Select Committee on Delegated Powers and Deregulation Eleventh Report


ANNEX (continued)

DATA PROTECTION BILL [HL]

Clause 28

  17.    Clause 28(1) provides for an exemption from certain provisions of the Bill in particular circumstances in the contexts of crime and taxation. The clause 28(1) exemption is expressed to apply "in any case" in which the application of the provisions in question would be likely to prejudice any of the matters specified. But it is understood that it may be necessary in some circumstances, in view of the importance of the purposes set out in clause 28(1), to disapply those provisions otherwise than on a case by case basis. Clause 28(4), therefore, gives the Secretary of State the power to exempt personal data of a specified description from those provisions if required for the purposes set out in clause 28(1). As any such order would restrict the rights of data subjects, the affirmative resolution procedure is the appropriate parliamentary control (see clause 60(4)).

Clause 29

  18.    Under section 29 of the Act, the Secretary of State can make an order exempting from the subject access provisions personal data about the data subject's physical or mental health, and an order has been made in this respect: the Data Protection (Subject Access Modification)(Health) Order 1987 (S.I.1987/1903). Article 13 of the Directive preserves the availability of this exemption by granting Member States the discretion to "adopt legislative measures" to restrict the scope of the subject access provisions where necessary to safeguard "the protection of the data subject or of the rights and freedoms of others" (Article 13.1(g)). Accordingly, clause 29(1) gives the Secretary of State the power to make an order exempting from the subject information provisions (as defined in clause 26(2)) personal data relating to the physical or mental health or condition of the data subject. As such an order effectively removes or limits the rights of the data subject given to him under the Bill, the affirmative resolution procedure applies as it did under the Act (see clause 60(4)).

  19.    Under section 29 of the Act, a similar exemption to that outlined at paragraph 18 above can be made with respect to other categories of personal data relating to the carrying out of social work. One order has been made in this respect: the Data Protection (Subject Access Modification) (Social Work) Order 1987 (S.I.1987/1904). To retain equivalent provision, and as permitted under Article 13.1(g) as described above, clause 29(2) of the Bill gives the Secretary of State the power to make an order exempting from the subject information provisions personal data processed by certain public or voluntary bodies and relating to the carrying out of social work. There is an exception to clause 29(2) that the Secretary of State cannot make an exemption order unless he considers the subject information provisions would be likely to prejudice the carrying out of the social work. For the same reasons as apply to an order made under clause 29(1), any order made under Clause 29(2) will be subject to the affirmative resolution procedure (see clause 60(4)).

Clause 31

  20.    Clause 31 of the Bill provides an exemption for the media from the provisions of the Bill listed in clause 31(2), provided the conditions set out in clause 31(1) are satisfied. Part of the test for the exemption is found in clause 31(1)(b), namely that the data controller reasonably believes that publication would be in the public interest. When considering this limb of the test, regard may be had to the data controller's compliance with any relevant codes of practice with respect to the publication: clause 31(3). It is not possible or practicable to list on the face of the Bill the codes of practice that are to be taken into account, and a generic description purporting to define such codes was thought to be liable to invite abuse in practice. Consequently, a power has been given to the Secretary of State in clause 31(3)(b) to designate by order the relevant codes of practice which may be considered. Any such order will be subject to the negative resolution procedure (see clause 60(5)(a)).

Clause 37

  21.    By clause 26(4), the subject information provisions are given general precedence over enactments or other rules of law prohibiting or restricting the disclosure, or authorising the withholding, of information. That is not intended to be an invariable rule, however, and clause 37(1) gives the Secretary of State the power by order to exempt certain personal data from the subject information provisions (defined in clause 26(2)) where there are statutory restrictions on the disclosure of the information concerned. No such order can be made unless the Secretary of State considers it necessary for the safeguarding of the interests of the data subject or the rights and freedoms of any other individual that the statutory restrictions should prevail. This necessity test is included to give effect to the wording of Article 13.1(g) of the Directive. A similar provision exists in section 34(2) of the Act to vary the general rule established in section 26(4). Again, and following the Act, as the granting of an exemption involves the restriction of the rights of the data subject, any order will be subject to the affirmative resolution procedure (see clause 60(4)).

  22.    Paragraphs 18, 19 and 21 above relate to exemptions from the subject information provisions. Clause 37(2) gives the Secretary of State the power by order to enable disclosures to be made which would otherwise be in breach of the provisions of the Bill specified at clause 26(3), in circumstances to be specified in the order. This non-disclosure exemption is made subject to the same necessity test as is included for an order under clause 37(1), and thus the sense of Article 13.1(g) is transposed on the face of the Bill. Although the wording of this non-disclosure exemption is quite general, use of the power is circumscribed by the provisions of the Directive. Any order made under this clause will be subject to the affirmative resolution procedure (see clause 60(4)).

Clause 51

  23.    Clause 51(2) gives the Secretary of State the power to make an order making provision as to the functions to be discharged by the Commissioner as the designated authority in the UK for the purposes of Article 13 of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. An equivalent power is given in section 37 of the Act. An order made under clause 51(2) will be subject to the negative resolution procedure (see clause 60(5)(a)). This is the procedure currently specified in the Act.

  24.    Clause 51(3) gives power to the Secretary of State to make provision as to the co-operation by the Commissioner with the European Commission and with supervisory authorities in other Member States. The two particularisations set out in Clause 51(3)(a) and (b) bring on to the face of the Bill the provisions in the last sentence of the first paragraph and the second paragraph of Article 28.6 of the Directive. Any order made under clause 51(3) will involve provisions of an essentially administrative nature. The parliamentary control to be applied is the negative resolution procedure (see clause 60(5)(a)).

  25.    It is envisaged that the need to give effect to international obligations may in the future result in the Commissioner being required to assist other supervisory bodies in certain respects that are currently outside his remit. For this purpose, clause 51(4) provides for the Commissioner to carry out such data protection functions as may be specified in an order of the Secretary of State in this respect. The negative resolution procedure will apply to this order (clause 60(5)(a)).

Clause 64

  26.    Clause 64(3) contains a standard commencement order-making power, which is not subject to any parliamentary procedure.

Schedule 1 to the Bill

  27.    Paragraph 3(1) of Part II of Schedule 1 disapplies in certain circumstances the obligation on data controllers to provide certain information where they collect data otherwise than from the data subject. To come within the scope of the disapplication provisions, certain conditions set out in paragraph 3(2) must be satisfied together with any conditions specified in an order made by the Secretary of State. This power is taken pursuant to the discretion given by Article 11.2 of the Directive to the Member State to "provide appropriate safeguards". The order can only add further conditions to tests set out in the Bill, and will be subject to the negative resolution procedure by virtue of clause 60(5)(a).

  28.    Paragraph 4 of Part II of Schedule 1 gives the Secretary of State power to make an order which determines firstly what categories of data will constitute "general identifiers" and secondly, the conditions under which such a general identifier can be processed. Article 8.7 of the Directive gives discretion to Member States to determine the conditions, and as the conditions may vary from identifier to identifier and additional identifiers may be introduced in the future, it is considered appropriate to leave all of the conditions to be determined by order. Any order made under this provision adds to the protection already afforded to the individual data subject and accordingly the negative resolution procedure is to apply (see clause 60(5)(a)).

  29.    Provisions are made in the Directive with a view to imposing a measure of standardisation on the export of data to countries outside the European Economic Area. The eighth data protection principle therefore prohibits the transfer of data outside the European Economic Area unless that third country ensures an adequate level of data protection. Derogations from this prohibition are permitted by Article 26 of the Directive and are contained in Schedule 4 to the Bill. Paragraph 15 of Part II of Schedule 1 gives the Secretary of State a discretion to re-impose the prohibition (or impose conditions) on transfers which otherwise come within the derogations. It is anticipated that this power will rarely be used, but it is felt desirable to retain the flexibility afforded in this respect by Article 26.1 of the Directive which sets out the categories of available derogations "save where otherwise provided by domestic law governing particular cases". The negative resolution procedure is thought to be the appropriate control in this case, particularly as any order is likely to provide additional protection for the data subject by either prohibiting a transfer or bringing a transfer within stricter controls. Clause 60(5)(a) provides for such a procedure.

Schedule 2 to the Bill

  30.    The first data protection principle, and one of the fundamental concepts of any data protection regime, is the requirement for personal data to be processed fairly and lawfully. As well as establishing this principle, paragraph 1 of Part I of Schedule 1 goes on to prohibit the processing of any personal data in the absence of the satisfaction of at least one of the conditions set out in Schedule 2. Paragraph 6 of Schedule 2 specifies one such condition: the processing must be necessary for the purposes of the legitimate interests of the data controller or anyone to whom the data is disclosed. There is an exception to this provision where the processing is unwarranted by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

  31.    Paragraph 6 gives effect to the provisions in Article 7(f) of the Directive. The wording of Article 7 appears to be entirely mandatory, but when read together with Recital 30 to the Directive, discretion is given to Member States to specify circumstances in which some processing is or is not to be taken as satisfying the conditions in paragraph 6. Accordingly, paragraph 6(2) of Schedule 2 gives the Secretary of State power by order to specify such circumstances, thus effectively giving the Secretary of State power to determine the "balance of interests" test in certain circumstances. Any order made under this provision will be subject to the negative resolution procedure by virtue of clause 60(5)(a).

Schedule 3 to the Bill

  32.    In the case of sensitive personal data as defined in clause 2, those data cannot be processed in accordance with the first data protection principle unless at least one of the conditions in Schedule 3 is met in addition to one of the conditions in Schedule 2. Paragraph 2(1) of Schedule 3 lifts this bar on processing sensitive personal data in the context of employment law. Article 8.2(b) of the Directive provides for this disapplication, "in so far as it is authorised by national law providing for adequate safeguards". In this respect, paragraph 2(1) permits processing to comply with any right or obligation conferred or imposed by law on the data controller, and paragraph 2(2) goes on to give the Secretary of State power to specify additional safeguards. Under section 2(3) of the Act, a similar power to modify the data protection principles in respect of certain categories of sensitive personal data is subject to the affirmative resolution procedure. It is felt, however, that the appropriate level of parliamentary control for any order under paragraph 2(2) is the negative resolution procedure, as the power is to be used simply to fine-tune the "adequate safeguards" which will already be largely provided for under the existing employment law. Accordingly, clause 60(5)(a) provides for this procedure.

  33.    In addition to the general disapplications given effect to in paragraphs 1 to 7 of Schedule 3, Articles 8.4 and 8.5 give Member States the discretion to lay down further disapplications provided that suitable specific safeguards are provided under national law. Accordingly, paragraph 9 of Schedule 3 gives the Secretary of State power to disapply the prohibition of the processing of sensitive personal data in circumstances to be specified. Examples of activities which an order might cover include public health and social protection, scientific research and Government statistics. It was not considered possible or appropriate to try to set out all the necessary exemptions on the face of the Bill, and the taking of a power will enable any specified list of exemptions to be readily amended. For consistency with the section 2(3) provision in the Act and due to the potential political interest an order under this provision might attract, the affirmative resolution procedure will apply by virtue of clause 60(4).

Schedule 4 to the Bill

  34.    In paragraph 29 preceding, a brief background is given to the provisions in the Bill relating to the transfers of data to a country outside the European Economic Area which does not have an adequate data protection regime. A further exception to the general prohibition on transfers is found in paragraph 4 of Schedule 4 if the transfer is necessary for reasons of substantial public interest. This provision transposes the derogation permitted by Article 26.1(d) of the Directive. The wording of Article 26.1(d) not only permits transfers where the necessity test is satisfied but also where the transfer is "legally required" on important public interest grounds. In this respect, a power is taken in paragraph 4(2) of Schedule 4, enabling the Secretary of State to specify by order circumstances in which data controllers may, and in some cases may not, make such transfers for reasons of substantial public interest. Any order made under this provision is subject to the negative resolution procedure (see clause 60(5)(a)).

Schedule 6 to the Bill

  35.     Schedule 3 of the Act presently enables the Secretary of State to make rules for regulating the exercise of rights of appeal and the practice and procedure of the Tribunal. Paragraph 7(1) of Schedule 6 retains this provision. Although the list in paragraph 7(2) of Schedule 6 includes several procedural matters which are not contained in the equivalent list in the Act, these lists are illustrative only and the matters specified arguably already come within the generality of the order-making power. By analogy with the Act's provisions and due to the procedural nature of the matters within by this power, the rules are subject to the negative resolution procedure (see clause 60(5)(d)).

15 January 1998


 
previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries

© Parliamentary copyright 1998