Official Report: Minutes of Evidence

The Chairperson (Ms Maeve McLaughlin): You are very welcome, folks. We have Les Allamby, the chief commissioner; David Russell, the deputy director; and Fiona O'Connell, a researcher. We invite you to make an opening presentation, and then we will open it up to comments or questions.

Mr Les Allamby (Northern Ireland Human Rights Commission): Thank you and good afternoon. I intend to make a short statement, after which I am happy to take questions from you, Chair, and your colleagues.

The purpose of the Bill is to allow the Department and other bodies to utilise health and social care information that identifies individuals. That is for the purpose of furthering the interests of improving health and social care or meeting the public interest. The Bill also sets out that there will be a regulatory framework, although most of the fine detail of that will be set out in regulations.

The explanatory and financial memorandum is very open about the policy objective behind this: to minimise the risk of legal challenge facing the Department and Health and Social Care bodies where individuals are readily identifiable from the use of secondary data for research or other purposes. Our starting point at the Northern Ireland Human Rights Commission (NIHRC) is that we recognise the value of the policy premise behind the Bill: secondary data — in other words, information beyond the direct care of the individual — can have genuine value for research, policy planning and, ultimately, the delivery of health and social care services, as well as for other services whereby the aim is to promote societal good.

There is a common law duty of confidentiality, which is based on court judgements, and there are three circumstances in common law in which disclosure is allowed. The first is when consent has been freely and genuinely given; the second is when there is a statutory basis that either allows or requires such a disclosure; and the third is when the balance of public and private interest favours disclosure. The first two are relatively straightforward, and it is the third that has traditionally been much more complex when deciding what is the balance of public and private interest, and, in making that decision, you may reach a decision that the courts ultimately decide is different. Worry about courts entering the domain has had a potentially chilling impact on making the best use of secondary data. The Bill will override the common law duty and replace it with a new statutory provision.

Among the issues that the commission looked at was the use of the data for the purposes of public interest. Public interest is extremely widely drawn. It clearly stretches beyond health and social care, and, initially and in our submission, we suggested that it might be more narrowly defined — for example, to cover health and social care and public safety. There is a downside to that, in that, if you narrow the scope of the use of secondary data to public safety as well as health and social care, there may be other legitimate purposes that you would use the data for, and you would be back into the common law duty. On reflection, there is an alternative approach, which is to leave public interest as it is in the Bill but ensure that the safeguards are robust enough so that, for example, you could ensure that the factors that need to be considered when assessing what the public interest is could be articulated very clearly in the code of practice. You could — I will come back to this briefly — make the code of practice something that "must" be followed rather than something that you merely "have regard to".

There is recent case law in the European Court of Human Rights on the issue. It comes from a case called L.H. v Latvia, the judgement for which was given in July 2014. The court held that the lack of precision in domestic law in Latvia in allowing public authorities to collect medical data was a violation of article 8 — the right to respect for private life. There is a very useful short paragraph from the judgement that we included in our submission and that I think crystallises the issues very clearly and neatly and that illustrates the value of the Bill:

It seems to me that the Bill, by providing for the situation, codifying it in law and providing a number of safeguards, would deal with a number of the concerns that were raised in the Latvian case. On that basis, we welcome the setting up of a committee. We think that it should either be a requirement, although I have no reason to doubt that the Department intends to set up a committee, or perhaps, in the alternative, it would be useful for the Health Committee to ascertain how long the Department intends to take to set up a committee.

It states that regulations may be made to deal with reporting and publication, which might be an area worth exploring. It is important to clarify exactly what reporting and publication of authorisations they have in mind. I do not know whether that is an annual report that would come to the Assembly or something else, but, at this stage, it would be worth clarifying the Department's thoughts on that issue.

It is important to be mindful of diversity issues on the committee and to ensure the inclusion of people with experience of disability issues, both first-hand and other knowledge, gender issues and cultural issues. Those will all be important in areas in which data may be valuable and useful and mined for other purposes. It is important to involve people who have been at the sharp end of those experiences, and I can imagine that there are diseases and illnesses that are much more gender-specific than others. There is an opportunity to deal with that. It would be helpful to ascertain from the Department how it would ensure that that is done in practice.

There is also the code of practice. It must be prepared "as soon as reasonably practicable" and then published. I am not sure what "as soon as reasonably practicable" means in practice, and it would be helpful to ask the Department for a timetable so that this Committee and other interested parties get a sense of how long that might take. It would probably be valuable if, rather than the legislation stating that Health and Social Care bodies "must have regard to" the code of practice, perhaps to strengthen it by stating that the code of practice must be complied with and, in particular, should address the specific article 8 safeguards. There is interesting case law in public law terms on the issue of guidance and circulars and whether or not they are binding on public authorities. It often depends on the language and on how it is framed and used, and courts have taken different views on different types of guidance. It would probably be better to have the certainty of saying that the code of practice, which is very important for this legislation, should be complied with and, in that way, put it beyond peradventure.

Those are our short and relatively sweet comments. Overall, this is an important Bill, which the commission will support, albeit with what we think are sensible additional safeguards.

The Chairperson (Ms Maeve McLaughlin): Thank you, Les, for that. The Committee has had a number of conversations on the fundamental issues in this important legislation. We have expressed concerns from the outset about public interest, social well-being, definitions and safeguards. I am particularly interested that you say that the legislation is too wide. I am also interested in the Bill's compliance with European human rights legislation.

Mr Allamby: My colleagues may want to come in on this. Public interest is a widely drawn term, and I have some understanding of why you would want to draw it widely in that you would not want to circumscribe what value you might be able to utilise for secondary data. On the one hand, I can see why, by drawing it widely, you ensure that you have as great an opportunity as possible to use secondary data for very useful societal purposes. On the other hand — on reflection, this is where we have come to — if you have a term as widely drawn as "in the public interest" — my understanding is that that has been used relatively sparingly in England and Wales for the purposes of data — you probably need very strong safeguards to ensure that everybody is clear about what is meant by public interest. That is where the code of practice could come in, because it could state the factors that you should look at and what you need to take into account when you decide what is in the public interest, and the balance that is needed to ensure that people are reassured.

My earlier quote referred to people whose data is being used. From brief discussions that I have had, I know that most people are comfortable about their data being used for good, sensible societal purposes when they know what those are. If people are reassured that their data will be used for those kinds of sensible purposes, that makes sense. That is probably a better route than to narrow public interest and not be able to take opportunities to use secondary data that everybody around this table would probably support.

The Chairperson (Ms Maeve McLaughlin): Your submission mentions replacing "public interest" with "public safety".

Mr Allamby: Yes. Originally, we discussed using "public safety" on the basis that that would be narrower than "public interest", which is much broader. It is about looking beyond health and social care in what might be utilised. We reflected on that, and, on balance, we felt that, if you could deal with this by way of clearer and stronger safeguards through the code of practice — the role of the committee, how it publishes, when it gives authorisations and on what basis — I would be more comfortable about retaining the public interest.

The Chairperson (Ms Maeve McLaughlin): Is there an option to remove public interest and be clearer about the purpose of the Bill?

Mr Allamby: That is an option. The downside is that, if there were other legitimate reasons to use secondary data that went beyond health and social care, you would have to fall back on a common law approach, and the Bill is clearly designed to try to move away from that.

My understanding is that, if people take a cautious view, and there is a survey that looks, for example, at health data beyond Northern Ireland, one issue would be whether our secondary data would be utilised as part of a much bigger study. If we did not have the Bill, or if you were to use the data beyond health and social care, there might be issues in that we might not be part of a much wider survey.

You are due to hear evidence from the Rare Disease Partnership. That is a good example, because the numbers in Northern Ireland are very small, but people might want to be part of a bigger study in other parts of the UK.

The Chairperson (Ms Maeve McLaughlin): What about my question on compliance with the European Convention on Human Rights (ECHR)?

Mr Allamby: On balance, provided the safeguards are clear and robust — it would be worth strengthening them to be absolutely sure — the code of practice should contain a clear articulation of article 8. Article 8 and your right to a private life is a qualified right: in other words, if you are going to use somebody's personal data, it has to be in accordance with law and necessary in a democratic society. There are a number of safeguards on that.

If should be made clear that, in giving authorisations, you have to be mindful of article 8 rights. The explanatory and financial memorandum is clear about that. It states that the Bill does not override — neither should it — the Human Rights Act or data protection provisions. There are ways in which you could do that.

The Chairperson (Ms Maeve McLaughlin): As the Bill stands, do you think that it is compliant?

Mr Allamby: We have not taken legal advice, but we looked at this issue and were interested in getting more detail on what legal advice was taken to make it compatible with article 8. That is a long-winded way of saying that, on balance, we think that it complies with article 8, provided those safeguards are followed through.

The Chairperson (Ms Maeve McLaughlin): On balance, provided the safeguards are followed through, do you think that the Bill is compliant?

Mr Allamby: Yes. We are taking it at face value that the Department will set up a committee and that the code of practice will be thorough, comprehensive and detailed. With those caveats, the Bill would meet article 8.

The Chairperson (Ms Maeve McLaughlin): If those safeguards were built in.

Mr Allamby: Yes. Part of the Committee's role will be to ensure that those safeguards are as robust as possible.

The Chairperson (Ms Maeve McLaughlin): It might also be useful to get the Department's view on the Bill's compliance, given the wide interpretation of processes like public interest or social well-being.

Mr Allamby: The Department said that it will produce regulations that set out how authorisations will be given and that those will be published. We want to see exactly what that means in practice.

The Chairperson (Ms Maeve McLaughlin): David, do you want to comment?

Dr David Russell (Northern Ireland Human Rights Commission): When we looked at paragraphs 15 and 16 of the commission's submission, we thought that it was pretty clear where the Department had got its language from. The phrase "public interest" obviously derives from the EU directive. The EU directive talks about substantive public interest, and the Council of Europe's Committee of Ministers uses similar language. The phrase "public interest", in and of itself, is not strange when it comes to the standards that the commission looks at. The question that you rightly raise is the extent to which, in domestic law, the subsequent protections are sufficient to meet the article 8 test, but the language itself is not unheard of. It obviously comes from the EU directive.

The Chairperson (Ms Maeve McLaughlin): This goes back to the conversation on the purpose of the legislation and the intent of the Bill. It is critical. A number of members wish to speak.

Mr Easton: Thanks for your presentation. Is it fair to say that you generally support the Bill, but some changes are needed?

Mr Allamby: Yes, it is. We can see the underlying purpose of the Bill, which is to use secondary data for legitimate purposes such as research. It will be useful for the prevention of diseases, the underlying causes of ill health and so on. We can accept that there may be issues beyond health and social care that have perfectly legitimate reasons for using secondary data. We are saying, however, that you have to be mindful of the use of that data, which can be identified for individuals in circumstances in which people have not given their consent. The Bill allows you to avoid scrutiny of the courts in general terms, so it must have clear, firm, robust safeguards. Much of the detail of those safeguards will be in regulations rather than the Bill. The regulations may bring forth a variety of different forms of those safeguards, but we want to be sure that the safeguards are firm and robust. If they are, we are comfortable with a Bill that makes public policy sense.

Mr Easton: You touched on how you would like the committee to be made up: do you have any thoughts about its size? Would you like more people from the health sector or laypeople on it? What membership breakdown would you like?

Mr Allamby: I should not be prescriptive about the kind of background, but it would make immense sense to have a mixture of lay and professional people. It would be very helpful to have one or more people on the committee with experiential knowledge — people who have suffered ill health and disabilities. As I said, it needs to be recognised that certain forms of ill health are much more prevalent in one gender than another, so we need to be sure that gender representation reflects some of those issues. Speaking as a middle-aged man in a grey suit, we could ensure that not everybody sitting around the table is a middle-aged man in a grey suit. There are good reasons why the committee should have an appropriate balance of culture, disability and gender.

Mr Easton: You want the code of practice to be set up as soon as possible and to be complied with. If someone broke the code of practice, what type of sanctions would you like to be in place? Penalties are mentioned in other submissions, but the Bill is quite loose at the moment.

The Chairperson (Ms Maeve McLaughlin): Level 5 fines are mentioned.

Mr Allamby: The Bill has provision for sanctions. There are a range of sanctions that make sense, from the very serious breach at the top end, which is in the Bill, to other ways. One reason for a code of practice that is strengthened by saying that it must be adhered to is that it moves away from an argument about following the code rather than having only due regard to it. Presumably, having regard to a code of practice can mean anything from, at one end of the spectrum, saying, "There's that code of practice", and that is how seriously you take it, to the other end of the spectrum, where you really do take it seriously. That ambiguity is avoided if you say that you must comply with the code of practice. You can still write a code of practice that allows you, in some cases, a genuine, well-ordered and sensible discretion, but at least it pushes you into having to have regard to it.

I do not know about sanctions that are beyond the sharper end. I would have to go away and think about what would make proportionate sense. Sanctions need to be proportionate to breaching the code of practice. Those would go from very serious sanctions to less serious but significant sanctions. There should be a range.

Ms Fiona O'Connell (Northern Ireland Human Rights Commission): We welcome the fact that there is a maximum sanction and that it complies with guidance, but we note that the Bill also refers to other procedures. We recommend that the Department be asked to indicate what those are, because it is not clear whether they are administrative, employment or disciplinary. The Committee might want to ask the Department about that.

Dr Russell: Part of the reason why we asked for the code of practice's obligation to comply to be strengthened is that the commission cited the case of Khan v the UK, and the court has considered the issue of guidelines in the past. It said that, when it is neither legally binding nor publicly accessible, that could not satisfy the requirement for accordance with the law under article 8, since article 8 is the focus. That is why we have come out so strongly about using the words "must comply" rather than "have regard to".

Mr McCarthy: Thanks very much for your presentation. My question is largely set against the background of what the Chair asked for in relation to the term "public safety" as an alternative to "public interest". Is it sufficiently robust and understood in case law to capture fully all potential health benefits that arise from the authorised use of data in particular circumstances?

Mr Allamby: I think that I addressed that in our reflections. Hand on heart, if the phrase "public safety" were used, would that leave room for the legitimate use of secondary data for other purposes outside the Bill? The answer to that is probably yes, which is why I posited the alternative, which is to retain the phrase "public interest" but to be sure about the safeguards, including setting out what the factors are in practice when considering the public interest. Your point is legitimate: if you wanted to use secondary data for other planning purposes — transport, education for people with particular needs, or something else — would that fall within public safety and health and social care? You might get into a debate about whether or not that falls within the Bill. That is the problem with narrowing the definition. On the other hand, you do not want "public interest" to be used as a code for anything that someone decides is in the public interest. That is where you want safeguards to make sure that there is a much clearer articulation of what we mean by the public interest. My view of the public interest might be different from yours, Kieran, or Paul's or anybody else's around the table.

Ms O'Connell: When we were writing our submission, we used the term "public safety" because it reflects the language in article 8 of the convention.

Mr McCarthy: That is fair enough.

Ms McCorley: Go raibh maith agat, a Cathaoirleach. Thank you for the presentations. You have referred to your view on the use of the language in your written material. There is "may provide" in a couple of places and "may set up a committee". What do you think about that? We have formed a view that it has not been put together strongly enough. Do you view it that way?

Mr Allamby: The use of the word "may" gives the Department the discretion to do it or not. I have no reason to doubt the Department's bona fides that it intends to set up a committee, for example. However, the legal position is quite clear. If you "may" set up a committee, then you equally may not. Therefore, it is within your discretion. If you "must" or "shall" do something, you have no choice but to do it. I think that, in this case, it would be inconceivable that the Department would set this legislation in train and then not have any safeguards, but it puts it beyond doubt if you use the word "must", and that is the advantage of it.

Ms McCorley: I agree. It just makes me wonder why the Department did not say "must". It is hard to understand the purpose of saying "may", because it leaves an option.

Mr Allamby: I do not know what the thinking of the Department is; I am not privy to it. It is one to ask the Department. This is speculation on my part, but it is not the first time that Departments and Governments have given themselves latitude in being cautious about those things. It is clear that this will only provide genuine public confidence if there are proper safeguards. So, in this context, I cannot see the advantage of the Department giving itself discretion. It seems to me that it has committed itself to setting up a committee. The sequencing of this is really important. I do not think that you can implement this Bill, in practical terms, without those safeguards being in place. So the code of practice and the committee should all be commencing, in effect, pretty much at the same time, so that you can ensure that any purposes for use of health and social care secondary data has the kind of authorisation process in place and has the code of practice published so that people understand what the safeguards are.

Ms McCorley: Yes, that is it. This is about sensitive personal information, and it needs to be as robust as it can. Clause 1(2)(d), which has been referred to, is about making it an offence. Do you think that there is merit in saying that that should be in the Bill itself rather than left to regulations, so that there would be a robust punitive measure that would be very clear?

Mr Allamby: Yes, but the sanction is in the Bill, at least up to level 5. I think clause 1(2)(d) says — from my recollection — what the maximum sanction would be.

The Chairperson (Ms Maeve McLaughlin): The Bill says:

Ms McCorley: Yes, but it reads: "Regulations...may make provision". I am just saying that it could be more robust.

Mr Allamby: Probably. Again, I have no reason to doubt that there will be other sanctions, and it is the same thing, arguably. It would put it beyond peradventure if the Bill said "must". That would clearly ensure that the Department had no choice but to do it, and it is the same argument as with the other provisions about using the discretionary power as opposed to a mandatory power to do something.

The Chairperson (Ms Maeve McLaughlin): I have one other question on the opt-out. We had a discussion about the opt-out and consent in relation to sharing secondary information. You touched on it, Les, but we would like your views on it. Again, is there any impact on human rights if opt-out is not provided for or if consent is considered irrelevant? What are your views from the human rights perspective on that?

Mr Allamby: This Bill, as I understand it, allows you to use the secondary data without having everybody's consent. It provides greater safeguards than exist in common law, so you do not have to go into the kind of justification for common law purposes. However, if somebody said, "You used my secondary data for illegitimate purposes", then the question for article 8 would be to look at the facts of the case and what safeguards were there. The issue would be whether those safeguards were sufficiently robust and precisely defined in the circumstances of the case.

The Latvian case is a good example of why confidentiality of personal information is of fundamental importance. If you are going to breach that right of privacy, you must have clear and precise reasons in law, and they must meet a number of qualified rights.

I cannot give you a yes or no answer other than to say that the Human Rights Act and convention rights still apply. I am not sure that you could have a provision for an individual, as opposed to a group, to opt out and what the circumstances would be. I am not sure what provision would need to be in place for that.

For example, would the committee that authorised the use of data be given the kind of information that one person in 300 did not wish to participate as opposed to 50 out of 300? I am not sure what the mechanism would be if you are not getting people's direct consent in the first place to use their secondary data. It is not an area I know enough about to know how that works. I think you have witnesses from other organisations this afternoon, such as the Cancer Registry, who may be able to tell you the practical ways of dealing with that.

The Chairperson (Ms Maeve McLaughlin): It seems that a lot is riding on the safeguards.

Mr Allamby: Yes, that is a fair comment.

The Chairperson (Ms Maeve McLaughlin): Allowing for even article 8, the other issue that we have not really touched on is social well-being. Clause 1(11)(b) refers to:

It seems to me that "any other similar circumstances" is unusually broad.

Mr Allamby: It is very widely defined. It would still need to be for some legitimate purpose. If it came down to a court having to look at this, I suspect that it would want to interrogate what that legitimate purpose was, albeit recognising that this is drafted in very broad circumstances.

If the committee that provides the authorisations is doing its job properly, it ought to be interrogating what you want the data for — its purpose, the societal benefit and public interest — and taking account of the fact that you are using people's data, and that people may be recognised as a result, and the importance of that against the purpose you are doing it for. Your authorisation process should be saying clearly that, on balance, the potential good that will come from this justifies any potential issues that might arise for the individuals concerned from using secondary data.

The Chairperson (Ms Maeve McLaughlin): There is a potential, as things stand, that that is not human rights-compliant, surely, if "or any other similar circumstances" is not defined?

Ms O'Connell: In the Latvian case that Les mentioned, there was a violation not just because the law was not formulated with sufficient precision but that it did not sufficiently clarify the scope of the discretion conferred upon the authorities. The law would need to be very clear.

The Chairperson (Ms Maeve McLaughlin): So it was not defined.

Ms O'Connell: It was not drafted with sufficient clarity to highlight the scope for discretion.

Mr Allamby: It is defined very broadly. The legal issue, if it is defined as broadly as that, would be about the safeguards and how they work and the proportionality of what was being done. So, you would still have to go through some process of justification. You would not able to simply say, "It says 'other circumstances', so we can do what we want". If the safeguards are robust, and you can proportionately justify it, fine, but that is possibly what you would have to do.

The Chairperson (Ms Maeve McLaughlin): Finally, if there was, for example, consideration given to replacing "public interest" with "public safety", surely you would need to be very specific that means public safety for health purposes?

Mr Allamby: Yes. The difficulty, and this is what we reflected on, is that if you define it as "public safety" and take out "public interest", I am not sure that that confines it to health and social care. There might be other public safety issues that you are looking at, so it is not confined to that.

The more difficult issue is that the Bill might fall foul if you wanted to use secondary data for, as I said earlier, education, transport, planning or some other purpose. The question would be whether that is public safety or health and social care. You then move into a much more difficult definitional debate. That would require someone to be unhappy with why you are using the secondary data in that way, but it does narrow the potential use of secondary data. You have to weigh that up against the kind of public confidence there needs to be. You can get that public confidence if the safeguards are clear, transparent and robust.

Mr McKinney: I just want to clear that up. Are you saying that getting enough definition, enough around safeguards and enough around a committee would be sufficient to allow no opt-out?

Mr Allamby: Potentially, yes, that is what I am saying.

Mr McKinney: Where does that fit into my right to not want to share that information?

Mr Allamby: The whole purpose or rationale of the Bill is to make it much more difficult for someone to take legal action. The common law duty was that you had to get somebody's consent. You can opt out in common-law terms unless there is already a statutory purpose that says you can override somebody's consent. Then, there is a second provision that states that you can override somebody's consent in common law terms. The Bill is strengthening that. So, the idea that you will have an absolute right to opt out with this Bill is not correct.

The Bill will not allow somebody to say, "I don't want my data to be used". This is about using secondary data, so it does not involve going round everybody whose secondary data you want to use and asking, "Can I have your permission?". There would not be any purpose to the Bill if that were what you were doing. I do not know the fine detail of how that is currently managed, but the Bill is effectively saying that there are some circumstances in which we can use secondary data without going to go to every person affected and asking, "Do you mind if we use your data?".

Dr Russell: We do not know — maybe the Department can provide the answers on this — practical examples of where "public interest" might be used and how secondary data could then be transferred between Departments or public authorities, for example. One example of an area where secondary data is used and where there are no opt-out clauses is the religious belief of children in schools. The Department of Education uses secondary data on that issue, and it releases it into the public domain. Obviously, article 8 is engaged for the individuals when they are registered in schools, but that data eventually finds its way into the public domain for research purposes in a way that means the individuals cannot be identified. That use of data is clearly proportionate, subject to a legitimate aim. There are examples already in public life where data is captured from an individual source, but the way in which it is transferred out is perfectly proportionate.

Mr McKinney: Is that sufficiently covered in the legislation as it is presented to us?

Dr Russell: There is a potential, as Les says, for it to be totally compatible with article 8, but it is entirely subject to a lot of the things that will come forward in the regulations, including the safeguards and the issues that we have addressed and discussed around the "musts" as opposed to the "have regards".

Mr Allamby: It is not satisfactory. I know where you are coming from. On balance, if you get the safeguards right and they are properly provided for, we are comfortable that this would be within article 8. It could be utilised in such a way that somebody could make a terrible judgment call and the safeguards could turn out not to be as robust. There are all kinds of things but, on balance, looking at it as it stands, if it is applied properly, if the Committee is rigorous in its approach and if the code of practice is comprehensive — these are lots of "ifs" — we are comfortable with it, but we want to make sure that all those things are in place. It would be helpful if the Committee could ask the Department the kind of questions that make sure that that is the case. We want people to see the code of practice, have a chance to comment on it and ensure that it addresses article 8 issues with all those caveats. That is a yes, but it is a yes subject to all those caveats.

Dr Russell: The other thing that is extremely useful, as Les said in the opening presentation, is the fact that the regulations will be subject to affirmative resolution. That is an extra safeguard for the legislature.

Mr Allamby: I am tempted to say that "brevity" and "the Human Rights Commission" are not very often heard in the same sentence.

The Chairperson (Ms Maeve McLaughlin): I thank all three of you for attending. It has been useful. We will reflect on what you have presented today. Thank you for your time.