Identity Cards Bill

I shall go very carefully through the various amendments and their implications, and the effect of the clause. I apologise in advance for any imperfections in my explanation. I am sure that the noble Baroness, Lady Scotland, will put them right when she reappears at the Dispatch Box at some later stage. Amendment No. 55, which relates to Clause 2(4), would require us to notify any person who is registered under that clause with details of his entry. The noble Baroness, Lady Anelay, said that the amendment is very simple, adding that it is not an unreasonable request. On the face of it, the amendment does appear to be very simple and not unreasonable. However, the amendment contains no exceptions to the requirement. In our view, it is unnecessary and inappropriate to add specific provisions to the Bill in this way. It is important to appreciate that even verification of information on the register would be caught by the effect of the amendment, as any verification would technically count as an entry on the register. By the later stages of the programme, the amendment could require approximately 500 million notifications per year to be sent out to individuals. A lot of discussions about cost have taken place in your Lordships’ House during the progress of this Bill, but it would not be going too far to say that the effect of this amendment would present the agency with very significant cost implications. In many cases, an entry will have been made at an individual’s own request. The Data Protection Act already lays down general rules on notification rights; that is, fair collection principles which require data controllers to inform data subjects of, among other things, the purposes for which information about them is being held. To that extent, we argue that the amendment is unnecessary. The rules under the Data Protection Act have been carefully considered, and drafted in view of the underlying EU directive. It has already been made clear that the DPA will apply to the ID cards scheme. The Act leaves a certain amount of discretion within the data-controlling authorities when it comes to notification. The obligation to notify applies only ““so far as practicable””. For example, it may not be practicable to notify someone whose details have been added to the register on deportation to prevent re-entry. Why would that be practicable? Nor does the obligation to notify apply in situations where the exemptions relating to national security and the prevention and detection of crime are applicable. The majority of people will of course know that they are registered, as they will have applied for and have been issued with an ID card. However, any person concerned that they may have been registered without their knowledge would have data-subject access rights, under the Data Protection Act. The Data Protection Act does not impose an absolute obligation to notify. It is sensitive to matters such as national security, as well as practicalities. We argue this Bill should not provide otherwise. In other words, it should not depart from that fundamental principle. Amendment No. 167 is, as the noble Baroness advised us, a probing amendment. However, it will place a requirement on the Secretary of State to send a copy of the information held against an individual’s entry to the individual’s address at least once every two years. Amendment No. 80 is similar, in that it gives the individual the right to request a copy of their record, including details of all the verifications. It also states that individuals may be provided with this free of charge, as long as they do not make more than one request per annum. These amendments would place a large and costly administrative burden on the new agency. It has been estimated that once the register is fully populated, approximately 20 million records would have to be sent out every year if, as in Amendment No. 167, the Secretary of State was obliged to send each individual a copy of their record at least once every two years. In Amendment No. 80 the numbers could be even greater, as each individual is entitled to a free copy of their record once every year. I recognise that noble Lords have concerns about how an individual will be aware of the information that is held about them on the national identity card register, and that those concerns also relate to the duty of the individual to keep their entry updated. However, the two main changes that will need to be updated are first, one’s address, and secondly any name changes. We accept that there will be individuals who change nationality or gender, and even those who need to amend their date of birth, but in essence name and address changes are going to form the bulk of updating information requests. These changes are those which the agency will have been notified of by the individuals themselves; therefore we see no need for the agency to send individuals a copy of the information held on them every two years, as the information came from them. It will be made clear on registration which changes of circumstance need to be notified. For example, only addresses used for three months or more will need to be notified. The obligation to notify of errors obviously applies only to errors of which the person concerned is aware. There should be no room for doubt about what the obligations are. In addition, use of the verification services will encourage people to ensure that their record is up to date. Amendment No. 187, similar to Amendment No. 55, would place a duty on the Secretary of State to provide all or any details requested by an individual included on the register, where those details relate to his own entry. Again, we believe that the amendment is unnecessary. The provisions of the Data Protection Act apply to the database in the same way as to any other database. There is no attempt to exclude or modify subject access rights under Section 7 of the Data Protection Act. Anyone will be able to apply for a copy of their entry on the register and will have a right to be provided with it, subject only to the exemptions contained in the Data Protection Act. I do not believe that an absolute right to receive all the information, as proposed by this amendment, would be desirable. For example, if information had been provided to the police for a continuing investigation into serious crime, this fact would be recorded under paragraph 9 of Schedule 1 and could be monitored by the scheme commissioner, but it would not be appropriate or in the public interest to reveal that fact to the individual under investigation. In addition to formal subject access rights under the Data Protection Act, it is planned that an individual will be able to read his card and register entry easily. For example, we expect to offer a service whereby an individual could read the information held on his entry securely via the Internet. Individuals will be able to check the detail of their entry on the register and information regarding verification requests made against it in the previous six or 12 months via a secure web portal—and this will be free. Individuals will also be able to telephone the call centre to check their details, which will be free to the individual, apart from the cost of the phone call. A full subject access request under the DPA would be subject to the reasonable fee allowed for by that legislation, which is currently £10. Although plans have not yet been finalised for requests of information held on the register which are not done via the Internet, it is apparent that they—unlike Internet checks—incur expenditure in terms of human resources to carry out the check. There would be little difference between a manual limited check and the full subject access request under the Data Protection Act in terms of resources used. It is the case that the Internet is becoming more widely available, with many public facilities, such as libraries, offering access. I stress again that no decision has been taken on this, but it is clearly appropriate for the Secretary of State to have the facility to levy an appropriate charge for offline inquiries. I apologise for the length of my response, but I believe that it has probably answered most of the points that were made in the opening comments. For all those reasons, I suggest that the amendment should not be pressed to a Division.