PARLIAMENTARY DEBATES

HOUSE OF COMMONS

OFFICIAL REPORT

First Standing Committee on Statutory Instruments, &c.

DRAFT DATA PROTECTION (REGULATION OF FINANCIAL SERVICES ETC.) (SUBJECT ACCESS EXEMPTION) (AMENDMENT) ORDER 1992

Tuesday 14 July 1992

LONDON: HMSO

£7·50 net

Members who wish to have copies of the Official Report of Proceedings in Standing Committees sent to them are requested to give notice to that effect at the Vote Office.

No proofs can be supplied. Corrigenda slips may be published with Bound Volume editions. Corrigenda that Members suggest should be clearly marked in a copy of the report—not telephoned—and must be received in the Editor's Room, House of Commons.

not later than

Saturday 18 July 1992

STRICT ADHERENCE TO THIS ARRANGEMENT WILL GREATLY FACILITATE THE PROMPT PUBLICATION OF THE BOUND VOLUMES OF PROCEEDINGS IN STANDING COMMITTEES

© Parliamentary copyright House of Commons 1992 Applications for reproduction should be made to HMSO

HMSO publications are available from:
HMSO Publications Centre HMSO Bookshops HMSO's Accredited Agents
(Mail, fax and telephone orders only) 49 High Holborn, London WC1V 6HB (071) 873 0011 (Counter service only) (see Yellow Pages)
258 Broad Street, Birmingham Bl 2HE (021) 643 3740 and through good booksellers
PO Box 276, London SW8 5DT Southey House, 33 Wine Street, Bristol BS1 2BQ (0272) 264306
Telephone orders 071–873 9090 9–21 Princess Street, Manchester M60 8AS (061) 834 7201
General enquiries 071–873 0011 16 Arthur Street, Belfast BT1 4GD (0232) 238451
(queuing system for both numbers in operation) 71 Lothian Road, Edinburgh EH3 9AZ (031) 2284181
Fax orders 071–873 8200
Printed in the U.K. by HMSO

1

The Committee consisted of the following Members:

Chairman: MR. ALAN HASELHURST

Baker, Mr. Nicholas (Dorset, North)

Bayley.Mr. Hugh (York)

Boyce, Mr. Jimmy (Rotherham)

Burden, Mr. Richard (Birmingham, Northfield)

Byers, Mr. Stephen (Wallsend)

Campbell, Mr. Ronnie (Blyth Valley)

Cann, Mr. Jamie (Ipswich)

Fox, Sir Marcus (Shipley)

Lloyd, Mr. Peter (Minister of State, Home Office)

Maclennan, Mr. Robert (Caithness and Sutherland)

Randall, Mr. Stuart (Kingston upon Hull, West)

Stanley, Sir John (Tonbridge and Mailing)

Stern, Mr. Michael (Bristol, North-West)

Sumberg, Mr. David (Bury, South)

Temple-Morris, Mr. Peter (Leominster)

Tracey, Mr. Richard (Surbiton)

Wells, Mr. Bowen (Hertford and Stortford)

Whitney, Mr. Ray (Wycombe)

Dr. P. C. Seaward, Committee Clerk

2
3 First Standing Committee on Statutory Instruments, &c. Tuesday 14 July 1992

[MR. ALAN HASELHURST in the Chair]

Draft Data Protection (Regulation of Financial Services etc.) (Subject Access Exemption) (Amendment) Order 1992

10.30 am

The Minister of State, Home Office (Mr. Peter Lloyd): I beg to move, That the Committee has considered the draft Data Protection (Regulation of Financial Services etc.) (Subject Access Exemption) (Amendment) Order 1992. After that lengthy start, the Committee would probably like me to be brief. This complicated order will achieve a comparatively simple objective. The Data Protection Act 1984 gives data subjects a general right of access to information held about them. However, the Act permits exemptions for the purposes of the prevention and detection of crime. The order will extend that exemption specifically to the operation of TAURUS—transfer and automated registration of uncertified stock—which is the new stock exchange paper-free transfer system.

10.31 am

Mr. Stuart Randall (Kingston-upon-Hull, West): The Minister said that the order will extend powers to the authorities to tackle crime. No member of the Committee would quarrel with that aim; we are all for it. However, the backcloth to this subject is the introduction of exemptions and extended functions for what the Government have always described as very good reasons. Although the Opposition accept that access and intelligence is necessary to reduce crime, we are a little concerned that such orders come before the House from time to time with very little justification. We are always told that the Secretary of State, in his wisdom, has made a decision, but none of us has the faintest idea what it is really all about. It would not be unreasonable for us to have at least a scintilla of understanding of the order before we approve it. It will provide organisations—perhaps, computer companies—with extensive powers, which can involve restricting an individual's access to information about himself. That is what the exemption is about. I should like to understand more clearly what the order is all about and why the Government think it is necessary to increase the powers again. One should consider the order against the backcloth of a fairly strong move towards the introduction of a freedom of information Act. That subject is wide of our debate and I shall not go down that path, Mr. Haselhurst, as I know that you would drop on me like a ton of bricks if I were to attempt to do so. However, that is the context in which the Committee should view the order. The Minister mentioned TAURUS and the stock exchange, but we do not know which body the order will apply. I am worried about the role of the Data Protection Registrar. He is supposed to be consulted, but he does not 4 have any investigative powers. Therefore, if the Government present the registrar with a case for greater restrictions being put on individuals, I imagine that he would simply respond by saying that he could see no reasons for not extending them. That the registrar can consider the matter only in those terms worries me. We are discussing self-regulating organisations. Where will the matter end? The order is just one order relating to exemptions. Who will be the next group of people to be affected? I stress that Opposition Members unquestionably support any efforts that are made to reduce crime and corruption, especially within the financial services industry. It would be irresponsible for us to do otherwise. However, it seems that the order would be compromising or prejudicing the freedom of the individual. We want to strike a balance. Given the sort of protection provided by the Data Protection Registrar, in that he does not have the powers to carry out such work, I am not satisfied that the right balance has been struck. Let us consider how the order will work within an EC context. The financial services sector is growing daily at an alarming rate. Data bases and share-dealing schemes in stock exchanges throughout the world are becoming more international in their nature. Will the powers that we are giving under the order to the authority be national powers, or will the authority work in conjunction with regulatory authorities in EC and other countries? It will be useful for the Committee to understand the scope of the order and to know whether its disciplinary functions will transcend national boundaries. What about the role of the security services, which I regard as totally unaccountable? Will information be given to them, especially the MI6 part that deals with international transactions and economic matters? Would that utterly unaccountable organisation be able to take advantage of those powers? I suppose that the Minister will say that that is not a matter for the Committee, because it is one of national security. However, it is worth while asking him such questions. The backcloth to our argument is balance. For far too long this country has been too secretive. If we compare such functions with those carried out in Canada, Australia and the United States of America, for example, we would find that we are a highly secretive country and that we have a propensity to restrict individual freedom in the context of national security at the expense of the individual. The problem is that none of us in the Committee has a clear enough understanding of the consequences of the functions and whether they are overly or sufficiently comprehensive. We can make no judgment on that, so I hope that the Minister will enlighten us.

10.40 am

Mr. Hugh Bayley (York): I am of average intelligence. I am not the brightest in the world nor the most stupid. In the fullness of time after I have been summoned to the Whip's Office for some terrible misdeed and put on to another Committee such as this, I may take to statutory instruments like a duck to water. However, as a newcomer to the House, the order and the explanation for it are as clear as mud and custard to me. In a court of law, ignorance of the law is no defence. The law should be phrased in such a way that the man or woman in the street, who is of average intelligence, can understand what it is all about. 5 I associate myself with the remarks of my hon. Friend the Minister for Kingston upon Hull, West (Mr. Randall) that we need a law to cover such crimes. However, it must be a clear law so that society understands what it covers. Will the Minister assure me that, if civil servants in his Department receive performance related pay, they are not paid according to the number of brackets they insert into the title of an order? If the law is to be efficient, it must be clear. The order has been phrased in such a way that the average person would not understand what it does.

10.41 am

Mr. Peter Lloyd: A number of points have been made. The hon. Member for Kingston upon Hull, West was concerned about the order's impact on civil liberties. I appreciate and understand that concern and the hon. Gentleman is right to express it. He said that he did not have the faintest idea of what the order would empower the TAURUS authorities to do in its narrowly directed provisions on the new paper-free system in the stock exchange. He also said that he had not a scintilla of understanding about the order. The hon. Gentleman does himself an injustice because I know that he understands the issue far better than he allows and because the Labour party has been extremely interested in the issue of fraud and malpractice, especially in the City, and argued that those who indulge in it should be brought to book. Alas, in order to bring people to book sufficient information has to be garnered to stand up in court to ensure that a prosecution is successful. Such information needs to be collected and stored until there is sufficient for the prosecuting authorities to act. If those guilty of malpractice were able to apply at regular intervals for all the information available about them under the Data Protection Act 1984, they would see where the collected information was heading and have plenty of opportunity to cover their tracks. In some cases, they may also be able to detect from where the information had come and block up that particular source. The need to maintain honest procedures means that the police and other regulatory authorities, that were either approved or established by the House, must hold information that they do not make available. The 1984 Act makes it clear that information may be withheld only in certain specific circumstances. In the case of the order, the circumstances relate to the detection and prevention of crime. Information may be withheld for that purpose only. The hon. Member for Kingston upon Hull, West rightly expressed concern that the regulatory authority will determine what information falls into that category. He also wondered whether the Data Protection Registrar has sufficient powers and a sufficient role. First, the registrar has been consulted about the order and he is happy with its nature. Secondly, he has powers of investigation on his own initiative. A data subject who has applied for information that has been withheld, will be told that he has received all the information that, by law, the authority has been obliged to give him. If, at that point, he is dissatisfied with the implication that some information has not been revealed, he may complain to the registrar, who will look to see what is being withheld, to satisfy himself whether it is being withheld as allowed under the 1984 Act, or where the authority—in this instance, the regulatory body—has been given specific authority under the order.

6

Mr. Randall: I am sure that the Minister is right—I would not question that now. However, I suggest that the Data Protection Registrar's files are massive. The few people in that office do not have the scope and power to carry out those tasks. The reality is that the registrar's powers are extraordinarily limited. The amount of information is massive compared to the number of staff.

Mr. Lloyd: The registrar' powers are not limited. He may investigate, and has to satisfy himself that sufficient information is available to enable him to make a proper judgment. The hon. Gentleman mentioned staff. Of course, when the order comes into effect, it will have an impact on the work that might have to be done. It then behoves the Government to ensure that the registrar has the necessary resources. The hon. Gentleman can be quite sure that the registrar is not slow in saying what his needs are. The Government would not be interested in an order like this unless it was to be satisfactorily policed, which is important. Although I cannot give the hon. Gentleman the assurance that the registrar will have everything that he asks for whenever he asks for it, I can assure him that it is open to the registrar to make those applications. The authority and responsibility in the totality of TAURUS, and the rules governing it, lies not with the Home Office, but with the Treasury. We are concerned to see that the registrar can do his job properly. I agree with the hon. Gentleman; it is important that he can. The hon. Member for Kingston upon Hull, West also asked about the international significance of the order. The order fits properly under the 1984 Act. Indeed, that is part of its authority. The 1984 Act enables us to satisfy the 1981 EC directive. We needed to satisfy that directive to ensure a proper exchange of information throughout the Community. The proper and necessary exchange of information is not diminished by the order. The purpose of the law is to enable that to happen in the EC under proper rules that everyone can understand. I have enormous sympathy with the hon. Member for York (Mr. Bayley). Orders, Bills and amendments are usually immensely complex, and sometimes seem to be unnecessarily so. However, when I put the wet towel round my head and examine them closely, I usually find that if they were written more simply, loose ends would be left that would be readily exploited by others who employ lawyers to put wet towels around their heads. That is why I began the debate with a short explanation, which I hope was clear. I hope that, when my contribution is read, it will prove to be clear. As I said earlier, the objective is narrow. We hope that the new stock exchange paper-free transfer system will come into operation later this year. The provision will allow the appropriate authorities, which are set up properly with rules approved by the Treasury, to have an exemption with regard to a narrow range of information — that which is necessary. I repeat that because it is the kernel of the order. It will enable information to be withheld when that is necessary for the prevention and detection of crime — in most cases, financial fraud. That must be an objective of all members of the Committee. There will be a diminution of individual rights, but I believe that those rights are well protected by the registrar, with adequate resources.

7

Mr. Richard Burden (Birmingham, Northfield): I understand the need to prevent and detect crime. The primary purpose of the 1984 Act was to protect the individual, and I understand that in past debates on similar issues the Government have emphasised the need to strike the correct balance between protecting the rights of the individual and preventing and detecting crime. We have discussed the powers of the Data Protection Registrar in checking out whether a piece of information is correctly withheld, but I would appreciate more information about that matter. The 1984 Act dealt with the accuracy of information. It is possible that the Data Protection Registrar will be satisfied that the subject matter is suitable for withholding, but that the accuracy of that information might be questionable. What rights to redress will the individual have under the order?

Mr. Lloyd: That is an interesting point. I agree that the primary purpose of the 1984 Act was to protect individuals. The exemptions are necessary to ensure that criminals are not protected as well. The hon. Gentleman asked what protection the individual would have if the exempted information was wrong. As the information is exempted because it relates to the investigation and prevention of crime, its final use, should it be used, will be to support a prosecution in court. The correctness of the information will then be tested, as evidence is always tested in court. I made an error earlier: I referred to a 1981 EC directive that led to the 1984 Act. In fact, it was a Council of Europe convention, which means that it covers more countries than would a directive. I hope that my answer gives the hon. Gentleman some satisfaction. Of course, the information cannot be tested until it is used; then it can be tested very thoroughly.

Mr. Jimmy Boyce (Rotherham): Something rankles me. I suppose that I should not subscribe to the conspiracy theory, but how can we have confidence that self-regulatory bodies will bring crimes out into the open? Crimes could be covered up with a nod and a wink. Perhaps I do not understand the matter as well as my hon. Friend the Member for York, but crimes could be covered up as a result of the order. Can the Minister explain what guarantees we have that all will be clean and that crimes will not be covered up by nods and winks?

Mr. Lloyd: I do not know whether the hon. Member for Rotherham (Mr. Boyce) is questioning Parliament's decision to set up regulatory bodies, especially in financial spheres. If he is, he is in a small minority as it is generally accepted that such regulatory bodies are necessary. They operate under rules or general guidance laid down by the House. None of the rules is a matter for me or the Home Office. They have been the responsibility of the Department of Trade and Industry and, in this respect, they belong to the Treasury, to which specific question are best directed. The answer to the hon. Gentleman's question is in the rules that are set and in the individuals who oversee the application of those rules to the regulatory bodies. In this case, the final assistance to achieve the end that the hon. 8 Gentleman wants is the wide-ranging powers of the registrar. The registrar must satisfy himself that the law is generally being observed and that any complaint to him that that is not so is investigated thoroughly and fully. It is up to him what action he should take. The registrar is alive to his need to defend the individual and to ensure that regulatory bodies do not retain unnecessary information or misuse the information that they may properly keep to themselves.

Mr. Burden: I shall press the Minister more on the point that I raised. Of course, I understand that the accuracy of information can be tested if a case goes to court. My worry is that if an investigation is not pursued as far as a court, information can still be held and the right of the individual to have access to that information can be restricted. What are the rights of the individual in such cases? For instance, if a case does not go to court will the registrar be expected to review the restrictions to find out what is being withheld and whether it should be withheld. Should the registrar make a new decision if information is out of date or if its accuracy has not been checked? I should like the Minister to clarify those points.

Mr. Lloyd: The rules are for the House, not the registrar. The registrar has to satisfy himself that the regulatory bodies exercise exemptions as laid down by Parliament. As I have said, the registrar has general powers of investigation. In such cases, his ability to investigate complaints is especially valuable. If a data subject suspected that information was being withheld, the implication would be clear: the regulatory body would say that it had produced all the information required by law and, if the data subject's suspicions were real, he could ask the registrar to look into the matter. Therefore, we rely on regulatory bodies, established by orders and legislation passed by the House, and on the registrar to keep an eye on the way in which the bodies use their powers and to investigate complaints. It is always possible that a group of people will be totally incompetent, but it is not entirely possible to protect against that by any rules or sets of appointments. The only way to ensure that the files never contain inaccurate information is to ensure that every person has access to every piece of information held about them. The hon. Member for Northfield would then express doubt as to whether every piece of information had been revealed. If everyone has access, the wheel comes round full circle and that would enable people engaging in criminal activities or malpractice to cover their tracks before there is sufficient evidence to prosecute them successfully.

Question put and agreed to.

Resolved, That the Committee has considered the draft Data Protection (Regulation of Financial Services etc.) (Subject Access Exemption) (Amendment) Order 1992.

Committee rose at one minute past Eleven o 'clock.

9

THE FOLLOWING MEMBERS ATTENDED THE COMMITTEE:

Haselhurst, Mr. Alan (Chairman)

Baker, Mr. Nicholas

Bayley, Mr.

Boyce, Mr.

Burden, Mr.

Byers, Mr.

Cann, Mr.

Fox, Sir Marcus

Lloyd, Mr. Peter

Randall, Mr.

Stanley, Sir John

Sumberg, Mr.

Temple-Morris, Mr.

Tracey, Mr.

Whitney, Mr.

10