Serious Crime Bill [HL]

moved Amendment No. 110A: 110A: After Clause 65, insert the following new Clause— ““Sharing of information and data matching: assessable processing Section 22 of the Data Protection Act 1998 (c. 29) (preliminary assessment by Commissioner) has effect in respect of the sharing of information and data matching for which provision is made under this Part.”” The noble Baroness said: The amendment inserts a new clause after Clause 65 to enable the sharing of information and data matching under Part 3 of the Bill to be subject to assessable processing under Section 22 of the Data Protection Act 1998. My noble friend Lord Northesk, who is no longer in his place, is concerned that, 10 years on, the Data Protection Act may not be as robust as it should be, whereas the Minister has just said that the DPA remains with its full bite. As far as the Government are concerned, the DPA is robust and able to deal with matters. Section 22 enables the Secretary of State to designate particular kinds of processing that appear to be likely to cause substantial damage or distress to the data subject or otherwise significantly prejudice the rights and freedoms of data subjects as assessable processing. Proposals for that have to be submitted to the Information Commissioner before the processing can go ahead. As I understand it, the commissioner cannot forbid the processing, but he can issue a formal opinion to the controller and, presumably, if the controller does not take notice, after the processing starts he can take action to restrain the disapproved-of processing. That is not good grammar but the Committee will understand what I mean. Can the Minister confirm that no types of processing have ever been designated and, if so, why has none been so designated? Would it not be possible for the Secretary of State to designate both the disclosures to the private sector and the data-matching exercises as assessable processing, so that the commissioner could review the detailed plans before they go ahead? That would take advantage of an existing system and provision, which is surely exactly what Section 22 was intended to do. Interestingly enough, although there has apparently been no designation, I am advised that the activities of inquiry agents have proved to be a major problem. The Information Commissioner’s Office has published a report, What Price Privacy? The Unlawful Trade in Confidential Personal Information, which details the problems. One major example included records of information supplied to 305 named journalists working for a range of newspapers. The Government have accepted a recommendation of that report and I understand are now committed to imposing a prison sentence for offences of obtaining data unlawfully under Section 55 of the Data Protection Act. In response to the consultation paper, Increasing Penalties for Deliberate and Wilful Misuse of Personal Data, the Government stated that they are strongly committed to ensuring that there is robust protection for personal data. If that is the case, why did the Government not to take up the option to designate activities of inquiry agents under Section 22, as they originally intended? While I agree that, as I have mentioned before, tougher sentencing can be a deterrent, it is simply closing the stable door after the horse has bolted. We need to be proactive, in thefirst place, in protecting our personal data. I beg to move.