Civil society joins key professional bodies to demand removal of data sharing powers
Many of Britain's leading professional bodies have joined Privacy International and colleague NGOs to call for the complete withdrawal of the controversial clause 152 data-sharing powers. An open letter signed by thirty organisations ranging from Liberty, to the Royal College of Psychiatrists, to the Licensed Taxi Drivers Association condemns the new powers as a dangerous threat to privacy, and has demanded the removal of the clause from the Coroners & Justice Bill. The text of the letter is below.
Dear Mr Straw,
We are writing with regard to clause 152 of the Coroners and Justice Bill that provides for amendment of the Data Protection Act 1998 (DPA) to enable ‘information sharing’ of data if approved by an Order made by a Minister.
This new power is without precedent, and carries substantial implications for data protection and for the rights of individuals. We wish to set out our concerns and to seek answers to a number of troubling questions.
The amendments would enable the Secretary of State, Treasury or a Minister in charge of any government department almost unfettered right to make an Order permitting “any person” to share personal information across the public and private sectors for any purpose in line with the government’s policy objectives. The use of information is not required to be consistent with the original purpose of the data. Moreover, the Order-making power will not be contingent on obtaining the consent of the individuals whose information is being shared.
Such an order can confer power on any person; remove or modify any legal prohibition on information sharing and amend or repeal any Act of Parliament whenever passed. In its current wording, the Bill contains Order-making powers related to data sharing that are not subject to independent oversight, and over which the Information Commissioner has no control.
As the Order-making power is general, the data being shared could be almost limitless, including name, address, date of birth, ethnicity, credit history, medical records, DNA and genetic information, tenancy records, education records, police files and social work records.
The Bill stipulates that the only limits on such an order are that the information sharing must relate to a matter with which the relevant Minister or department is concerned and that it is in line with the policy objectives of the Minister. Although the Bill requires that an order should strike a fair balance between the public interest and the interests of the people affected, no protections or oversight measures have been written into the legislation.
While authorities must submit a copy of a draft order to the Information Commissioner there is no obligation to disclose to the Commissioner any background document or legal advice about an Order, no obligation to answer any request for information from the Commissioner and no obligation to engage the public about the detail of a draft Order. In practice, according to the wording in the Bill, this means that representations can be ignored after they have been considered.
There is no provision in the Bill to require Parliament to take action on advice from the Information Commissioner. Even if such advice was to be taken seriously, Parliament will be unable to amend an Order. In such a case the only influence that can be exerted by the Commissioner is to intervene before an Order is issued.
If these amendments are enacted, Ministers will be given the power, through secondary legislation, to effectively nullify the protections contained within the DPA, and indeed the very purpose of the DPA. In view of the extraordinary powers conferred by clause 152, the information sharing provisions in the Bill may constitute the gravest threat to data protection in the history of the Data Protection Act, and are among the most wide-ranging and potentially intrusive proposals ever laid before Parliament.
You have asserted that the purpose of the clause is to assist bereaved families by providing a simple mechanism to inform all relevant agencies of a death. If this is indeed the government’s motivation, then we can devise much more simple and cost effective ways of achieving this aim, without the risk of destroying the core principle of consent. A tick box on the bottom of a death certificate would be one such example.
We are concerned that the data sharing provisions in the Bill were not put out to formal public consultation and that no Regulatory Impact Assessment has been conducted on the data sharing provisions in the Bill.
The public is overwhelmingly concerned about the issue of information security and data protection rights. In 2008, an ICM poll sought the public’s opinion on data sharing between government agencies. 65% of respondents thought it was a “bad” or “very bad” idea, compare to only 31% who felt it was a “good” or “very good” idea. A 2009 YouGov poll commissioned by the Sunday Times revealed an identical level of concern on this issue. Rarely have we witnessed such a clear and resounding vote of no confidence in an issue concerning the use of personal information.
Government should regard such issues with great sensitivity and concern. Mental health issues, for example, where stigma continues to attach, must be recognised as one of many areas where patient information is of a particularly sensitive nature.
These and other facts raise a number of important questions. We would be grateful if you would supply us with a response to these.
- In view of the significance and generality of clause 152, it is entirely inappropriate to bury the information sharing provisions in the Coroners and Justice Bill rather than in the form of dedicated legislation. If the justification for the clause is assisting bereaved families, that purpose should be circumscribed in the Bill.
- Clause 152 has not been subjected to a Regulatory Impact Assessment. We believe this indicates not just a disregard for convention, but also highlights the government’s cavalier attitude to an issue of the gravest public concern.
- In Second Reading you claimed that the basis of clause 152 derived “not from the Government, but from an independent review of data protection, undertaken by people who are profoundly committed to the provisions—the Information Commissioner and Professor Mark Walport”. This is a misleading assertion. Recommendation 8 of the Review does indeed suggest a fast track legislative procedure, but one that is confined to the Secretary of State and then only in “precisely defined circumstances”. Clause 152 is anything but precisely defined.
- The Thomas-Walport Review also advised, with respect to the making of Orders: “we believe this process would not be appropriate for large-scale data-sharing initiatives that would constitute very significant changes to public policy, such as those relating to the National Identity Register or the National DNA database.” Given this advice, we believe the government should concede that clause 152 is entirely inappropriate and should be struck from the Bill.
- The clause 152 provisions will potentially affect everyone. Why then was input to the Thomas-Walport Review limited to “experts and practitioners in the field of data sharing and data protection” rather than the population in general? In our view, the Thomas-Walport report published a questionnaire, not a consultation. The content of the Review consultation and the circumstances of its publication abjectly failed to meet the Government’s own consultation guidelines.
- During Second Reading, the Chairman of the Joint Committee on Human Rights observed: "Our approach, which is set out in numerous reports, is that, when there is a demonstrable need to permit data sharing, the Government’s intentions should be clearly set out in primary legislation, including the necessary safeguards, to enable proper scrutiny." Why has the government so flagrantly ignored this advice?
- The clause creates a huge risk to the core principle of informed consent that sits at the heart of data protection. Clause 152 fundamentally breaches the protection offered by consent. If it is enacted, the resulting powers will breach a number of protections, including those in paragraph 24 of the Helsinki Convention.
In view of the dangers created by these proposed provisions, we respectfully urge you to remove clause 152 in its entirety from the Bill.
Professor Dinesh Bhugra,
The Royal College of Psychiatrists
Dr Mike Lindsay,
Children’s Rights Alliance for England
Professor Wendy Savage,
Professor Richard Parish,
Royal Society for Public Health.
Dr Helen Wallace,
Professor Elizabeth Campbell,
British Psychological Society
Ian H Johnston,
British Association of Social Workers
Professor Ross Anderson,
The Foundation for Information Policy Research
Association for Progressive Communication
Academics For Academic Freedom
Deputy Chief Executive,
Independent Schools Council
Justice in Health Network
Roger M Goss,
Dr Glyn Hayes,
President & Chairman,
UK Council for Health Informatics Professions
Tamil Elders Society
Chief Executive Officer,
Gillian M Bean & Margaret MacRae,
Sufferers of Iatrogenic Neglect
Licensed Taxi Drivers Association
Wes Streeting & Susan Nash
National President & National Executive Committee
National Union of Students
James Doherty & Pete Murray & Michelle Stanistreet
President & Vice President & Deputy General Secretary
National Union of Journalists
Joint Council for the Welfare of Immigrants
Association of British Drivers