Data Protection (Subject Access Modification) (Social Work) (Amendment) Order 2011
(Limited Text - Ministerial Extracts only)
Read Full debate
Lord McNally
That the Grand Committee do report to the House that it has considered the Data Protection (Subject Access Modification) (Social Work) (Amendment) Order 2011.
Relevant documents: 16th Report from the Joint Committee on Statutory Instruments
The Minister of State, Ministry of Justice (Lord McNally)
My Lords, never underestimate the value of the Whip because, but for the intervention of my noble friend Lady Northover, I would have been well into this speech and would not have moved the Motion on the previous order. I am most grateful to her.
Lord McNally
The draft order before us today amends an order made in 2000 with regard to the data protection rights of individuals in the context of social work. Specifically, the order brings the data protection obligations of the Children and Family Court Advisory and Support Service in Wales—CAFCASS Cymru—into line with those of its counterparts in England.
The purpose of the draft order is to ensure that officers of CAFCASS Cymru are exempted from the requirement to disclose personal data to an individual—known as a “data subject” in the Data Protection Act 1998—when they consider that to do so would be likely to prejudice the conduct of social work by causing serious mental or physical harm to the individual or a third party. As a result of an order made in 2005, CAFCASS Cymru’s counterparts in England can already use this partial exemption when replying to requests for personal data made under Section 7 of the Data Protection Act 1998. In 2000, when the DPA came into force, the Government brought forward such an exemption by order, which could be relied upon where the disclosure of the information would prejudice the carrying out of social work by causing harm to an individual or a third party.
I should explain that, even without this exemption, in certain situations data controllers may be able to rely on the principle that information shared with a social worker was given in confidence. Therefore, it might not be fair, or even lawful, to release the information, as to do so would be in contravention of the first data protection principle in the DPA. However, the social work exemption in the 2000 order gave a strong, certain and very explicit legal basis to withhold information and ensure that social work is not prejudiced. The schedule to the 2000 order listed those organisations and functions to which the exemption could be applied. This important exemption—the subject of our debate today—ensures that individuals’ rights to see their personal data do not inadvertently prevent social work from being carried out effectively.
With that background in mind, I will turn to the reason for the order before us today. In 2005 an order was approved by Parliament which added certain functions of CAFCASS in addition to those in the 2000 order. The 2005 order allowed CAFCASS to apply the social work exemption in appropriate cases. As Members will know, CAFCASS works with children and their families who are involved in family proceedings, and advises the courts on what it considers to be in the child’s best interests. Matters in which CAFCASS may become involved include where parents are separating or divorcing and cannot agree on arrangements for their child. The role that CAFCASS officers perform means that they routinely process information related to social work.
On 1 April 2005, the functions of CAFCASS in Wales were devolved to the Welsh Assembly, making CAFCASS in Wales—CAFCASS Cymru—a separate organisation to that of CAFCASS in England. Unfortunately, this was not taken into account at the time of the 2005 order, and therefore CAFCASS Cymru has not been able to apply this exemption, although its counterpart in England has. As a result, the intention behind the 2005 order that this exemption should apply across England and Wales, as agreed by Parliament, has not been fulfilled. It is important that this inconsistency in the subject access regime between England and Wales is rectified and that CAFCASS Cymru is able to use this exemption as was originally intended.
CAFCASS Cymru has told us that, between 2007 and 2009, there were 23 cases where it would have considered using this exemption, had it been available. In these cases, CAFCASS Cymru relied on the principle, mentioned at the start of my remarks, that there would have been a reasonable expectation that information that children share with a family court adviser would remain confidential and therefore would not disclose the information because it could give rise to an actionable breach of confidence. However, this approach has not been tested, either by the courts or by the Information Commissioner. The extension of this exemption to cover CAFCASS Cymru will provide it with parity and will ensure a stronger, more certain and explicit legal basis to withhold information if CAFCASS Cymru considered that this would be likely to prejudice the carrying out of social work, by causing serious harm to the physical or mental health of a child.
I want to emphasise here that the Government take the issue of individuals’ rights to access their personal data very seriously. Just as we have made clear our commitment to transparency in terms of public data and official information, we are also committed to upholding people’s rights to see what information is being processed about them in both public and private sectors. Indeed, the Ministry of Justice’s recent call for evidence sought views on how the current subject access regime is working. Responses to this confirmed that individuals see this as an important right and that data controllers by and large take their responsibilities in this area seriously. But there can be no doubt that in certain, specific circumstances, such as those we are considering today, releasing information may not be in the interest of an individual, or indeed of others, including the children of the individual concerned, or those involved in protecting them.
I should make clear to noble Lords that a right of appeal remains for those individuals who believe that a subject access request has not been complied with fully. As with any subject access request, there is a right of appeal through the courts under Section 7(9) of the Data Protection Act. Alternatively, individuals may approach the Information Commissioner, who may investigate whether the data controller has complied with the obligations under the Act. In addition, this order, should it be agreed, will add employees and contractors of CAFCASS Cymru, acting in their professional capacity, to the list of “relevant persons” in the 2000 social work order, as is the case with CAFCASS in England.
Section 7 of the Data Protection Act acknowledges that there may be times when the personal data of another person may be released as the result of a subject access request. In most circumstances, the data controller will need to seek the consent of that other person or assess the reasonableness of disclosure before giving out the data. However, the personal data of a “relevant person”, as defined by the 2000 order, is not subject to these conditions of consent or reasonableness. This means that CAFCASS Cymru must disclose personal data given by its employees in the course of their professional duties if this is required to provide the data subject with personal data under the terms of a subject access request. Consent and the reasonableness test are not factors in the disclosure.
A concern was raised in another place about how relevant persons will be protected from harm by having to release their personal data to others. It is important to remember that this draft order would allow CAFCASS Cymru to withhold information if social work was to be prejudiced by causing harm to the individual or any third party. This could include those who work for CAFCASS Cymru. CAFCASS in England, which must already adhere to this when replying to subject access requests, has told us that it is not aware of any harm caused to employees. In all cases so far it is only the name of the employee that has been released and it is highly unlikely that the individual making the request will not already know the name of that person—most likely to be a social worker—who has been dealing with their case. As such, it would probably raise more suspicion if the name of the employee in question was redacted and therefore the name is almost always released. Officials in CAFCASS Cymru have said that their approach would be similar to that of CAFCASS in England. Again, this provision would bring CAFCASS Cymru into line with CAFCASS in England to ensure consistency in the two bodies' approach to releasing personal data.
The principles about the need to maintain a strong subject access regime while protecting individuals were agreed by all parties in 2005 and these principles still hold firm. In any case, there is no reason why they should apply in England but not in Wales. Including CAFCASS Cymru in the list of organisations able to apply the exemption will not only protect individuals and ensure that social work can be carried out effectively; it will also ensure coherence and consistency between the organisations in England and Wales, and correct the error made in 2005. I therefore commend this draft order to the Committee.
Lord Thomas of Gresford
My Lords, I would not necessarily agree to the principle that something that applies in England must necessarily apply in Wales. That is the whole point of devolution, which I am sure that the noble Lord has foremost in his mind. However, I support this provision.
The noble Lord referred to the call for evidence. He made a statement in July 2010 about the call for evidence, which he said was to be,
“assessed and used to inform the UK’s position in negotiations on a new EU instrument for data protection, which are expected to begin in early 2011”.
He also said that there would be a,
“Post-Implementation Review of the DPA, with a view to publishing a full impact assessment by the end of the year”.
Have those time limits been complied with? I was not able to find anything to indicate that they had. What is the position in relation to the negotiations with the EU for a new instrument in this field?
Lord Bach
My Lords, I thank the Minister again for explaining these orders—perhaps not quite as succinctly as in the previous case, but I understand why—and I am grateful to the noble Lord, Lord Thomas of Gresford, for raising the point that he has raised.
Of course, whenever exemptions are made to data protection regarding people’s fundamental right to know what data are held about them, how those data are used and what safeguarding processes there are, it is right that they should be very carefully examined. This order has been examined very carefully in another place and I have read the transcript of those proceedings. On that occasion, the matter was tested by a number of questions, particularly about the frequency of exemption already in place for England. However, Members of the other place were content and satisfied with the answers that were given; in my view, we should also be content with the order and with the way in which the Minister has outlined the order today.
There are occasions when it is not just right but important that exemptions are made to the normal rights under data protection legislation. That is common sense and is appropriate. What makes the exemption satisfactory is that, first, there is a right of appeal, which is very important in our view. Secondly, it is absolutely right that social workers, who are not very well paid but who do a pretty demanding job that is absolutely crucial and much underrated by the rest of society, should get the protection that they deserve, and anything that can make their difficult task easier should be done by Parliament, if possible. I believe that that is what these exemptions have done so far in England and will now do in Wales. Our view is that this order is sensible, reasonable and absolutely appropriate.
Lord McNally
My Lords, I am sorry that my explanation of this instrument was succinct. I turned over in my mind whether to adopt the attitude exemplified by my noble friend Lord Sassoon and the noble Lord, Lord Davies, in the earlier debate by reducing the issue to some party barn-storming by announcing that this was the coalition cleaning up a mess left by the previous Government, but I have been around this place long enough to know that we will probably make similar mistakes in legislation.
Lord McNally
This just shows how these matters are dealt with in the justice system. I also note that, as one QC eased himself out of the Benches, another QC eased himself in. I deal with these matters with great trepidation.
On our call for evidence, the preliminary result was published in January of this year and I shall ensure that my noble friend receives a copy. We are undertaking an interesting exercise in trying to future-proof as much as we can the whole of data protection. The call for evidence will be extremely useful in making what we hope will be a positive contribution to the review of the European directive. The capacity of data protection of the exchange of data has changed dramatically, even in this still young century. Therefore, the need to take a new look at data protection is extremely timely. We shall be making a contribution to the review going on in Europe and we shall also review exemptions and applications under the Data Protection Act as part of that process.
Perhaps I might associate myself with the points made by the noble Lord, Lord Bach. One was that it is important that there should be a right to access data. Successive Governments have now been committed to greater transparency, but there have to be safeguards along with that. I also therefore associate myself very much with his tribute to social workers—a group sometimes quite outrageously pilloried in our popular press—who carry out extremely difficult responsibilities on behalf of our whole society. If they are to carry out such responsibilities, the kind of protection that this order provides for them is no more than they deserve. Certainly, in this case it should apply both in England and Wales.