Data Sharing between Public Bodies A Scoping Report Law Commission Data Sharing between Public Bodies A Scoping Report Law Com No 351 Law Com No 351 The Law Commission (LAW COM No 351) DATA SHARING BETWEEN PUBLIC BODIES: A SCOPING REPORT Presented to Parliament pursuant to section 3(2) of the Law Commissions Act 1965 Ordered by the House of Commons to be printed on 10 July 2014 HC 505 © Crown copyright 2014 You may re-use this information (excluding logos) free of charge in any format or medium, under the terms of the Open Government Licence v.2. To view this licence visit www.nationalarchives.gov.uk/doc/open-government-licence/version/2/ or email [email protected] Where third party material has been identified, permission from the respective copyright holder must be sought. This publication is available at www.gov.uk/government/publications Print ISBN 9781474109079 Web ISBN 9781474109086 Printed in the UK by the Williams Lea Group on behalf of the Controller of Her Majesty’s Stationery Office ID 04071405 07/14 41831 19585 Printed on paper containing 75% recycled fibre content minimum ii THE LAW COMMISSION The Law Commission was set up by the Law Commissions Act 1965 for the purpose of promoting the reform of the law. The Law Commissioners are: The Right Honourable Lord Justice Lloyd Jones, Chairman Professor Elizabeth Cooke David Hertzell Professor David Ormerod QC Nicholas Paines QC The Chief Executive of the Law Commission is Elaine Lorimer. The Law Commission is located at 1st Floor, Tower, 52 Queen Anne’s Gate, London SW1H 9AG. The terms of this report were agreed on 1 July 2014. The text of this report is available on the Law Commission’s website at http://lawcommission.justice.gov.uk/areas/data-sharing.htm. iii THE LAW COMMISSION DATA SHARING: A SCOPING REPORT CONTENTS Paragraph Page PART 1: PRESENTING THE ISSUES CHAPTER 1: INTRODUCTION Introduction 1.1 1 Recommendations 1.5 2 Background 1.11 2 Liaison with Government 1.13 3 The consultation process 1.14 3 Current law 1.24 5 Developments in data sharing law and practice 1.76 18 Reform of the Data Protection Act 1998? 1.88 22 The international transfer of data 1.91 22 The meaning of “data sharing between public bodies” 1.94 23 Issues other than the law 1.99 25 Summary of our findings 1.104 26 Devolution and a tripartite project 1.113 28 Outline of this report 1.129 31 CHAPTER 2: WHEN SHOULD PERSONAL INFORMATION BE DISCLOSED? Introduction 2.1 34 Transparency, trust and confidence 2.6 34 Informing the public 2.16 37 Getting the priorities right 2.20 38 Adverse consequences of unauthorised disclosure 2.30 39 Improved practice following unauthorised disclosure 2.38 41 When should information be shared? 2.40 42 Three approaches to information sharing 2.46 43 Questions raised by the approaches 2.53 44 Problems with the approaches 2.68 46 Hybrid models 2.73 47 New public management 2.74 47 PART 2: PROBLEMS UNDER THE CURRENT LAW CHAPTER 3: OVERLAPPING LEGAL REGIMES Introduction 3.1 49 The number and variety of different legal regimes 3.4 49 iv Paragraph Page Professional or sector-specific duties and obligations 3.12 52 Data protection law 3.16 52 Human rights law 3.55 62 Understanding the current law 3.70 66 Flexibility and decision-making 3.88 69 A principled approach 3.99 71 Conclusions 3.101 71 CHAPTER 4: STATUTORY GATEWAYS Introduction 4.1 73 Consultation 4.4 73 Discussion 4.17 75 Lack of power to share 4.25 77 A lack of obligations to share 4.32 79 Restrictive conditions on sharing 4.41 81 Limitations experienced by bodies without common law 4.44 82 powers The benefits of a statutory regime 4.47 83 Conclusions 4.49 83 CHAPTER 5: COMMON LAW Introduction 5.1 85 The Ram Doctrine 5.2 85 Consultation 5.6 86 Private law rights 5.10 87 Confidentiality 5.13 87 Intellectual property 5.28 90 Other private law rights 5.31 91 The importance of private law rights 5.33 91 Managing private law rights 5.36 92 Conclusions 5.39 92 CHAPTER 6: ANONYMOUS INFORMATION Definitions 6.1 93 Anonymous data and data protection 6.13 95 Powers to produce and release anonymised data 6.21 96 Pressures to use identifiable data 6.22 97 Data sharing for research and statistical purposes 6.24 98 Conclusions 6.31 99 CHAPTER 7: PROBLEMS OTHER THAN THE LAW Introduction 7.1 101 Individual reluctance and public trust 7.3 101 Barriers to effective and appropriate data sharing 7.12 103 v Paragraph Page Incentives and disincentives to share 7.18 105 Risk aversion 7.26 106 Resources 7.39 108 Incompatibility of computer systems 7.54 112 A reluctance to use implied or ancillary powers 7.61 113 Data security 7.76 113 Data quality 7.78 115 Conclusions 7.91 117 PART 3: DATA SHARING IN PRACTICE CHAPTER 8: HER MAJESTY’S REVENUE AND CUSTOMS Introduction 8.1 118 Her Majesty’s Revenue and Customs 8.2 118 Legal powers of HMRC 8.13 122 The plethora of gateways 8.43 130 Examples of HMRC’s gateways 8.52 132 Conclusions 8.103 146 CHAPTER 9: DEPARTMENT FOR WORK AND PENSIONS Introduction 9.1 148 Wrongful disclosure under section 123 of the Social Security 9.5 149 Administration Act 1992 Examples of Department for Work and Pensions’ gateways 9.14 152 Statutory debris 9.26 155 Other features of the Department’s statutory powers 9.36 157 Conclusions 9.51 162 CHAPTER 10: THE TROUBLED FAMILIES PROGRAMME Introduction 10.1 163 Issues raised in consultation 10.2 163 Conclusions 10.13 165 PART 4: NEXT STEPS CHAPTER 11: DEVELOPING SOLUTIONS Introduction 11.1 166 Consultees’ support for reform 11.2 166 Consultees’ concerns about law reform 11.12 168 Other considerations 11.25 171 A law reform project 11.43 174 Conclusions 11.60 177 vi Page APPENDIX A: LIST OF WRITTEN RESPONSES 181 APPENDIX B: LIST OF CONSULTATION MEETINGS 185 APPENDIX C: GOVERNMENT INITIATIVES AND 188 PUBLICATIONS ON DATA SHARING vii viii THE LAW COMMISSION DATA SHARING BETWEEN PUBLIC BODIES: A SCOPING REPORT To the Right Honourable Chris Grayling, MP, Lord Chancellor and Secretary of State for Justice PART 1: PRESENTING THE ISSUES CHAPTER 1 INTRODUCTION INTRODUCTION 1.1 Data sharing affects us all. As Lord Mance explained in a recent Supreme Court case Information is the key to sound decision-making, to accountability and development; it underpins democracy and assists in combatting poverty, oppression, corruption, prejudice and inefficiency. Administrators, judges, arbitrators, and persons conducting inquiries and investigations depend upon it; likewise the press, NGOs and individuals concerned to report on issues of public interest. Unwillingness to disclose information may arise through habits of secrecy or reasons of self-protection. But information can be genuinely private, confidential or sensitive, and these interests merit respect in their own right and, in the case of those who depend on information to fulfil their functions, because this may not otherwise be forthcoming.1 1.2 This report analyses the responses to the Law Commission’s Scoping Consultation Paper, Data Sharing Between Public Bodies, in order to decide whether there are inappropriate legal or other hurdles to the transfer of information between public bodies and, potentially, between public bodies and private bodies engaged in public service delivery. We go on to consider whether law reform would mitigate or resolve the problems identified.2 1.3 We conclude that there are problems with the form of the law relating to data sharing that could usefully be addressed. We have also found evidence of problems which are not directly due to the form of the law, but could be alleviated by law reform. 1 Kennedy v The Charity Commission [2014] UKSC 20, [2014] 2 WLR 808. 2 Data Sharing Between Public Bodies (2013) Law Commission Consultation Paper No 214, available at http://lawcommission.justice.gov.uk/areas/data-sharing.htm (last visited 1 July 2014). Subsequent references will be in the form “Consultation Paper, para X”. 1 1.4 The protection of privacy is fundamental to any data sharing regime. Any law reform proposals must reflect a proper understanding of the role and importance of privacy rights and of the disclosure of information in society today. The protection of privacy is an imperative in itself. In addition, confidence on the part of public bodies and of the public as a whole, in the data sharing regime, is vital to making it work. RECOMMENDATIONS 1.5 In this report we make three principal recommendations. Recommendation 1 1.6 We recommend that a full law reform project should be carried out in order to create a principled and clear legal structure for data sharing, which will meet the needs of society. These needs include efficient and effective government, the delivery of public services and the protection of privacy. Data sharing law must also accord with emerging European law and cope with technological advances. The project should include work to map, modernise, simplify and clarify the statutory provisions that permit and control data sharing and review the common law. Recommendation 2 1.7 The scope of the review should extend beyond data sharing between public bodies to the disclosure of information between public bodies and other organisations carrying out public functions. Recommendation 3 1.8 The project should be conducted on a tripartite basis by the Law Commission of England and Wales, together with the Scottish Law Commission and the Northern Ireland Law Commission.