|
|
The Campaign for Freedom of Information |
Data Protection Bill
Report Stage, 2 July 1998
Amendments tabled by Richard Shepherd MP
A series of amendments to the Data Protection Bill were drafted by the Campaign for Freedom of Information and tabled by Richard Shepherd MP at the bill's report stage in the House of Commons on 2 July 1998. The amendments (which appeared as numbers 15-17 on the order paper) were all debated, but none of them was passed. This briefing explains their purpose.
|
Introduction The amendments reflect concern about a new prohibition on the release of information in clause 59 of the Bill. This will make it an offence for the Data Protection Commissioner (as the present Data Protection Registrar will be known) or her staff to disclose information about any identifiable business or individual, other than in very limited circumstances. The offence would be committed even if the disclosure caused no harm, for example, to commercial confidentiality. No such offence exists under the current Data Protection Act. The clause is likely to prevent the Commissioner from publicly identifying business which have been found to be misusing personal data about individuals, for example, by obtaining data through deception or selling private information for commercial purposes. The Commissioner may be unable to reveal that:
Equally, it may be an offence to reveal that:
The Registrar has herself expressed concern at this new provision, which she says may "require her and her staff to be unnecessarily guarded in future".1 The result may be both to deny the public information which it ought to have, and to undermine public confidence in the Commissioner's work by preventing her for explaining what action she has taken to deal with complaints relating to matters of public concern. The offence is not limited to disclosures likely to cause actual harm, but will be caused by any disclosure of any information about an identifiable business. This :
During the Data Protection Bill's Committee stage in the House of Commons, an amendment was tabled by Mr John Greenway to restrict the offence to information which "is potentially damaging". This was not accepted by the Government.4 The Government says that the new offence is required by the European Data Protection Directive, which states that national supervisory authorities must be subject to "a duty of professional secrecy". However:
The Government maintains that the restriction is not as serious as it appears because the Commissioner has a discretion to release information under Clause 51(2). This states:
However, precedent under similar provisions suggests that this may be of limited value. For example, the Health and Safety Commission and Executive are prohibited from disclosing information unless it is for the purpose of their functions5 but are also required to ensure that people concerned with matters relevant to the purposes of the Health and Safety at Work Act are "kept informed of, and adequately advised on" those matters.6 It interprets these two requirements restrictively, and says that it is prohibited from revealing information about individual premises unless to do so "would directly prevent risk...[or] is necessary to protect health and safety".7 Requests for information about identifiable premises from people who are not themselves in danger - including Members of Parliament, researchers and journalists - are usually refused. The explicit prohibition on releasing information about identifiable businesses is therefore likely to override the Commissioner's general discretion to release information, unless under clause 59(2)(c), disclosure is "for the purposes of, and is necessary for, the discharge of...any functions under this Act". It will be extremely difficult to demonstrate that a particular disclosure is necessary for any function under the Act. If the function can be discharged without the disclosure, the disclosure will not be necessary - and would be illegal. Clause 59(2) also permits disclosure in certain other limited circumstances, for example, where the information is publicly available already; the individual or business concerned consents to the disclosure; or where disclosure is made in connection with legal proceedings. It also provides a limited, and highly restrictive, public interest defence.
The proposed amendments The amendments would:
Amendment 15 Page 24, line 28, [Clause 40] at end insert:
Note Under clause 40(1) the Commissioner may serve an enforcement notice where it appears to her that a data controller is contravening any of the data protection principles.8 The notice may require the controller to take specified action or stop processing data. The amendment would require a register of such notices to be set up (new subclause 7A). The register would have to be available to the public free of charge at all reasonable times Certified copies of entries from the register could be obtained on payment of any prescribed fee. This is done by new subclause 7B, which applies the existing provisions of clause 19(6) and (7) which relate to the main Data Protection Register, to this new register. Those provisions are as follows:
The amendment would bring the Data Protection Bill into line with existing legislation such as the Environment and Safety Information Act 1998 and the Environmental Protection Act 19909 which require the establishment of public registers of enforcement notices about environmental and safety hazards. Subparagraph (b) of the amendment would allow the Secretary of State, by order, to require that other information relating to such notices be included on the register. This would allow the fact that a notice had been cancelled (under clause 41), or was the subject of an appeal (under clause 48) to also be recorded. It might also permit the person on whom the notice had been served to add a statement of explanation or mitigation to the register.
Consequential Amendment Page 41, line 4, [Clause 67], at end insert "section 40(7A)(b)" The preceding amendment would create a new order making power. This will require a consequential amendment to clause 67, which deals with the procedures by which orders are to be introduced. The amendment indicates that this order would be made under the affirmative procedure.
Amendment 16 Page 25, line 20 [clause 42] at end insert -
Note Under clause 42(1) a person who believes that he or she has been directly affected by any processing of personal data may ask the Commissioner for an assessment of whether the processing breaches the Act's requirements. After carrying out the assessment the Commissioner must inform the applicant "to the extent that he considers appropriate...of any view formed or action taken as a result" [clause 42(4)(b)]. However, while the applicant must be informed of the outcome, the Commissioner may commit an offence under Clause 59 by revealing the same information to any other person. Thus, even though there may have been a well publicised complaint about a particular practice, the Commissioner may not tell anyone (including a journalist, MP or another potentially affected person) about her findings. The amendment allows (but does not require) the Commissioner to make such disclosures. (However, a requirement may arise under the proposed Freedom of Information Act). The discretion is appropriate in this case, since where a complaint relates purely to the circumstances of an individual applicant, wider disclosure may not be appropriate. However, where the issue is of general concern, and affects large numbers of people, disclosure may be justified - for example, if it reveals that a bank is failing to safeguard personal data about its customers. (Note: There is no reason why the level of disclosure proposed in the amendment should be thought to contravene the "obligation of professional secrecy" required by the Directive, given that the Directive also provides that supervisory authorities "must help to ensure transparency of processing" [Recital 63])
Amendment 17 Page 36, line 44 [Clause 59]
Note A public interest test is available, under clause 59(2)(e), should the Commissioner (or a member of her staff) be prosecuted for an offence relating to the disclosure of information. The test is particularly restrictive. Amendments 17 and 18 both seek to remove some of the restrictive features. Clause 59(2)(e) provides that no offence is committed if:
This means that it would have to be established that:
It is hard to see why this public interest test should be set out so strictly, particularly as most of the Bill's other public interest tests are less demanding. For example, there is no requirement that the public interest be "substantial" before a newspaper can publish personal data, under the public interest test in clause 32(1)(b). Amendment 17 would remove the requirement that the disclosure be "necessary" and that the public interest be "substantial". The defence as amended would read:
Amendment 18 Page 36, line 44 [Clause 59]
This is an alternative to Amendment 17. It would delete the word "substantial" but retain the word "necessary". The amended provision would then read:
It is effectively identical to Amendment 46 tabled by the Home Secretary. Under the Home Secretary's amendment the provision would read:
The word "necessary" would remain a problem under both Amendments 18 and 46. A disclosure which was only "desirable" in the public interest, but not "necessary" would not be permitted, under these amendments.
Campaign for Freedom of Information, July 2, 1998
Endnotes
|
||||||||||||||||||||||||||||
