transfers were essential to support an efficient and effective statistical system. The key is to allow such transfers while ensuring that no breach of confidentiality will occur and that the data will be used only for statistical purposes. However, it said:
“amendments 155-174 will have some undesirable consequences.”
I think that the society has come now to a better, balanced judgment that I hope the Committee will want to take into account.
Clause 36(4) contains a list of exceptions, which draws on experience of existing practice, in the case of the Office for National Statistics, and on experience with confidentiality clauses in other legislation—for instance, the Commissioners for Revenue and Customs Act 2005.
It is not clear which exceptions or exemptions the hon. Lady is concerned about. We have made that list to strike the right balance, as I have described, between encouraging greater administrative data sharing, where that is in the public interest, and ensuring that the proper safeguards are in place, because that will also be a matter of public concern and interest. The list is drawn from the experience of the arrangements that the ONS already has in place and, as I have cited, in respect of our approach in other legislation. If the hon. Lady has specific concerns about particular exceptions, I hope that she will contribute to this debate.
The confidentiality clause works with the data-sharing provisions later in the Bill to ensure, first, that our existing data flows can continue, secondly, that specific extensions can be granted, subject to the strict safeguards that I have already outlined, and, thirdly, that there are stronger sanctions for disclosure, meaning that breaches of the confidentiality obligation are punishable by up to two years imprisonment. We have designed the clause to get a balanced approach that takes account of the need for flexibility in future data sharing and the need for reassurance about the basis on which any personal data might be used by the board.
In doing this, we were, as the Committee would expect, conscious of the human rights implications of our proposals and sensitive to the need to strike an appropriate balance between the wider public interest in data sharing and the rights of the individual. The data-sharing clauses and the confidentiality clauses are considered, as has been confirmed, to be compatible with convention rights. The board will be subject to section 6 of the Human Rights Act 1998, which provides that public authorities should act in a way that is compatible with convention rights. In making any disclosure permitted by provisions of the Bill, the board will have to consider the compatibility of such disclosures with convention rights.
Since the publication of the Bill, the Information Commissioner’s office has told the Treasury that the Information Commissioner, who now also deals with data protection matters—which may formally have been the responsibility of the Data Protection Registrar—welcomes the creation of a criminal offence for the illegal disclosure of personal information under this clause, which he believes should act as a significant deterrent. He also welcomes the measures in the Bill that aim to ensure that any personal information required by the board for the production of statistics is tightly controlled and used only for the purposes required to exercise its functions. Overall, I understand that the Information Commissioner welcomes the recognition in the Bill of the importance of ensuring that personal information is used only where necessary and that confidentiality is respected. That is, as I explained at the start, the very essence of the balance that we are trying to strike.
I hope that I have given a helpful explanation of our principled approach in framing the Bill in general and clause 36 in particular. I commend the clause to the Committee.
I am asking my hon. Friend tolook again at subsection (5) because its wording is infelicitous. The phrase grammatically qualifies the verb “held”, but I think that it was intended to qualify the noun “access”.
As my hon. Friend knows, I always try to avoid being infelicitous. If he feels that I have been, I am perfectly prepared to consider his point. It does not strike me immediately as apt, but I will reflect on it.
Welcome to the Chair, Sir John. I shall respond to a couple of the Financial Secretary’s comments. The Conservatives have not sought to press any of the amendments to this clause that we debated—rather unsatisfactorily, because of time constraints—on Tuesday evening.
I return to one of the exemptions in clause 36 to probe the Financial Secretary’s thinking a bit more. He set out clearly the sanctions and safeguards that will give people who pass on personal information to the board confidence about its use, and listed three circumstances in which that personal information could be used. One use is for statistical purposes. I think that we all agree that that is why the data will be collected in the first place, but I was concerned about the third exemption. After due parliamentary process, the data collected by the board could be used by another Department under the exemption in subsection (4)(a). It concerns me to wonder for what purpose such data might be used. If subsection (4)(a) were qualified by the words “for statistical purposes”, I could understand and accept it, but the exemption is broad. It applies to disclosures
“required or permitted by any enactment”.
I shall give a scenario to which I should like the Financial Secretary to say how subsection (4)(a) will apply.
In the 2011 census, data will be collected on the population of the UK—their address, personal data and date of birth. In theory, that census data could be used by enactment as a cross-check against the national identity database to see whether the database is complete. If people knew that that was the case, they might be rather reluctant to provide data for the purpose of the census.
I do not see anything in subsection (4)(a) that would preclude, subject to parliamentary scrutiny, the cross-checking of census data against the national identity database. What limits will apply to that provision? It is quite broad in its potential use and could apply toany future enactment or allow data to be released retrospectively without the consent of the individuals concerned. Will he explain a bit more about how he foresees the provision being used? There are later exemptions in the Bill that will allow information to be passed on to Departments for specific reasons, but it would be useful for the Committee to have greater clarity about the extent to which he believes subsection (4)(a) will be used.
My first concern is retrospection and whether information provided on the assumption that it will be confidential could be used for different purposes under a subsequent enactment. Can the provision be used for such purposes, or will there be no retrospection in that respect?
The hon. Lady’s concern will be dealt with by the requirements in the Bill to strike the appropriate balance between greater data sharing and protection of individual confidentiality and data. Both of these will be ensured by the safeguards and sanctions contained in the Bill. Any extension of data sharing arrangements will have to be set out very clearly in any subsequently proposed order and will be scrutinised by Parliament under the affirmative procedure—I have ensured that such matters will be dealt with that way. I expect that such arrangements will be carefully monitored by the board and, indeed, by the House as they are implemented. That should give the hon. Lady the reassurance she seeks and allay the concerns that may lie behind her question.
To the hon. Member for Fareham, I repeat what I said at the end of our last sitting, which is that there are no time constraints on consideration of the Bill in Committee. Happily, the parties reached a shared view on programming the Committee stage. As I explained on Tuesday evening, Government Members were prepared to stay as long as necessary to give proper scrutiny to the clauses we were then considering. Of course, if the hon. Gentleman thinks that he has not when debating previous amendments made points that in general terms relate to clause 36, it seems to me appropriate, with your indulgence, Sir John, that they debated now. I do not understand his reiteration that time constraints are an issue.
Subsection (4)(a) is in the clause simply to take into account other Acts of Parliament that this House may pass that may affect the arrangements in the Bill. The limits on the extent of subsection (4)(a) are, in simple terms, the limits that are set by this House under other Acts of Parliament. I think if the hon. Gentleman pauses he will recognise that that is necessary in the context of the Bill; otherwise it could have legal precedence over any other Act of Parliament and intent of this House expressed in legislation. When we consider some of the clauses that relate to the Registrar General, we will examine an example of existing legislation that sets out certain conditions in which data may be shared between the Registrar General and, for example, the health service—in that case, patient records. The purpose of subsection (4)(a) is to accommodate the circumstances that arise if Parliament passes legislation that is relevant to the data sharing arrangements in the Bill but that the Bill is not designed to override.
I hope with that explanation all hon. Memberswill be prepared to allow this clause to stand part of the Bill.
Briefly, my concern is that the board and the statistical process might be used as a conduit for information to pass to Government Departments in a way that the people who supplied the data would not expect. The board may be used as a conduit for information to flow that may be inappropriate in the light of the reasons why the data were collected in the first place. I still have concerns about that and it may be an issue that we return to on Report.