Select Committee on Science and Technology Eighth Report


Letter to the Chairman from the Lord Williams of Mostyn,

Parliamentary Under Secretary of State, Home Office

    Thank you for your letter of 3 February enclosing the final draft of the Committee's report on digital images as evidence.

    You explained that the Committee had concluded, in the light of the evidence it had heard, that improved controls over public space CCTV systems and associated data matching schemes were needed, and that you had identified the Data Protection Bill as a potential vehicle for achieving these.

    I am grateful to you for giving me the opportunity to consider the Committee's views in advance of the Bill's committee stages. I believe that in practice the Bill as drafted already addresses the Committee's concerns as summarised in your letter, for the reasons given below.

    You queried firstly whether the digital television surveillance systems which are increasingly likely to be used in city centres were unambiguously within the scope of the proposed legislation. We are confident that they are. As you know, the Bill builds on the data protection regime established under the Data Protection Act 1984. Like the 1984 Act the Bill and its data protection principles are framed in general terms rather than by reference to specific data processing technologies, which can be swiftly superseded by new ones. As the Data Protection Registrar explained in her oral evidence, a number of CCTV systems are outside the scope of the 1984 Act because of the limitations of its definition of personal data and its requirement for processing to be undertaken by reference to the individual. Clause 1(1) of the Bill significantly expands both definitions. It appears to us that monitoring by live CCTV comes within the first limb of the definition of "data", i.e. information which is being processed by means of equipment operating automatically in response to instructions given for that purpose. "Processing" is no longer limited to activities carried out by reference to the data subject and it also covers a much wider range of operations, including the disclosure of data by transmission, dissemination or otherwise making available. We consider that the new definitions are sufficiently broad to catch not only the sophisticated types of CCTV systems with which the Committee are concerned, but even much simpler equipment which merely projects images of individuals passing a shop into the shop window without actually recording.

    Your second concern was whether data matching schemes, which might for example be used to identify and track individuals, would be adequately controlled under the new legislation in the absence of a specific complaint by an individual. As explained above, the Bill, like the present Act, is not technology-specific. Its controls will apply to data matching schemes, as do those of the current Act.

    It may be helpful at this stage if I briefly explain the relevant aspects of the Bill's enforcement regime. Whereas under the present Act the Registrar is only able to enforce compliance with the data protection principles against registered data users, the Bill requires compliance with the principles from all data controllers (unless their processing comes within an exempt category), whether or not they have notified their particulars to the Commissioner. Clause 49(1) of the Bill imposes a duty on the Commissioner to promote the following of good practice by data controllers and clause 49(3) enables the Commissioner to prepare and disseminate codes of practice; to encourage the preparation and dissemination of such codes by trade associations; and to advise on the adequacy of any such codes submitted for her consideration. Under clause 49(5) the Commissioner may, with the consent of the data controller, assess any processing of personal data for the observance of good practice. These are wider powers and responsibilities than those applying to the Registrar under the current Act. I note that the Registrar referred in her oral evidence to the possibility, for example, of the Commissioner issuing a code of practice for CCTV systems. Although any such code would be non-statutory, it could be expected to include a detailed statement of application of the data protection principles.

    The Commissioner will not need to wait for a complaint before initiating an investigation. Clause 41 empowers her to issue an information notice requesting relevant details from a data controller where she has reasonable grounds for suspecting any contravention of the data protection principles. This power is backed up by the powers of entry, inspection and seizure detailed in Schedule 8. Failure to comply with an information notice is an offence under clause 45.

    In addition to the enforcement provisions relating to the Commissioner, the Bill also strengthens the judicial remedies available to individuals; for example, clause 11 enables an individual to seek compensation for damage or distress caused by a data controller's failure to comply with any of the requirements of the Bill.

    Aside from the audit powers conferred on the Commissioner under clauses 41 and 49(5), the Bill also provides, at clause 21, for a system of preliminary assessment or "prior checking". You sought clarification about the extent to which this provision will go to meet the need which the Committee sees for an audit function in relation to data matching. We would see it as having the potential to meet it in full. Clause 21, which responds to Article 20 of the 1995 EC Data Protection Directive, provides for certain processing which is particularly likely to harm data subjects to be prohibited for a period of time in order to allow the Commissioner to assess its likely compliance with the requirements of the Bill. Processing during the prohibited period will be an offence. If the Commissioner concludes that the processing is unlikely to comply with the Bill's requirements, the processing may still go ahead, but the data controller will of course be at risk in that event of subsequent enforcement action for any breach of the Act. The particular processing to which the clause applies is to be specified in an Order subject to the affirmative resolution procedure. No decisions have yet been taken as to which categories of processing operation should be subject to preliminary assessment, but you will be aware from the paper published last July (Data protection: the Government's proposals) that operations involving data matching are primary candidates.

    Recommendation 5.14 of the Committee's draft report proposed that the Government should produce guidance for both the public and private sectors on the use of data matching. We see the issue of guidance on data protection issues as falling within the remit of the Registrar/Commissioner rather than government and I have outlined above the duties imposed on her by the Bill in this regard. In fact the Registrar already has a duty under the current Act to promote observance of the data protection principles and in August 1997 she issued guidance on developing data protection codes of practice on data matching. Its aim was to provide a framework within which codes of practice could be developed within particular sectors, leading ultimately to model codes which could be commended to those seeking to establish new data matching systems.

    I hope you will feel that this letter addresses the Committee's concerns satisfactorily. If, however, there are still points outstanding which you consider would be best dealt with by an early meeting, my diary secretary will be happy to arrange one as soon as practicable.


17 February 1998

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries

© Parliamentary copyright 1998