Identity Cards Bill

The noble Baroness has kindly explained her amendment, which she has described perfectly well. I shall try to explain why we think the clause should stand as it is. The clause is specifically drafted to allow the Secretary of State to notify the person or organisation who provided the information as part of the identity-checking process if any subsequent inaccuracies or omissions were discovered in the information they had supplied. This will enable us, in circumstances where an organisation has provided information we believe is inaccurate or incomplete, to alert that organisation to that fact. As a result, we can help ensure that information held by other organisations is accurate, which will assist us in our fight against identity fraud by ensuring that those who try to avoid identification by using slightly different details will find it harder to do so. In order to comply with the aspect of the first data protection principle that requires that information be processed fairly, the Secretary of State will have to notify data subjects of, among other things, the purposes for which data will be processed. In practice, that will mean that at the outset, probably on the application form, an explanation will be given of the power to carry out cross-checks under Clause 21. However, the Data Protection Act, unlike the proposed amendment, does not oblige the Secretary of State to give notification of each occasion on which those powers are used. There are good reasons why we consider that it would not be appropriate to place the Secretary of State under such an obligation. In most cases, when processing an application form, the Secretary of State is likely to have the most recent and most accurate information about an individual. Where a discrepancy arises between that information and the information held on another database, that other database may well be out of date. It would then be a matter for the organisation holding that data to consider amending its records or making further inquiries of the individual. At that point, therefore, there is a good chance that the individual will be contacted. It is possible that the Secretary of State may have reason to believe that the information on the application form is inaccurate, and that data held by other organisations is correct. In those circumstances, it will be open to the Secretary of State to contact the individual concerned in order to try and clear up the discrepancy. A legal obligation to notify the data subject every time a cross-check is carried out, even where no discrepancy is revealed, would involve, I would argue, a disproportionate investment of time and cost on the resource. As we have outlined, where discrepancies arise, in practice, the data subject is likely to be contacted by one or other data controller. However, in some cases, to oblige the Secretary of State to notify the individual would be entirely inappropriate. It is quite possible that the reporting of inconsistencies may form part of an investigation of fraud. I am sure noble Lords would agree that in such cases as these we would not wish to alert that individual to the fact that their fraudulent activities were being investigated. Furthermore, this power is limited to validation of information that is, or could be, held on the register. There is no scope for it to be used in a way that would be surprising, or that would involve anything other than the usual identity information. I hope this explanation satisfies the noble Baroness, and I invite her to withdraw the amendment.