The Coroners and Justice Bill – Data Protection Clauses.
These clauses have already attracted some attention. There is an article by Philip Johnston in The Telegraph (26 Jan). The Information Commissioner has published a commentary on the provisions.
Quite correctly, the IC draws attention to the Information Sharing Clause 152 which provides a definition of information sharing to be inserted at section 50A (3) of the DPA 1998. This goes:
“(3) For the purposes of this Part a person shares information if the person-
(a) discloses the information by transmission, dissemination or otherwise making it available, or
(b) consults or uses the information for a purpose other than the purpose for which the information was obtained.”
At first sight, this looks like an attempt to cover both sides of the information sharing. (a) is the person who discloses the information and (b) is the person who receives the information. So far, so good. However, (a) is disclosing the information for a purpose other than the purposes for which it were obtained, because otherwise the sharing would already be covered. Unfortunately, this means that the person at (a) is also the person at (b), as disclosing in this case is also using the information for a purpose other than the purpose for which the information was obtained. So maybe first sight is wrong.
One can also note the ambiguities in (b). Strictly speaking, the information sharing action applies only to the act of disclosing and the act of receiving. Why should “sharing” apply also to consultation or use of the information after it has been received? That is the subsequent use or processing of the shared information, but it is not the sharing of information itself.
How should we think about information sharing? There is the act of sharing narrowly defined as above, and this is the purpose of the sharing, to get the information from the discloser to the receiver. Then there is a subsequent purpose, say the policy objective in support of which the shared information is to be processed. The subsequent purpose might be a purpose exclusive to the Government Department receiving the information; the Department simply wants a bit more information. On the other hand, the subsequent purpose might be a purpose now being pursued as a shared purpose between departments. One can see that there is a difference between the sharing of information and the sharing of a subsequent purpose, and that they are not the same thing.
When you make the distinction you can see how “specifying the purposes for which the information may be shared 50A(5)(b) ” may not tell you whether the purposes are shared purposes (although it will tell you that the information is being shared), and it is in the former obscured circumstance that the real expansion of the use of personal information by the Government will occur.
Furthermore, this sort of disclosing of information for a shared purpose undermines key concepts of the existing law, with possible constitutional implications – who is the data controller for this shared purpose, and what/where is the organisation processing it? Is the answer the virtual Corporate State?
To complete the picture, 50B (1)(b) provides for the removal or modification of any existing prohibition or restriction on the sharing of information, including that provided by any enactment.
Thus personal information can be shared for broadly defined inter-departmental purposes, on any matter with which a department of the Secretary of State is concerned, on a definition of information sharing and the purpose of the sharing that I for one find difficult to understand.
Further reflections on the safeguard provisions to follow.