moved Amendment No. 30:

May I speak in support of this amendment, as I have a following amendment which would allow an even longer tenure of office—five to eight years. I am speaking with the support of the British Computer Society, which is the leading professional organisation in computers. It is concerned to reinforce the independence of the registrar. It regards such political independence as most important, and this is one area where it can be reinforced. The BCS looks on this Bill as a chance to reduce public suspicion and scepticism about computers in certain areas. It does not require a person to be very politically aware to have suspicions about the independence of an appointee in these circumstances of three years.

I hope that it does not seem small-minded of me to refer to a small mistake in the Notes on Clauses, which I otherwise found very useful. I quote from the notes on Clause 3, at the end of paragraph 3. It describes the procedure for appointment and then states:

"By these means the Registrar is distanced from the Government of the day and he cannot be removed from office by the decision of a departmental Minister. He is thus assured of the same degree of independence as the Parliamentary Commissioner for Administration."

As I am sure your Lordships know, the Ombudsman, together with the Local Government Ombudsman and the Health Service Ombudsman, are effectively appointed for life; that is, until retirement at 65. There is a considerable difference between a three-year leasehold and a lifetime tenure. I believe that at least a five-year leasehold, or even longer, is required to provide an adequate degree of independence.

In your Lordships' House on Tuesday, at Question Time, some of your Lordships may have heard some of the rather robust exchanges about what was called the non-reappointment of Sir Ralph Verney as chairman of the Nature Conservancy Council after a three-year tenure. Suspicions were voiced from all sides about the motives for the non-reappointment, apparently also reflecting feelings reported outside the House. Those suspicions may have been groundless, but nevertheless they were there. The noble Lord who was answering for the Government said they were looking for someone,

"young enough to serve at least a second term".—[Official Report, 8/2/83, col. 1108.]

The present Government cannot guarantee that it will fall to them to offer him a second term.

If this sort of controversy and suspicion can arise on the subject of nature conservancy, how much more should it be avoided with the registrar of data protection? One of the main requirements is that, in the eyes of the public, he should clearly be seen to be independent of political pressures. I should like to hear what the Government have to say before withdrawing my amendment in favour of the present amendment, which I strongly support.

I listened with interest to the noble and learned Lord's introduction to this amendment and to the reflections on it by the noble Viscount, Lord Craigavon. The Bill, as drafted, provides that the initial office holder shall serve for a full five-year period, in order both to oversee the setting up of the register and to establish the direction which the registrar's office shall take during the first few years in which the provisions are fully operational. Thereafter it was the Government's view that there might be grounds for an element of flexibility in the lengths of appointment made, so that, for example, if a good man were found for the job who for some reason could only serve for a more limited period, one would not be inhibited from appointing him for that shorter time.

However, in view of the concern of the noble Viscount, Lord Craigavon, and the explanation of the noble and learned Lord, and in order to prolong the bonhomie introduced by dinner and underline what I said in the earlier part of our debates about my good-heartedness, I am prepared to consider this.

I shall not say "for this relief much thanks" because the relief is not complete enough yet. But for this post-dinner gesture we are grateful and we look forward with enthusiasm to the acceptance of my amendment in due course, possibly on Report. However, in view of the Minister's assurances, I shall withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 31 not moved.]

The next amendment is No. 32 but I should say that, if this is agreed to, it will not be possible to call Amendments Nos. 33 and 34.

I think that the noble Lord inadvertently failed to speak to this amendment with his Amendment No. 30. It is consequential on Amendment No. 30, is it not?

had given notice of his intention to move Amendment No. 32:

moved Amendment No. 34:

These amendments refer to the parts of Schedule 2 which give the Secretary of State a role in controlling the registrar's manpower, expenditure and accounting procedures. The noble and learned Lord has argued that the Secretary of State should be relieved of that role and that the full burden should ultimately rest on the Treasury. He suggested that this is necessary to avoid the Secretary of State (who in this case would be the Home Secretary) being faced with a dangerous conflict of interests: on the one hand, he is responsible for approving the registrar's resources: on the other, he might be suspected of wanting to avoid the registrar looking too closely at data held by the Home Office.

First, as regards independence, the Bill provides ample evidence of the Government's determination to ensure that the registrar's independence is real and effective. He will be appointed by Her Majesty by Letters Patent and can only be removed following an address both from this House and from another place. It will not be possible to remove him at the political whim of a future Secretary of State. Secondly. the Government are not his personal paymaster. The salary and pension of the registrar will be determined! by another place and issued from the Consolidated! Fund. Then, of course, his staff will not be civil servants, so they will have no affiliations to a central department. And, last but not least, the registrar will have the power to use his reports direct to Parliament to draw attention to any particular concerns he may have.

That is not an unimpressive battery of guarantees, but though the functional independence of the registrar can be guaranteed, we must still make sure that he is accountable for his use of public funds. He cannot become a law unto himself in that respect and the noble and learned Lord recognises that in leaving approval of staffing levels and payment of expenses to rest with the Government. But he wishes these functions to be discharged by the Treasury alone. The first thing I would say is that it must make sense for both resource control and policy responsibility to lie with the same department. It would be a certain recipe for confusion if one department dealt with general policy on data protection and a quite different one dealt with resource approval. The two go inextricably hand in hand. I have a deep admiration for the department of the Treasury and a profound respect for my right honourable friend who leads it, but he would be the first to agree that the Treasury is not the most appropriate department to take charge of data protection policy. Yet, for reasons that I have just mentioned, the adoption of this amendment would, I believe, lead us down that road.

It is possible, or rather tempting, to draw a parallel with the Parliamentary Commissioner for Administration. In the Act setting up the PCA, the Treasury was given sole responsibility for approving resources, but the parallel is not exact. Both the PCA and the registrar must be wholly independent, and in providing for the registrar's appointment, security of office and payment of salary and pension, we have followed the PCA model. But when the office of Parliamentary Corn missioner for Administration was established, the overall policy lay with the Treasury, so it was right that the Treasury approved resource allocation and the commissioner's staff, the civil servants. provided by the Treasury. But the registrar's office will he a non-governmental body, not staffed by civil servants at all. I could go on, but I think I have deployed enough of what I have before me to show the basis of our not being happy with this amendment.

May I just briefly support my noble friend and say that in my experience the Treasury is not suitable as a department of state to undertake administrative functions of this nature. Executive responsibility is not its forte and, though I well see what the noble and learned Lord is working at—to try to take this out of some sort of central control—there must be somebody there. If we were to try to select the department of state most unsuitable to be landed in the position in which these amendments would land it, I would select the Treasury as most unsuitable.

May I add that I do not think I have ever seen such a Bill in which such vast powers have been given to the Secretary of State. Almost every clause finishes up with the words that the Secretary of State can cancel it, alter it, amend it, improve it, extend it or do whatever he may wish to do. What we are seeking to do in Committee stage in your Lordships' House is to go through each of these clauses seriatim and on each particular power it is perfectly possible for the noble Lord the Minister to make out a case for that particular power being given to the Secretary of State. What we are not able to do in this Committee stage is to take an overall look at the totality of the situation, as to whether the Secretary of State is not being given overall a far wider extent of his powers and his discretion than is really desirable. If that is the correct view, and if this is a Bill in which there are considerable extensions of the Secretary of State's powers, far more than might reasonably be anticipated, then I would suggest it is up to your Lordships' Committee to take individual instances where that power can be whittled away without doing any harm to the Bill. I would have thought that this was one of those instances where this was desirable and quite practicable.

I am not entirely surprised that the noble Lord, Lord Mottistone, was not endeared with the idea of the Treasury being involved. I seem to have heard him in great eloquence on that theme on previous occasions, so he may be not entirely without a modicum of prejudice in that regard. I am grateful to the noble Lord, Lord Wigoder, for his support of the amendment. What is crucial in this matter is that the Secretary of State for the Home Office has an enormous involvement through the involvement of his department in the whole of the procedures we are concerned with; and his constant involvement, and indeed intervention, which runs through this Bill from clause to clause is something which is causing concern and will be the subject of further concern. I see that I can make no progress on this matter tonight, but maybe we shall return to it on another occasion. In the circumstances, I ask leave to withdraw Amendments Nos. 34 to 39 inclusive.

Amendment, by leave, withdrawn.

[Amendments Nos. 35 to 39 not moved.]

moved Amendment No. 40:

I think we all knew that the time would come when the noble Lord would find an amendment acceptable.

moved Amendment No. 46:

I should like to support the noble Viscount. This is a sensible amendment which will obviate the excuse from an operator that he did not realise that he had to give all the information that was required.

The noble Viscount has explained, in introducing these amendments, his desire to ensure that the register is as full and informative a document as possible. The Government certainly share his wish that the particulars entered on the register should give a proper indication of the matters to which they relate, and that is why Clause 7(2)(a) of the Bill expressly empowers the registrar to refuse registration if he considers that the particulars proposed for registration would not give sufficient information. But the Government have also recognised that it would be unnecessary—and in some cases inappropriate—to insist upon very detailed entries every time. The noble Viscount gave some examples, but there will be many straight forward cases of data processing—company payroll records are perhaps a case in point—where the nature of the data and the purposes to which they are put, will be well known to all those involved, and where it would be quite unnecessary to insist upon a laboriously detailed description of what was going on. Or there might be cases where to give very specific details about the activity in question would be to prejudice the very purpose for which the data were being held—commercial secrets might be revealed for example, or the effect might be to reveal to those who had been responsible for some major crime that the police were on their track. Thus, Clause 7(3) provides for registered particulars to be in general terms where appropriate, and actually requires the registrar to accept particulars in such terms where the purposes for which the data are to be held would otherwise be likely to be prejudiced. I believe that this strikes a very careful balance between the two interests which are involved here, and that together these provisions give the registrar appropriate discretion to decide upon the right degree of detail in each case.

I think that perhaps the noble Viscount's amendments would upset that careful balance— indeed, I doubt whether they could sit alongside the provisions of Clause 7(3) without seriously confusing the situation—and I suggest that they are unnecessary given the discretion which the registrar already enjoys. To shift the balance any further in the direction of detailed register entries is neither necessary for the sake of an informative register, nor would it be fair on those users who might thereby find themselves obliged to supply far more information than it was in anyone's interests to have available. I hope, in the light of what I have said about the provisions already present in the Bill, that the noble Viscount will agree to withdraw his amendment.

I am grateful for that answer. I am not sure whether the powers of discretion in Clause 7 cannot still he exercised even if my amendment were put into Clause 4. However, I would like to read in Hansard what the noble Lord has said and possibly maintain the option of bringing this amendment back at a later stage, if necessary. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

[Amendment No. 47 not moved.]

moved Amendment No. 48:

The noble Viscount urges us to extend the list of a user's details which are to be placed on the register so that they will include a brief description of the processing facilities, including system software and software products, and their main locations. Although I understand the reasons for the amendment, I do not believe that its adoption will help. What it would in fact achieve would be to involve data users in extensive work and be of limited help to the registrar. I say this because in many respects the data protection principles can be policed without reference to the processing facilities which hold the personal data. The main exception to that is where security measures are concerned—the eighth principle. But even there, although knowledge of a user's facilities may, on occasion, be of interest to the registrar in considering matters such as security and reliability, the value of such knowledge will vary according to the nature of a data user's operations.

The relevance and worth of such knowledge will depend above all on how the equipment on which the personal data in question are processed is being used. The more complex and demanding the processing operation, the more reliable the security of the equipment may be. The more sensitive the purpose for which personal data are held, the more stringent the security measures which it may be appropriate to take in respect of the data.

This amendment will not assist the registrar to take a view on issues such as those involving non-personal data processing. Nor would he know from the additional information he would receive in consequence of this amendment what other workloads the equipment in question might have to cope with, and he would not know whether special features had been added to a software system by a user which might have a bearing on the issue of security.

I have expressed doubts about the value of the amendment, but I have also a positive objection to it; it is because of the burden it will place on users. As we shall discuss at greater length in due course, we have been at pains to make the registration process as simple as possible in order to minimise the burden and costs for users. This amendment would add a significant element to the information that users would have to provide and one that might need frequent updating as equipment and software change, which they do with considerable rapidity. I do not think that the advantages it would bring would outweigh the costs and efforts that it would demand from users.

There is one other point. The amendment makes no allowance for users who process data on facilities provided by computer bureaux and who might be wholly unable to provide the imformation demanded by the amendment. I therefore hope that the noble Viscount will see fit to withdraw his amendment.

I am grateful to the noble Lord for that very full answer. I think the answer might be that the professional has a slightly different perspective on the whole process or registration. However, until I am able to see that full answer in Hansard tomorrow, I should like to withdraw the amendment, possibly with a view to bringing it back at the next stage. I beg leave to withdraw the amendment.

Amendment, by leave, withdrawn.

moved Amendment No. 49:

I should like to support my noble friend in his amendment. I just wonder whether my other noble friend on the Front Bench has thought of the position if the single relevant individual happens to be a young woman away on maternity leave. She would be away for six months and one would get no answer. Therefore, I would urge him to accept this particular amendment.

The purpose of Clause 4(3)(f), to which this amendment relates, is to provide in the register entry of each data user certain information of assistance to data subjects wanting to seek access to data. That information is the name or description and address of an individual in the user's organisation responsible for dealing with requests for access. The register will, therefore, enable subjects to dispatch requests direct to the person responsible for dealing with them, and avoid the danger of a letter getting lost in the maze of a big corporate system. The effect of the amendment is to allow the name or description of more than one person to appear in the register as responsible for dealing with requests.

I have to say that that would seem to lose much of the benefit of the register entry on this point. Instead of the subject having a clear target at which he should aim his request, he will have more than one—possibly a multiplicity of alternatives. The benefits to the subject (and incidentally for the registrar) in having a single central inquiry point are thereby much diminished.

Perhaps I can put my noble friend Lord Swinfen at ease over the point he raised. Any data user who may not wish to nominate a particular individual by name as responsible for access requests, can instead nominate a post—and I think that this covers his point—in his company as responsible for those requests. That is the purport of the term "description" in Clause 4(3)(f). Thus, if Mr. X may be expected to do the job for only a short time, the user may specify the post filled by Mr. X—for example, "data controller"—allowing Mr. Y to succeed him in due course without any need to change the register entry.

If my noble friend will give way for a moment, the wording in the Bill says:

"the name or description … of an individual —".

The words are "of an individual". I realise that the description could be of a job position in a firm, but from my reading of the Bill a named individual is required.

A data controller is, in fact, an individual, and so I hope that that puts my noble friend's mind at rest. I think I have indicated the reasons why we have doubts about this amendment and why we see merit in confining the register entry in this respect to a single person or post. I would suggest that most data users will in fact wish that to be the case so that as many requests as possible come to a central point from which access requests can be co-ordinated and monitored. I hope for that reason that my noble friend Lord Mottistone will not press his amendment.

That is a disappointing reply, with great respect to my noble friend. I am extremely sorry that I have to address my remarks to him because I am sure he was trying very hard, but he did not take up my point about the need for decentralisation. I am not at all happy that he replied properly to my noble friend Lord Swinfen. I am sure there is another word that would be more suitable than "individual" when talking about a post. I should like to he reassured on that in time.

I should like also to say to my noble friend, if he is able to listen, that he needs to think again. It could well be in Scotland, for example, that somebody who wanted to make an inquiry, because it is requests from data subjects, might not want to write to some Sassenach in London. He would like to write to somebody in the local company which employs him in Glasgow or Edinburgh. This really deserves another think. You want to make quite sure that the definition of "individual" covers a post. The Whitehall view, shall we say, of centralisation being a good thing, which rather came out of the argument, and that you always have one chap sitting somewhere to whom everything is addressed, is not as real as might be indicated. I hope my noble friend can give me a little more reassurance.

I understand the points that my noble friend is making. In the light of what he has said, I shall be happy to consider the point further. If, on reflection, the clear disadvantages of allowing more than one individual to be specified seem to be outweighed by the advantages, then we shall come forward with an appropriate amendment in due course. With that undertaking, I hope that my noble friend will not press his amendment.

That is extremely generous of my noble friend, and I am most grateful to him. May I make a suggestion to him about the problem of having several recordings. One of the frightening things about computers these days is that they have lots of recordings and it is easy to pick out information from them, because that is one of the things that they can do much better than we used to be able to do by hand. They have lots of paper and addresses, and it is quite normal. That particular point is perhaps not as pressing when one assumes, for the sake of argument. that the register is going to be kept on a computer. With that, I beg leave withdraw my amendment.

Amendment, by leave, withdrawn.

moved Amendment No. 50:

With no connection to the fact that the noble Lord, Lord Wigoder, disagreed with my amendment because it would not have fitted his, may I say, while accepting his point that there is a lot to be said for having somebody who is responsible for compliance with the data protection principle, that it is most unsuitable to combine it with the person, or persons, who will be responsible for receiving and dealing with requests for data. You need somebody else, and somebody with quite different qualifications.

The person who is suitable to oversee the compliance with the data protection principles is going to have to be rather a special chap. Not only has he to understand what you might call the human side of the data protection principles, but must also understand the complications of the data equipment. He is going to be rather different from somebody who might be a sort of manager chap who does this accepting of requests. I should have thought that he needs to be a different person. I do not deny that we might need to have somebody of the sort that the noble Lord, Lord Wigoder, spoke about. From that point of view, I still want my amendment, and I do not want his in its present form.

I have listened with interest to the case that the noble Lord, Lord Wigoder, has made for this amendment. I understand why he thinks it would be helpful for the individual nominated by a data user for the purposes of Clause 4(3)(f) to be responsible not only for dealing with requests for subject access but also for ensuring that the user complies with the principles. But, having listened, I am afraid I am not convinced by the case which has been made out by the noble Lord. I harbour serious doubt as to whether any real benefits would be conferred in consequence of it, and whether the proposition it advances is capable of practical implementation.

First, as regards the suggested benefits. Where a data user is an individual, then the person responsible for compliance with the principles is obviously that individual. Where there is an organisation of some kind little value is derived from singling out a particular individual and placing responsibility for compliance of the principles on him or on her. It will not help anyone to have such a person identified when in fact the responsibility will rest elsewhere, or be shared with others, and thus in reality be corporate.

Secondly, even if it were of some value it would not be practical. No single individual in any sizeable organisation will be responsible for ensuring compliance with all the principles by that organisation. Let us not forget the matters to which they apply: the collection of information to be contained in data, for example. Many different individuals may be responsible for ensuring that it is fair. A quite different set of people might have responsibility for seeing that the data are accurate, or adequate, or kept up to date. Someone else will be in charge of ensuring that subject access is granted in the requisite way, and yet another person will look after security.

Of course, at some point in the structural pyramid all these responsibilities will come together, but in many cases that will be at such a high level, given the variety of tasks, and so far removed from day-to-day functional responsibility that to nominate that person would be meaningless. Certainly there would be a strong possibility that he would not be the same person to whom subjects would naturally go with such access requests. Therefore, on the grounds both of the value of the amendment and its practicability, the Government have strong reservations. I therefore ask the noble Lord to withdraw it.

I am grateful for those observations. One must not confuse the distinction between responsibility and day-to-day control. I should have thought that it was not difficult to nominate somebody in an organisation who had the responsibility for compliance with the data principles, even though the day-to-day control was under the immediate supervision of his subordinates. Perhaps the company secretary would in most cases be the obvious person in those circumstances.

I am grateful particularly for the observations of the noble Lord. Lord Mottistone, and in view of what he said about the position, he and I might have a word together to see whether there is a way by which we might jointly present representations on this matter at a later stage of the Bill, but for the moment I beg leave to withdraw the amendment.

moved Amendment No. 52:

Perhaps I may get my own back on the noble Lord, Lord Mottistone, by saying that I entirely agree with every word he said as to the desirability of an amendment on these lines. However, perhaps there is a more effective way of doing it than this group of amendments in his name. I query whether it is desirable to leave a matter of this great importance entirely within the Secretary of State's discretion. I cannot help but think that it might be desirable to prescribe precisely in the Bill the exemptions for which Lord Mottistone is contending.

I suggest that he looks in due course at Amendment No. 155, which is an attempt by the noble Lord, Lord Kennet, and myself to deal with precisely this problem, but to include it in statutory form rather than leave it to the Secretary of State's discretion. The noble Lord will see there that it proposes to exclude information which has,

"been obtained only from the data subject or from published reference material and … not disclosed to any third party".

I agree with the noble Lord that exemptions along these general lines are desirable if the registrar is not to be overburdened, right from the beginning, with a vast mass of material in which no data subject could, I think, have any real interest. I hope that along one or other of those lines the Government will agree that some progress should be made.

I, too, support my noble friend Lord Mottistone. I am sure there are a number of instances where it is not necessary to have the data registered—for instance, lists of applicants and their requirements on the computer of a chain of house agents. They supply the agents with precisely the information they want them to know as to the kind of houses they want, and it can do no harm to anyone to have that on a computer.

I wish briefly to support the remarks of the noble Lord, Lord Wigoder, for the short reason that if we are anxious not to overburden the registrar or the Secretary of State, especially at the commencement of operations under the Bill, can one imagine for a moment the volume of applications there would be for exemption if there were a general provision in the Bill which provided that the Secretary of State could, if he wanted to, exempt? One can imagine, therefore, the number of people who would decide that there was nothing to be lost and everything to be gained if they put in an application for exemption. I support the idea of looking at the obvious exemptions that should be here, but putting them in the Bill and making sure we know what we are doing.

A fundamental feature of the Bill is the requirement on all data users who hold personal data—subject to the most limited exemptions—to register particulars relevant inter alia to their use of such data. This concept of near universal registration is, in our view, essential to enable the registrar to regulate effectively the uses to which data may be put in the United Kingdom.

We have proposed this method of control for a number of reasons. First, the Government believe that only in the most limited of circumstances (covered by Clause 31) should data escape the requirement to be registered. Secondly, there is no such thing as a class of personal data that, in all circumstances, can be guaranteed to be harmless; all such data can be put to uses which can prove sensitive. And it is vital for the reassurance of public concern that there are not significant areas that are not registered and so brought directly and immediately within the ambit of the full complement of the registrar's supervisory powers. We believe that data subjects will want to be confident that the register is comprehensive and will not give a false impression of the scope of the processing of personal data by omitting significant numbers of users. We also believe that the very act of registration will exert a valuable discipline over users that will, in itself, encourage an attitude to data protection that makes abuse and misuse of personal data even less frequent than it is now.

As for the claim that registration is not general practice in Europe, I could not agree with that. A register of some kind is general practice in Europe, that being one of the most obvious ways of meeting the requirement in the Council of Europe convention that anyone must be able to establish the existence of an automated personal data file, its main purposes and the identity and address of those who control it. The notable exception is West Germany, where a wholly different approach is taken to secure data protection. But if we look at France or Austria, or the new laws being prepared in Holland, Portugal and Italy, or even Sweden, to which the noble Viscount, Lord Craigavon, referred, where the law is undergoing change, we find that in all those countries notification to a central register is virtually a universal requirement.

Having said that, I should not wish to suggest that we are unmindful of the burdens on data users. That is why we have been at pains to make the registration procedure as simple as possible, and, for small-scale users with simple uses, such as my noble friend suggested might qualify for exemption from registration, the process of registering will be straight-forward. There will be a simple form to fill in, and a handful of questions to answer. After that, assuming that there is no question of a breach of the principles, there is no reason to expect that the user will become further involved with the registrar. But, if there is any problem (however unlikely that may seem), the data subjects have the reassurance that the user will, by virtue of the fact of registration, be directly and immediately subject to the complete battery of the registrar's supervisory powers.

I have listened sympathetically to those many users who pleaded with us not to place undue burdens on them. The Government's approach to the registration process reflects that. But we cannot go further and allow whole new classes of user or data to be excluded from registration; nor, I have to say, could we entertain the idea that my right honourable friend the Secretary of State could, with no restrictions placed on him and no criteria to guide him, exclude users and data at will. To allow the primary legislation to be potentially emasculated by the exercise of an order-making power is wholly contrary to our parliamentary tradition. Even if the affirmative resolution procedure were provided for in the case of such orders—and no such provision exists in the amendment—such a wide-ranging power would scarcely be acceptable.

Lastly, I ought to point out that the amendments are further defective because the principal amendment would attach not to Clause 4 (which places a requirement on the registrar to maintain a register) but to Clause 5 (which requires data users to register). I hope that in the light of those comments my noble friend will feel able to withdraw his amendment.

I take the force of my noble friend's remarks, and I would make only one point in reply to him at this stage. He said something to the effect that the full rigour of the registrar's capabilities would fall upon people who did not do certain things. I pointed out that under Clause 10 that would be so in any case, whether or not my amendment was accepted. So that argument itself does not cut all that amount of ice. I noticed that among the European countries that my noble friend mentioned he did not include Norway, which I referred to as a country that had had to go towards this solution, having previously had universal registration. I shall myself certainly look to Norway, and hope that perhaps my noble friend may do so, too. I shall also look to see whether we can give to the Secretary of State some guidance on how he might construct his order, and perhaps that could be presented to your Lordships in an amendment at a later stage. In the meantime, I beg leave to withdraw the amendment.

Subsections (3) and (4) each begins with the words,

"Subject to the provisions of this section …"

Those words add nothing to the meaning or effect of the clause or either of the two subsections. Whenever those words occur they are nearly always unnecessary. They are especially inappropriate and unnecessary in this particular place, and I hope that my noble friends on the Front Bench will consider having them omitted at the Report stage.

I should like to raise a rather different point. Under Clause 4(3)(d) a data user has the obligation to enter on the register a description of any persons to whom he may wish to disclose the data. I should like to refer to the question of a data user who wishes to report to the police a suspected fraud upon his organisation, and consequently wishes to disclose to the police certain information that he has compiled mechanically. I raise the point because I should have thought that it was obviously undesirable that when registering every data user should state "the police" as a description of the people to whom he might wish to disclose data in due course.

I think that my query really turns on the meaning of Clause 28(2), where personal data are exempt from the non-disclosure provisions in certain circumstances; and the words "non-disclosure provisions" are defined in Clause 26(3). From that I find it very difficult to follow whether the data user is absolved from the non-disclosure provisions if he wishes to report a matter to the police. I do not ask for an immediate answer; an answer in writing will do admirably.

With regard to the point raised by my noble friend Lord Renton about the words:

"Subject to the provisions of this section",

I shall certainly seek advice, and if we can remove the words, no doubt we shall do so. I think that the points raised by the noble Lord, Lord Wigoder, really relate to Clause 28 in principle, and so I think that it might be best to leave them until we discuss Clause 28.

moved Amendment No. 53:

I know how reluctant is the noble Lord, Lord Mottistone, to have our support; nevertheless, we think it right, despite his discouragement, to do so on this occasion. The need for a code of practice is, we think, clear. I made some comments about this in considering an earlier amendment on Schedule 1 and we think that a code of practice of the kind which could reasonably be devised would be of practical value both to users and subjects of personal data. We accordingly support Amendment No. 53.

There is a further amendment dealing with this matter, Amendment No. 67, which, frankly, we think is preferable, but this amendment, No. 53, also fills a certain gap which would be left if it were not there. We shall support it for what it is worth.

I am briefed on this amendment by the CBI, as my noble friend so rightly indicated. They believe that a requirement for a code of practice to be drawn up before a data user can operate would be disastrous in terms of getting legislation on to the Statute Book within any reasonable time-scale and enabling this country to ratify the Council of Europe convention. They also feel that it is extremely unlikely that this process will be completed within a time-scale acceptable to other signatories to the convention and it is, in any event, highly questionable whether it is practical or desirable in the current climate of changing technologies and practices to seek to reach agreement against the clock on standard codes of practice for different sectors.

Speaking purely for myself, we have a number of professional institutions in this country which operate, within their professions, their own codes of practice—the Bar Council, the Royal Institution of Chartered Surveyors, to name but two. As a nation, we have operated for a very long time on codes of practice being produced by the institutions that have to operate them because they know the pitfalls and the trouble. They know what should be required; and they very quickly learn the tricks of the trade that enable people to get round and through the rules, regulations and codes that are drawn up for them by other people. What I should like the Government to do is to encourage the data-using industry and the computer manufacturers to get together to draw up a code of practice that they can submit to the Government for the Government's consideration.

There is a voice in this Chamber which sometimes sounds and we hear it whether it be from the Woolsack or from the Front Bench opposite—and I believe that that voice was heard to say that there might be inconsistency between Amendments No. 53 and No. 67. I only wanted to follow what the noble Lord has just said by explaining briefly, because I think it may be of use, that there are two ways in which codes of practice may come into existence. One, under this amendment, if the registrar sees fit, he can draw them up himself having sought the advice he finds necessary. Secondly, there is the opportunity for computer users themselves who happen to be in a certain category to draw up their own codes of practice if they want to, submit them to the registrar and ask for his blessing upon them. In those circumstances, they are alternative ways of dealing with codes of practice and they are complementary. I thought it might be useful if I gave that indication now in view of that voice that we love to hear even when it is not intended that we should.

I have been deeply interested by these exchanges as they unravel mystery after mystery. My attention was caught by the fact that, unlike my noble friend Lord Mottistone and the noble and learned Lord, Lord Gardiner, the noble and learned Lord, Lord Elwyn-Jones and the noble Lord, Lord Mishcon, have put their names down to these amendments as well as to those beginning with No. 67 on the Marshalled List. The fact that they may be inconsistent or alternative I do not think suffices to prevent me from teasing noble Lords opposite a bit: either they are so confident that the first amendment will fall that they have put their names on the second—and the second one would be superfluous—or, maybe, it is merely the enormously persuasive presence of my noble friend's name on the Marshalled List which has served to give—

I must, even at this hour, interrupt the noble Lord the Minister. I had hoped that my intervention would stop him from saying what he has just said. The intervention was that there are two ways that codes of practice may come into existence. First, the registrar, if this amendment is passed; and also from the various bodies of computer users, if Amendment No. 67 is passed. They are not inconsistent and, while joining with the noble Lord, Lord Mottistone, on one amendment, however reluctant we may be to do so, nevertheless we reserve our rights to elicit his support on No. 67.

I will not delay longer speculating about what happens if both are accepted. I think we should all find it confusing. I fear that we have, nonetheless, if I may now concentrate on the amendment before the Committee—which is what I should have done before had I not been in a very naughty mood—a number of very substantial objections to the present group of amendments. If I can summary them briefly, first, we can scarcely agree to the registrar drawing up codes of practice without any statutory guidance to him as to what they should contain. He would not know where to begin. And, since they are to have such a far-reaching effect—the force, indeed, of the criminal law—Parliament could not pass its responsibilities to him. There would have to be some parliamentary scrutiny if the criminal law was to be invoked, and that would involve a Minister having to be responsible for putting them before Parliament. Furthermore, while my noble friend shows admirable concern for data users in certain other amendments he has tabled, he is now contemplating placing such swingeing additional requirements on users as are represented by these amendments. I find this surprising. To face prosecution for breach of a code of practice is a formidable—we would say unreasonable—extension of the Bill's requirements.

Finally, let us consider the implications for the registrar. He would be under pressure to see fit to draw up codes of practice for all kinds of bodies. Yet he would know that any code he produced would have to take account of all circumstances that users legitimately going about their business could face; for, if an unforeseen circumstance occurred, and a user breached the code, a criminal offence would be committed. Can we reasonably expect him to be so expert in crystal ball-gazing as to draw up such codes, particularly if they are to be directly enforceable in the courts? The Lindop Committee pointed out that the field to be covered was a very wide one, but thought that with luck it could be covered by a small number of codes. I am not sure that I share their optimism; but even their small number turned out to be 50. The registrar would either be forced into anodyne blandness or he would, as my noble friend Lord Swinfen has said, spend months and months on working out each detailed code; and even then he could be confidently expected not to cover every point that might arise. I have to say that the codes of practice, in our view—by whichever route we arrive at them—pose more problems than they solve, especially in the form presented in these amendments.

I hope that noble Lords opposite will agree with what I have to say. It is up to them to say something else, of course. I find my noble friend's remarks positively like using a 15-inch gun to attack a small rowing boat. I unashamedly like codes of practice. I do not think they are used nearly enough for purposes of this kind. We ought to gain more experience. If we have a new venture of this kind, it is the right approach. I am sorry therefore that codes of practice are thought of as being quite so unsuitable for the occasion. I fully admit that the actual draft of Amendment No. 53 is no doubt suffering from all kinds of shortcomings. I am sure there are other things which could be tidied up. I shall take the amendment away and see whether we can do something about that. If I cannot get it in this Bill, I shall try another one. With that, I beg leave to withdraw my amendment.

Before the noble Lord withdraws his amendment—and again with a promise about brevity—I wonder whether the Minister would answer a short question. I may be wrong about what I am going to say, and, if so, I apologise. If this Bill has no reference to codes of practice because the noble Lord does not like the idea, can he tell me which provision in the Bill, in the absence of codes of practice or any reference to them, makes it a crime if you breach the code of practice?

As I understand it, we are speaking of the implication in the amendment.

The Minister is completely wrong, if I may say so. There is nothing in this amendment which says that it is a criminal offence to breach a code of practice. The whole basis of the Minister's reply rests upon a platform which has collapsed beneath him. Despite the fact that he still sits on his seat with the platform having collapsed, I must say that it is a completely wrong reply to the points that have been made by the noble Lord, Lord Mottistone, my noble and learned friend, and myself.

If the noble Lord looks at the amendment which strikes within this group on Clause 5 then he will find:

"Page 5, line 11, at end insert"—

and so on. I think he will find that this ties it in to the criminal law. I think that that is the intention.

The noble Lord the Minister may think that it is the intention. I have looked at the clause and I do not see any criminal offence created at all. I do not think that the noble Lord, Lord Mottistone, thought that it was going to be a criminal offence to breach the code of practice. I certainly did not. Therefore, as I said, the answer is a bad one.

I did not think it was going to do that, but I embraced that in saying that we have to consider it again and make sure that that situation does not apply.

moved Amendment No. 55:

Clause 5 of the Bill, in effect, enforces the requirement to register by making it an offence to hold personal data, or to provide services in respect of personal data as a person carrying on a computer bureau, while unregistered. In relation to data users, it is also to be an offence for a person to operate beyond the particulars included in his entry in the register. One aspect of this is the prohibition in Clause 5(2)(c) on obtaining personal data from a source not covered by the description in a user's register entry. It would be an offence under Clause 5(5) knowingly or recklessly to contravene this prohibition.

The amendment moved and explained by my noble friend Lord Mottistone would alter Clause 5(2)(c) so as to prohibit a registered data user from seeking to obtain personal data from a source not included within his register entry. The insertion of the words "seek to" would, at first sight, appear to serve two purposes. First, it might be seen as catching the person who only tries to obtain personal data improperly but fails. Here I can assure the Committee that the general law governing criminal attempts will catch the data user in appropriate circumstances. There would seem to be no need or justification for special provision here, especially if the various other prohibitions in this clause are not to be afforded the same treatment. Secondly, it can be argued that the words "seek to" involve an active pursuit on the part of a data user, thus excluding the unintentional contravention. Again, there is no need to amend the Bill. It is only an offence under Clause 5(5) knowingly or recklessly to contravene subsection (2)(c) of this clause. I hope that with that explanation of a strictly legal matter, my noble friend will be able to withdraw his amendment.

It is a small amendment. I shall read with great care what my noble friend has said and reserve the right to come back at the next stage. I beg leave to withdraw the amendment.

I rise with great trepidation as it is rather late in the day, in every sense of the word, to raise a new amendment—

You cannot!

Therefore, I crave—

On a point of order, my noble friend must remember that the Question before the House is, That the clause stand part of the Bill? This is no moment for moving a manuscript amendment.

As always, I am most grateful. Therefore, I stand corrected in more ways than one. If I may just raise this point for consideration, which I hope meets the bill, I should like to crave your Lordships' indulgence for a few brief moments. I have to declare an interest in that I am the president of the British Direct Marketing Association, which covers all forms of direct marketing, including direct mail. The industry is shortly to launch a scheme, the mailing preference scheme, which allows members of the public to have their names withdrawn from mailing lists by writing to a central organisation. I think that this will be of great benefit to the public.

I should like to raise the point that this scheme could be put into jeopardy, due to a certain problem which, unfortunately, arises in the industry at the moment. I refer to the unauthorised use of mailing lists, and the problem is that an unauthorised user of a mailing list may not remove a name which is put into the central register. I appreciate that, at this stage, even if I suggest words they would not he totally right. But we feel that in subsection (1) on page 4, after the word "unless", the words "that person has legal title thereto" should be added. I have changed the words marginally from what I informed my noble friend Lord Elton, because I feel that they should not refer to gender. Therefore the subsection would read as follows:

"A person shall not hold personal data unless that person has legal title thereto and an entry in respect of that person, as a data user…".

I appreciate that this is perhaps not the stage at which to raise this point and I do not even expect my noble friend to reply, but I thought that I ought to bring it to his attention now.

I am obliged to my noble friend for giving me notice of what he was about to say. He raises the question of the application of the Bill to those who trade in lists of names and addresses. I ought first to point out that such list brokers will be caught under the Bill only if they constitute data users or computer bureaux in terms of Clause 1. When they do not, their regulation is no part of the Bill.

My noble friend proposes that Clause 5(1) of the Bill should be amended so as to make it an offence for a person to hold personal data to which he has no legal title. The intention behind what he proposes is to prevent list brokers from holding lists of names and addresses to which they have no legal right. I suggest that it would be very odd to put it in this part of the Bill, which is simply designed to enforce the requirement to register. The proper test to apply to persons who hold data under a Bill concerned with data protection is whether they comply with the data protection principles, and the registrar has adequate powers to take action where a contravention occurs.

Having said that, it will no doubt please my noble friend Lord Redesdale and our mutual noble friend Lord Mottistone if I point out that under the first data protection principle it is necessary that personal data be obtained lawfully. Where a list broker was a data user in terms of Clause 1 and held lists of names and addresses which he had obtained unlawfully, under the Bill the registrar would already have powers quite adequate to take action.

We have now reached the stage in the Bill where it has been generally agreed that we should adjourn. Therefore I beg to move that the House do now resume.