Three weeks ago I blogged about the extraordinary and questionable way in which wide-ranging data-sharing powers were being introduced in the UK, buried deep in a Bill with the innocent-sounding phrase “Coroners and Justice” written on the front.
(Incidentally, you can now instantly tell whether or not you are a sad Hitchhiker fan by noting whether or not the phrase “Beware of the Leopard” popped out of nowhere like a large drinks bill as you read that last sentence…).
If you recall, apart from the worrying breadth of the data-sharing powers proposed, the Bill introduced them through the bizarre mechanism of amending another, otherwise quite unrelated piece of primary legislation (the Data Protection Act 1998). Well, I say “amending”… the effect of clauses 152-154 of the Coroners and Justice Bill (CLB) appeared to be to completely overturn the 2nd Data Protection Principle, namely that data collected for one purpose should not be re-used for another.
Well, the story is now appearing, on VNUnet and in the Telegraph Online, that Justice Secretary Jack Straw is to drop the clauses from the Bill and start a fresh attempt to reach consensus on a less sweeping alternative. If true (and both Phil Booth of No2ID and Simon Davies of Privacy International appear to think that it is), this is a welcome concession to the 30 or so bodies which wrote to Mr Straw last week to tell him what a bad idea they thought the clauses were.
According to the VNUnet article,
“Straw will instead ask the Information Commissioner to lead a public consultation on the issue so that public bodies can share information where there is a clear benefit – for example, previous reviews have highlighted the many different agencies that need to be informed when someone has died.”
That’s all well and good, but in citing the hoary old ‘bereavement’ example it almost entirely misses the point. If the proposals are intended to allow public sector organisations to share data where there is supposedly a clear benefit to the citizen, then the key criterion to be satisfied before any such sharing takes place must be: does the citizen in question want it to happen?
If I choose to be obliged to contact multiple agencies should I have to notify them of someone’s death, that choice ought to be mine, and I ought to be allowed to make it on the basis of helpful information about the risks, as well as the potential benefits, of allowing my data to be shared. Until the principle of informed consent is more rigorously applied to plans for the sharing of citizens’ data, any new proposals are likely to be just as unacceptable as the one which, I hope, is about to be consigned to the drafter’s bin.