The “Coroners and Justice Bill” has been placed in front of Parliament. Does this sound a little irrelevant to a privacy article? Not if you look in the small print of the Bill…
The Coroners and Justice Bill goes for second reading in the Commons next week. It contains a wide variety of items, including registration of deaths, handling of offenders, provision for security of court buildings and recovering proceeds of crime. One of its stated purposes is also “to amend the Data Protection Act 1998”. So what’s in it for the DPA?
Take a look at the text below – the really interesting bits are highlighted:
Coroners and Justice Bill
Part 8 — Data Protection Act 1998 (c. 29)
50A Power to enable information sharing
(1) Subject to the following provisions of this Part, a designated authority may by order (an “information-sharing order”) enable any person to share information which consists of or includes personal data.
(3) For the purposes of this Part a person shares information if the person–
(a) discloses the information by transmission, dissemination or otherwise making it available, or
(b) consults or uses the information for a purpose other than the purpose for which the information was obtained.
(4) A designated authority may make an information-sharing order only if it is entitled to make the order by virtue of section 50C and it is
(a) that the sharing of information enabled by the order is necessary to secure a relevant policy objective,
(b) that the effect of the provision made by the order is proportionate to that policy objective, and
(c) that the provision made by the order strikes a fair balance between the public interest and the interests of any person affected by it.
(6) An information-sharing order may not enable any sharing of information which (in the absence of any provision made by the order) would be prohibited by Part 1 of the Regulation of Investigatory Powers Act 2000 (c. 23) (communications).
50B Information-sharing orders: supplementary provision
(1) An information-sharing order may–
(a) confer powers on the person in respect of whom it is made;
(b) remove or modify any prohibition or restriction imposed (whether by virtue of an enactment or otherwise) on the sharing of the information by that person or on further or onward disclosure of the information;
(c) confer powers on any person to enable further or onward disclosure of the information;
(d) prohibit or restrict further or onward disclosure of the information;
(e) impose conditions on the sharing of information;
(f) provide for a person to exercise a discretion in dealing with any matter;
(g) enable information to be shared by, or disclosed to, the designated authority;
(h) modify any enactment.
So, under this amendment, any designated authority (which for RIPA means pretty much any public authority at all) can make an ‘information sharing order’ to share personal information. This seems to circumvent whatever purpose the information was gathered for; for example, child protection data could be shared with police, benefits officials or your local school. And that sharing can be done if it’s considered necessary for the authority to achieve a policy objective, or is in the interest of the greater public good – so the ‘think of the children’ argument is now applied to all personal information held by public authorities. Furthermore, the sharing process can include publishing that personal information.
This means that any public authority can publish your personal information if it believes that will help it achieve whatever crackpot policy objective it has come up with. Want to name and shame any household that the council believes is not recycling enough? No problem! Publish a list of individuals with criminal records? Go for it!
The government is in the process of awarding itself almost complete exemption from the Data Protection Act, and is doing so by squeezing it through on the back of a broader Bill in the hope that the public won’t notice, and any right-thinking MP or Peer should oppose this amendment at every stage. RIPA, which claimed to have controls built in, has completely failed to exert those controls, and there is every reason to assume that the same failures will apply here.
[with thanks to Caspar who brought this to my attention]