Data Protection (Subject Access Modification) (Social Work) (Amendment) Order 2011

Lord Thomas of Gresford Excerpts

Wednesday 23rd March 2011 Grand Committee

[Lord McNally]

The draft order before us today amends an order made in 2000 with regard to the data protection rights of individuals in the context of social work. Specifically, the order brings the data protection obligations of the Children and Family Court Advisory and Support Service in Wales—CAFCASS Cymru—into line with those of its counterparts in England.

The purpose of the draft order is to ensure that officers of CAFCASS Cymru are exempted from the requirement to disclose personal data to an individual—known as a “data subject” in the Data Protection Act 1998—when they consider that to do so would be likely to prejudice the conduct of social work by causing serious mental or physical harm to the individual or a third party. As a result of an order made in 2005, CAFCASS Cymru’s counterparts in England can already use this partial exemption when replying to requests for personal data made under Section 7 of the Data Protection Act 1998. In 2000, when the DPA came into force, the Government brought forward such an exemption by order, which could be relied upon where the disclosure of the information would prejudice the carrying out of social work by causing harm to an individual or a third party.

I should explain that, even without this exemption, in certain situations data controllers may be able to rely on the principle that information shared with a social worker was given in confidence. Therefore, it might not be fair, or even lawful, to release the information, as to do so would be in contravention of the first data protection principle in the DPA. However, the social work exemption in the 2000 order gave a strong, certain and very explicit legal basis to withhold information and ensure that social work is not prejudiced. The schedule to the 2000 order listed those organisations and functions to which the exemption could be applied. This important exemption—the subject of our debate today—ensures that individuals’ rights to see their personal data do not inadvertently prevent social work from being carried out effectively.

With that background in mind, I will turn to the reason for the order before us today. In 2005 an order was approved by Parliament which added certain functions of CAFCASS in addition to those in the 2000 order. The 2005 order allowed CAFCASS to apply the social work exemption in appropriate cases. As Members will know, CAFCASS works with children and their families who are involved in family proceedings, and advises the courts on what it considers to be in the child’s best interests. Matters in which CAFCASS may become involved include where parents are separating or divorcing and cannot agree on arrangements for their child. The role that CAFCASS officers perform means that they routinely process information related to social work.

On 1 April 2005, the functions of CAFCASS in Wales were devolved to the Welsh Assembly, making CAFCASS in Wales—CAFCASS Cymru—a separate organisation to that of CAFCASS in England. Unfortunately, this was not taken into account at the time of the 2005 order, and therefore CAFCASS Cymru has not been able to apply this exemption, although its counterpart in England has. As a result, the intention behind the 2005 order that this exemption should apply across England and Wales, as agreed by Parliament, has not been fulfilled. It is important that this inconsistency in the subject access regime between England and Wales is rectified and that CAFCASS Cymru is able to use this exemption as was originally intended.

CAFCASS Cymru has told us that, between 2007 and 2009, there were 23 cases where it would have considered using this exemption, had it been available. In these cases, CAFCASS Cymru relied on the principle, mentioned at the start of my remarks, that there would have been a reasonable expectation that information that children share with a family court adviser would remain confidential and therefore would not disclose the information because it could give rise to an actionable breach of confidence. However, this approach has not been tested, either by the courts or by the Information Commissioner. The extension of this exemption to cover CAFCASS Cymru will provide it with parity and will ensure a stronger, more certain and explicit legal basis to withhold information if CAFCASS Cymru considered that this would be likely to prejudice the carrying out of social work, by causing serious harm to the physical or mental health of a child.

I want to emphasise here that the Government take the issue of individuals’ rights to access their personal data very seriously. Just as we have made clear our commitment to transparency in terms of public data and official information, we are also committed to upholding people’s rights to see what information is being processed about them in both public and private sectors. Indeed, the Ministry of Justice’s recent call for evidence sought views on how the current subject access regime is working. Responses to this confirmed that individuals see this as an important right and that data controllers by and large take their responsibilities in this area seriously. But there can be no doubt that in certain, specific circumstances, such as those we are considering today, releasing information may not be in the interest of an individual, or indeed of others, including the children of the individual concerned, or those involved in protecting them.

I should make clear to noble Lords that a right of appeal remains for those individuals who believe that a subject access request has not been complied with fully. As with any subject access request, there is a right of appeal through the courts under Section 7(9) of the Data Protection Act. Alternatively, individuals may approach the Information Commissioner, who may investigate whether the data controller has complied with the obligations under the Act. In addition, this order, should it be agreed, will add employees and contractors of CAFCASS Cymru, acting in their professional capacity, to the list of “relevant persons” in the 2000 social work order, as is the case with CAFCASS in England.

Section 7 of the Data Protection Act acknowledges that there may be times when the personal data of another person may be released as the result of a subject access request. In most circumstances, the data controller will need to seek the consent of that other person or assess the reasonableness of disclosure before giving out the data. However, the personal data of a “relevant person”, as defined by the 2000 order, is not subject to these conditions of consent or reasonableness. This means that CAFCASS Cymru must disclose personal data given by its employees in the course of their professional duties if this is required to provide the data subject with personal data under the terms of a subject access request. Consent and the reasonableness test are not factors in the disclosure.

A concern was raised in another place about how relevant persons will be protected from harm by having to release their personal data to others. It is important to remember that this draft order would allow CAFCASS Cymru to withhold information if social work was to be prejudiced by causing harm to the individual or any third party. This could include those who work for CAFCASS Cymru. CAFCASS in England, which must already adhere to this when replying to subject access requests, has told us that it is not aware of any harm caused to employees. In all cases so far it is only the name of the employee that has been released and it is highly unlikely that the individual making the request will not already know the name of that person—most likely to be a social worker—who has been dealing with their case. As such, it would probably raise more suspicion if the name of the employee in question was redacted and therefore the name is almost always released. Officials in CAFCASS Cymru have said that their approach would be similar to that of CAFCASS in England. Again, this provision would bring CAFCASS Cymru into line with CAFCASS in England to ensure consistency in the two bodies' approach to releasing personal data.

The principles about the need to maintain a strong subject access regime while protecting individuals were agreed by all parties in 2005 and these principles still hold firm. In any case, there is no reason why they should apply in England but not in Wales. Including CAFCASS Cymru in the list of organisations able to apply the exemption will not only protect individuals and ensure that social work can be carried out effectively; it will also ensure coherence and consistency between the organisations in England and Wales, and correct the error made in 2005. I therefore commend this draft order to the Committee.

[Lord Thomas of Gresford]

My Lords, I would not necessarily agree to the principle that something that applies in England must necessarily apply in Wales. That is the whole point of devolution, which I am sure that the noble Lord has foremost in his mind. However, I support this provision.

The noble Lord referred to the call for evidence. He made a statement in July 2010 about the call for evidence, which he said was to be,

“assessed and used to inform the UK’s position in negotiations on a new EU instrument for data protection, which are expected to begin in early 2011”.

He also said that there would be a,

“Post-Implementation Review of the DPA, with a view to publishing a full impact assessment by the end of the year”.

Have those time limits been complied with? I was not able to find anything to indicate that they had. What is the position in relation to the negotiations with the EU for a new instrument in this field?