Care Bill [HL]

Debate between Lord Lester of Herne Hill and Baroness Brinton

Wednesday 7th May 2014 Lords Chamber

[Lord Lester of Herne Hill]

My Lords, the question that we are debating at the moment as we approach the enactment of the Bill is whether any extra words in any of these amendments are needed to provide more safeguards and greater public trust and confidence. The bit of law which is paramount but which has not been mentioned so far is the Human Rights Act. This Act, in Section 3, requires that all legislation, including this Bill, must be read and given effect to, if it is possible to do so, compatibly with the convention rights. One convention right, in Article 8, is the right to personal privacy. The Human Rights Act also provides that if any public authority, which includes the Secretary of State and any body performing functions of a public nature, were to breach the right to privacy, it would be liable to obligations, damages and other remedies under the Act. We do not have a written constitution which guarantees privacy; instead, we have the data protection legislation, which is broad-ranging, and the Human Rights Act.

The right to privacy requires three things. One is reasonable legal certainty where there is to be any invasion of privacy—one must know what it is for. The second is a legitimate aim—it must be done for a proper purpose. The third thing is that any invasion must satisfy the principle of proportionality—it must not be excessive. There is a lot of case law on this. Indeed, I was involved in one of the cases years ago in the Court of Appeal—called, I think, Source Informatics —which dealt with the lawfulness of supplying anonymised patient data.

I do not think it is sensible to add further language or further mechanisms over and above those that the Minister has described this afternoon. The more specific we become and the more we go on adding, the more ambiguities we create over what the additional words mean and how they might be interpreted. My view is that it is much better to use the Human Rights Act, the data protection legislation and the specific safeguards that the Minister has adumbrated very clearly today. In my view, they completely satisfy the right to patients’ personal privacy and I cannot think that adding these other words will add to public confidence. It seems to me that public confidence depends more on leadership and public information based upon the framework that we have.

Therefore, I hope that we do not divide the House on this. I hope that we are all able to agree that confidentiality and privacy are vital, as is public confidence, but that we should not overlegislate and overprescribe. In particular, we should not do so when we are considering Commons amendments at the 11th and a half hour before midnight, and we may later come to regret anything that we now add which creates further problems and further ambiguities.

[Baroness Brinton]

I agree with the last comments of the noble Lords, Lord Lester and Lord Ribeiro. One of the problems that your Lordships’ House has faced with this is the issue of data used for research versus data used for commercial purposes. That becomes a very grey area when some commercial firms are doing pure research. It may be worth your Lordships’ House remembering that even commercial research, whether it is carried out by research departments or within universities and other research bodies, is bound by the strongest ethical codes in which we should all have trust and assurance because they are respected around the world. I would be grateful if the Minister could confirm again—I know he has already done so—that commercial data will not be released so that, for example, an insurance company could raise premiums for a particular group of patients. That is the fear that the public have, rather than the issue of using research data, for which we already have many structures and for which the Health Research Authority is properly the correct authority to make sure that the codes are followed absolutely. There is a difficulty in that pseudonymised and anonymised data can sometimes be undone, but that issue already exists in other research areas and there are plenty of mechanisms to hold researchers to account should they use any of that information themselves. I support the point of the noble Lord, Lord Lester, that we should be content with the Government and that if we start to overprescribe, we will end up unravelling some of the complex but effective arrangements that already exist in the research world.

Secondly and very briefly, I have previously raised with the Minister one very specific point on this issue, and I have asked him this question in writing in advance. Has there been any progress on the timetable for inclusion of primary care musculoskeletal data into the care.data programme? I understand that it was an unintentional omission earlier in the process but, given the number of people in this country suffering from musculoskeletal problems, it would be quite extraordinary if they were not included at an early stage.

[The Earl of Erroll (CB)]

My Lords, I would just like to say a few words about this because I am very involved in the whole world of IT, personal data and identification and the issues around examining the data. One of the things that has become apparent to me is that if care.data is to be effective, public trust must be maintained in it—that is the core problem. It needs to be there so that we can do epidemiological studies, and to do those some information will have to be in the database—such as postcodes, so that you can look for clusters and so on—which will potentially allow people to be identified. Once you compare it and link it across to other databases, if you are looking for someone who is of a certain age, a certain health profile and in a certain area down to 100 yards, it is fairly easy to start working out who they are by cross-linking. However, it may be important to take that risk from time to time, as long as it is done properly. What we do not want if this is to work is for people to feel a need to opt out. You cannot do epidemiological studies if half the population decide they are going to opt out. It is essential that the public trust the database, trust that they will be protected as far as possible and trust that the information will not be misused against them. That is the core to getting this whole thing to work, and if you fail on that you have had it.

The noble Lord, Lord Lester, made a very good point about the human rights stuff being in there and that we have the Data Protection Act and all these things. The Minister also mentioned the Data Protection Act. However, there are some challenges with this. One of them is how you bring a case under the Human Rights Act when a department or the health service is acting incorrectly. It is quite tricky; it does not happen overnight and you would be lucky to stop it. There are wonderful protections in the Data Protection Act but there is a certain amount of vagueness about exactly where the limits are and, worse still, it will all be changed this autumn or winter when the new European Parliament assembles. The proposals nearly got through before the coming elections. Under the digital single market agenda, a new Data Protection Act regulation will almost certainly come out of Europe somewhere towards the end of the year. That will have direct action in this country. We have no control over it as it is a European law that is directly effective in this country, and the Information Commissioner over here will be the person who will enforce it. We will have no say in whether it relaxes things too far or becomes too prescriptive in what it does. We cannot rely on it for certainty in the future