Serious Crime Bill [HL]

moved Amendment No. 103: 103: Clause 61 , page 32, line 23, at end insert— ““( ) The Secretary of State shall lay before Parliament codes of practice relating to— (a) anti-fraud organisations specified under this section; and (b) data sharing and disclosure for which provision is made by this section.”” The noble Baroness said: As we have just discussed, Clause 61 confers powers on a public authority to disclose any kind of information as a member of a specified anti-fraud organisation or otherwise in accordance with arrangements made by such an organisation for the purpose of preventing fraud. Amendment No. 103 would insert a new subsection into Clause 61 to ensure that the Secretary of State will lay before Parliament a code of practice relating to, "““anti-fraud organisations specified under this section; and data sharing and disclosure for which provision is made by this section””." The aim of the amendment is to discuss how the sharing of information operates, the safeguards that are in place, and to raise concerns expressed about the lack, so far, of a code of practice. That theme runs through several amendments. I thank those involved in the national fraud initiative at the Audit Commission and the Bill team for providing a briefing on their work to my researchers on Monday this week. I say ““my researchers”” very grandly. There are four researchers in the Opposition Whips Office, two of whom went on a familiarisation visit to the Audit Commission. The four people work for the entire Front Bench, so 32 of us share four researchers. I am explaining for the benefit of the taxpayer that I do not have ahuge resource of researchers. Two of them receivedan extremely helpful briefing from the Audit Commission. I have been offered a similar briefing which I intend to take advantage of after the Easter Recess. We are looking at dates for that. The Government have cited CIFAS, the UK fraud prevention service, as the type of body they will designate under this clause. The Bill effectively enables public authorities to join such a body if they wish to enable them to risk assess applications for services on the basis of the information exchange. The Minister has suggested that there could be substantial savings from this measure, citing between £137 million and up to £273 million a year. From what we have been advised, I understand that the information can be used only if it is in electronic form. Can the Minister indicate whether our understanding is correct and whether there are files that cannot be included because local authorities, among others, may still file them on index cards rather than on computers? What cost would be involved should they have to computerise to take part in this work? There is some concern that the sharing of data will include the sharing of sensitive personal data such as medical records—an issue on which we feel very strongly, as the noble Baroness will recall, when we discussed the setting up of the national identity register during the debates on the Identity Cards Bill. One can only look at benefit fraud as a potential example. Provisions of this Bill would enable details of benefit fraud to be shared with mortgage lenders, and suspicious activity reports from the private sector could be matched with data held by the Inland Revenue authorities. One assumes that the Department for Work and Pensions, the Passport Office and the DVLA would all come into play; they would all be pooling information in some way. As I understand it, there are no exclusions for the type of personal data requested for data-matching exercises run by the Audit Commission. So, as such, presumably they could cover sensitive personal data. Could the noble Baroness explore that and give us some reassurances on it? I understand that the Audit Commission may be selective in the data it uses, but can the Minister confirm if this data may include sensitive personal data as well as non-sensitive data? Unlike the data-matching requirements, there appears not even to be a provision for a code of practice covering this aspect of data sharing, yetany member of staff who tips off the Information Commissioner or the press is treated as if that member of staff had alerted the individual under suspicion and, under the provisions of Clauses 62 and 63, could face two years in prison. Will the noble Baroness explain whether that is the case, and if so, why? I anticipate that the Minister may argue that this clause aims to fill a gap, to top up data-sharing provisions without prejudicing the bodies and organisations that already have the power to do so. As such, a code of practice in the Bill would cover only those who choose to take advantage of the gateway itself. As the Minister highlighted at Second Reading, there is no compulsion in the Bill—yet—to participate. In which case, the question is how can we be certain that all members of the bodies specifiedin this section—the complete list which is as yet unknown—will adhere to the same principles and operational practical steps of carrying out the work? It is essential that we get the administrative detail of privacy issues right. The Committee will recall that, back in 2005, the PIU report stated that there were, "““signs that public concern about privacy [were] on the rise—both in the public and private sectors””," and that while, "““there is a huge potential to make better use of personal data to deliver benefits to the public … this will only be realised if the public trusts the way the public sector handles its personal information—which means meeting their rights and legitimate expectations of the protection of personal privacy””." That is certainly a wise observation. I am sure that that case will be put forward very well by my noble friends Lord Northesk and Lord Lucas when they speak in more detail to their amendments. However, if the disclosure of information and information sharing will be able to happen across such a wide variety bodies, surely it is exactly why we need a code of practice—to ensure transparency and accountability. I beg to move.