Digital Economy Bill

Debate between Baroness Hamwee and Baroness Byford

Committee: 3rd sitting Hansard - continued): House of Lords
Monday 6th February 2017 Lords Chamber

[Baroness Byford (Con)]

My Lords, in this group I tabled Amendments 100 and 196. Within this group we are debating data sharing and the putting in place of safeguards that make us confident in the next move to make life better for the majority of people. I have one or two direct questions, particularly on the level of data that will be supplied from one authority to another. For example, does the Bill intend that information be supplied on the number of households in a given postal area where child benefit is being claimed and/or where all adults are unemployed? Would it be up to the users of the data to extract a summary picture from details of, for example, names, addresses, whether benefits are received, whether householders are unemployed or any other data?

At any level of inquiry, I presume data will be transferred such as dates of birth and marital status that, were they to fall into the wrong hands, could be used to perpetrate private fraud. No one today has mentioned private fraud, but it can come about as a result of lack of security and safeguarding. Again, perhaps the Minister will indicate what relevant provisions there are. I am unsure whether I have missed some. At earlier stages of the Bill I mentioned the amount of fraud going on and it is horrifying. If the Bill can in any way tighten up on that, it would be an advantage.

For example, will personal information cover things such as whether an individual has a diagnosis of dementia or whether a family has been a cause of concern to the social work department in their own area? Who makes these judgments? At what stage are these activated? I may not have read the Bill carefully enough to find the missing answers. I pose these fairly simple questions to make sure that our safeguarding of this information is secure.

Amendment 100 is a probing amendment that seeks to complete the explanation of what information HMRC would disclose, providing examples of the circumstances under which it would be disclosed and a complete list of the groups or persons whose information would be handed over. This relates to Clause 30, of which we spoke earlier. Subsections (9) and (10) specify the well-being of persons or households and define well-being in terms of physical or mental health, contributions to society—which we have covered slightly earlier on and which is difficult; I should be glad of clarification on that—and emotional, social and economic well-being. The latter are easier to understand.

Clause 31 refers to people living in fuel poverty. Again, we debated this previously. Fuel poverty has been defined as,

“living on a lower income in a home which cannot be kept warm at a reasonable cost”.

Clause 32 also refers to people living in fuel poverty. I do not understand what is intended, nor what will be involved for those deemed to be affected. Defining well-being in terms of well-being suggests that definitions of those covered by this legislation could depend on the personal and political stance of those making those decisions. What is “lower income”? Within what limits do homes qualify under these clauses and who will rule that they cannot be kept warm at reasonable cost? What will be the limits of powers of such a decision-maker over, for example, someone who prefers to wrap up for three months of the year so they may enjoy their garden for nine; in other words, somebody who is living in a bigger house that costs more to heat? Will an individual be able to opt not to have personal information shared within local authorities and/or with gas and electricity suppliers?

Turning now to my Amendment 196 in this group, I do not pretend to know anything about the structure, organisation or responsibilities of HMRC. Hence, I do not understand whether an “official” is someone equivalent, say, to a board member in a quoted company. I fear, however, that that is unlikely to be the case. In this era of Facebook, Snapchat and the substitution of public opinion for demonstrable fact, I am unhappy—I do not know whether other noble Lords are—that perhaps a more junior member of HMRC could decide that disclosure would be in the public interest. In other words, where does the buck stop?

Disclosure of personal information, even supposedly non-identifying, should be done only on the authority of the head of the organisation. He or she presumably will have the knowledge, experience and breadth of understanding to be sure that it cannot be combined with other data to name individuals. He or she will also, presumably, be less likely to make errors of judgment, and of course a claim of ignorance of any such disclosure would not stand up to scrutiny, as they would obviously be at the most senior level.

[Baroness Hamwee]

My Lords, I will just pick up the noble Baroness’s last point about who is an official. There are examples, in other legislation, of references to “senior officials” and “designated officials”, which might be somewhere between the junior official she has in mind and the Permanent Secretary, but she is right to draw the issue to the Committee’s attention.

On an earlier group, the noble and learned Lord indicated that he was going to speak at greater length—I assume that may be on this group—on the reason for using the term “personal information” rather than “data”. Perhaps I may use my noble friend’s Amendment 213 to ensure that we get to share more of Government’s thinking. I understand the point about corporations, since in the one case, they come within the group covered, and in the other they do not. But I am still puzzled as to why such efforts have had to be made to deal with personal information and then to add in references to the Data Protection Act, rather than starting from the DPA—with any necessary exclusions—which would have taken us straight to the involvement of the Information Commissioner, the data protection principles and so on.

I wondered during the Statement whether to have a go at some alternative drafting for Report, but thought I had better wait for this discussion. But perhaps part of it boils down to a question on Clause 33(8), which says, in wording replicated elsewhere, that,

“nothing in section 30, 31 or 32 authorises … a disclosure which … contravenes the Data Protection Act”.

To look at it from the other end of that telescope, is there any personal information which is the subject of the Bill that would not fall within the DPA and therefore not be protected by that clause?

Digital Economy Bill

Debate between Baroness Hamwee and Baroness Byford

Committee: 3rd sitting (Hansard - continued): House of Lords
Monday 6th February 2017 Lords Chamber

[Baroness Byford (Con)]

My Lords, my opposition to Clause 39 standing part of the Bill forms part of this group. I have listened carefully to what the noble Lord, Lord Clement-Jones, has just said. I come to this from a slightly different angle but the conversation goes round and round in a circle, and here we are trying to introduce protections again.

I tabled my opposition to the clause for probing reasons. I wonder whether it is possible to have examples of when and why a civil registration authority would disclose information. The definition in new Section 19AA(6)(e), introduced in Clause 39, lists as civil registration officials those local authority classifications which also appear as specified public authorities. Do the disclosure powers mean therefore that a civil registration official in, for example, my home county of Leicestershire may disclose information to other personnel employed within the county council, or do they empower him to disclose information to any or all of the other specified public authorities? From my reading of the subsection, that is not quite clear.

Would the regulations be used to divulge information specific to a person or perhaps a family, or could they ever cover everything registered at a particular time or relating to a particular location? For example, why would the NHS have an interest in receiving such information?

Could this chapter result in a large-scale information exchange between civil registration officials and public authorities using the internet? If so, how will such data be protected both in transit and at the receiving end? Do all public authorities use the same methods to guard against data theft and hacking? I shall be interested to hear the Minister’s response.

[Baroness Hamwee (LD)]

My Lords, perhaps I may ask a couple of questions which arise from the fact sheet on this issue. On civil registration, it says:

“The Bill establishes a framework, with appropriate safeguards, to share bulk registration information where there is a clear and compelling need”.


I wonder whether the Minister can help the Committee in understanding where that is translated into the Bill. The fact sheet also says:

“There are no intentions to share data with the private sector or for data to be used for any commercial purposes”.


It then goes on to say that,

“the powers would not permit this”.

However, I am sure that the Minister will understand my querying the words “no intentions”, because they suggest that there could be a change, and possibly one with which Parliament is not hugely involved. I am going to assume that the points made by the Delegated Powers and Regulatory Reform Committee are in the rather large pile of items that it raised and which the Government will reply to before Report, so I am referring to that only in passing, but it would be very helpful to understand how the points in the fact sheet, which is where many people would start, move over into the legislation.