Official Report: Minutes of Evidence

The Chairperson (Mr Maskey): I formally welcome Dr Ken Macdonald and Ms Shauna Dunlop. I should explain that this is not a formal evidence-taking session, in so far as the Bill has not been formally transferred by the Assembly to the Committee for consideration, but we are trying to be prudent, given the time frame and what happened with legislation towards the end of previous mandates. We are one step ahead of ourselves, but this is still an important opportunity for us to hear evidence from experts in the field such as you. Without further ado, I look forward to hearing your remarks this morning.

Dr Ken Macdonald (Information Commissioner's Office): Thank you very much, Chair. We are pleased to be here to give evidence on the proposals under the Housing (Amendment) Bill. Our role is to regulate the Data Protection Act 1998 (DPA), which is a reserved matter throughout the UK. The Act has repercussions for anything that is done with personal data. Our brief written submission to the Committee outlined the general areas where we might have some concerns and very much related those to the eight principles of data protection with which, under the Data Protection Act, it is essential to comply.

As you will see, we highlighted the fact that the processing has to be what we call "fair and lawful". Without going into the technicalities, the passing of the legislation is one way in which a form of processing would become lawful. Fairness, however, relates to the understanding by individuals of what will happen to their information. It is essential, especially where there may be intrusion into somebody's sensitive life — sensitive includes allegations of criminal activity and other convictions — that the individuals are told what might happen to the information. Here we have proposals for sharing what could be quite innocuous information: yes, there has been an incident of antisocial behaviour, but when did it take place, what were the circumstances and so forth? People's expectations have to be met, and that is done through fair processing. Therefore, people should be made aware at the time of signing contracts etc of the likelihood or possibility that, if they engage in certain types of behaviour, that will be disclosed for the purposes outlined in the Bill — for those purposes, and no other purposes. That must be in the tenancy agreement.

Our submission also notes that the information has to be "relevant, adequate and not excessive", and that is where it gets a little subjective. The issue here is disclosing aspects of antisocial behaviour, but exactly what is the threshold at which the disclosure needs to be made? Is it a one-off instance? We would be very uncomfortable with that. Is it a repeated set of behaviours that caused a lot of detriment to neighbours and the community? That would be much more acceptable to us. That might have to be in guidance provided by the Department once the Bill is passed, if it is. Nevertheless, we have to make sure that it is understood that there has to be a reasonable threshold before that sort of information is passed on. Another question to ask is when exactly the incident happened. Information about an isolated incident, or a series of small incidents some years back that has not been repeated, really should not necessarily be passed on at a later stage. It is like convictions becoming spent, so use similar principles and ask whether the information is relevant at the time. It might once have been, but, as individuals change and mature, antisocial behaviour declines.
The submission refers to the need to keep the information for only as long as is necessary, and that relates to the same issue: for how long does any authority hold information on the more negative aspects of a person's behaviour? Is it five years, one year or is it dependent on the type of activity? Has there been a warning from the police? Has there been a conviction? A proper timescale is needed for all of that.

We stress that the sensitivity of such information means that it needs to be kept securely. That, too, will be covered in guidance rather than in the Bill. However, if information of that type is being passed on to another body, it has to be done in a secure manner. We have a concern about the possibility that the Bill would extend outwith social landlords in the public sector to private landlords. Not all private landlords are necessarily as well constituted as social landlords, and we would be a little uncomfortable with the possible additional risk of information being mishandled and their not complying with the Data Protection Act.

Those are our main points. We welcome any questions and are happy to provide any clarification that you ask of us.

The Chairperson (Mr Maskey): Before I bring in members, I have one question. The Housing Rights Service has suggested an additional clause that would put on a statutory basis any guidance issued by the Department to whichever organisations are brought into the loop of sharing data: do you have a view on that?

Dr Macdonald: We always welcome guidance of that sort being put on a statutory basis. We would be happy to work with the Department to ensure that it gives appropriate guidance on compliance with the Data Protection Act.

Mr Allister: One thrust of the legislation is to assist in dealing with the multiple problems that antisocial behaviour throws up in the housing sector. You touched on the fact that the Bill does not extend to private landlords, and I want to explore with you a little of your reasoning on that. However, the failure of the Bill to apply to private landlords creates practical difficulties, in that a disruptive tenant in the social sector can simply walk around the corner to a private landlord and resume his destructive behaviour, affecting all and sundry around him, there being no facility for the sharing of information. There is no impediment to that. Do you understand the view of some that, if we want to address antisocial behaviour, we need to extend the Bill to include the private sector?

Dr Macdonald: I understand the point that you make. Our concern, as regulators of the Data Protection Act, is to ensure that the information that is kept will be processed in compliance with it. One of the Act's objectives is to ensure that the processing of information is not excessive. To remedy our concerns, we could look at the expectation that I would certainly have that, if I was seeking to rent premises in either the private or the public sector, a reference would have to be provided. References can be worded in a way that does not disclose the nature of concerns but still makes it strongly evident that you might not support leasing property to an individual.
.

Mr Allister: Could a reference not be the transfer of data?

Dr Macdonald: It could be, but you do not need to put all that information into a reference. A reference could read, for example, "This person has been a resident on such-and-such estate and has proven to be an unreliable tenant". That was just off the top of my head, but you can send the message that you would not necessarily support that person's tenancy.

Mr Allister: If you can send that message, why can you not send the message that the person has been convicted of whatever in respect of these premises?

Dr Macdonald: It is not absolutely necessary for a private landlord to know that. We are thinking about the risks —

Mr Allister: Why not?

Dr Macdonald: A private landlord makes the judgement on whether an individual is an acceptable tenant, and that can be put in writing without making any reference at all to the activity in which he has been involved. Our concern is very much on the data protection side, the security of the information. We are not convinced that private landlords, many of whom will have only one property to let, will have an understanding of the Act and what is necessary to ensure the secure onward handling of the information. It could leak out into the community and result in additional risks being taken.

Mr Allister: They would still have the responsibilities that the Act imposes.

Dr Macdonald: They would have the responsibilities, but —

Mr Allister: If they breached those, there would be consequences.

Dr Macdonald: Yes, but our intent is to avoid the breach. If that information is not absolutely necessary for them to hold —

Mr Allister: That is a subjective judgement.

Dr Macdonald: There would be a degree of subjectivity, but the basic point of a reference is to say, "I think that this person is a suitable tenant" or "I think that this person is not a suitable tenant". You do not need to give any justification for that. The individual applicant can come back to you and ask why.

Mr Allister: The social landlord and the social landlord's other tenants might think that it is very relevant and necessary for them to know the nature of the disruptiveness of a tenant whom they are being asked to take.

Dr Macdonald: We understand the general principle. We expect that social landlords will have an understanding of the Data Protection Act and have processes in place. We are not convinced that private landlords would. We want to remove the risk of detriment to the individual seeking the tenancy while protecting the other tenants. All we are saying is that, in these situations, reduce the risk by making the reference much more on the basis of, "Yes, we would recommend them as a tenant" or, "No, we would not recommend them as a tenant".

Mr Allister: You want, for the sake of protecting a potentially disruptive tenant, to enhance his or her rights and, in that process, to give a higher level of information and protection to the social landlord than to the private landlord.

Dr Macdonald: We are saying that we need to be satisfied that the recipient of the information has the appropriate security in place. We know that social landlords in the public sector place an emphasis on that. We understand that, but we are not convinced that the man in the street with a single property to let is as familiar with the Act.

Mr Allister: He is subject to the same Act.

Dr Macdonald: He is subject to the same Act, but private landlords do not necessarily have the resources in place to give the level of security that some of that information needs. The Act says that the organisation has to put in appropriate measures. The interpretation of "appropriate" brings in the resources that they have available to them. Larger landlords in the private sector and certainly those in the public sector will have the resources to ensure the secure handling of such information in their organisation, but an individual private landlord may not.

Mr Allister: Surely, the first test of appropriateness is that what they have in place is appropriate to the obligations under the Act.

Dr Macdonald: The way that principle 7 — the security principle — is interpreted is that it is appropriate to the resources of that organisation.

Mr Allister: Exclusively? Is that the sole test of appropriateness?

Dr Macdonald: No, but principle 7 states that an organisation must take "appropriate technical and organisational measures". You will know of some recent breaches here: organisations inappropriately disclosed data when they lost unencrypted information on portable media. Ten years ago, we did not expect all organisations to encrypt all their portable media, because it was very expensive. We expected councils and the police to do so, but not small organisations. All phones and tablets now have encryption built in, and it has become much more appropriate to use that. In other words, the Act states that appropriateness depends on a range of measures. On the security principle, the Act brings into consideration the resources that an organisation has. That is the driving force behind our concerns about small individual landlords. We are not convinced that they will have the resources properly to secure information, some of which is very sensitive and some of which relates to criminal behaviour and should not be put at risk. We want to avoid that risk. It is a risk to the community that they live in as well as to themselves.

Mr Allister: I have one final point on another matter. In the Bill or under any other provision is there any form of immunity for the person who makes a bona fide disclosure of relevant information?

Dr Macdonald: Any form of immunity?

Mr Allister: In the sense that they are immune from defamation or anything of that nature.

Dr Macdonald: The information disclosed has to be accurate. The Data Protection Act includes our views amongst the information that is covered. The subject of that view may think that he is being defamed, but, if the information can be substantiated as fact, that is an opinion and is acceptable. That part is not so much our area of law. If it is what somebody truly believes and is recorded as such, we are satisfied. Defamation is another —

Mr Allister: People take their own risk on defamation.

Dr Macdonald: Yes. As I said, it is outside the Data Protection Act.

The Chairperson (Mr Maskey): Jim, are you asking whether, if someone who has the information by virtue of this legislation —

Mr Allister: — discloses it and then discovers that they got it wrong, are they at risk?

Dr Macdonald: If someone realises that they have got it wrong, the recommendation would be to tell any recipient organisations that there has been a mistake and get them to correct it. Individuals also have the right of access to their information and the right to correct erroneous information.

The Chairperson (Mr Maskey): If someone is included in the data sharing and then wilfully or knowingly discloses that, surely they are in default of the legislation.

Dr Macdonald: There is a distinction in the legislation. Obviously, if someone discloses it beyond what is proposed in the legislation and it does not fall into any of the exemptions, of which there are several in the Act, they would, if it was a wilful and deliberate act against the authority of their employer, be likely to have committed a criminal offence. If information was disclosed because the procedures were inappropriate, it would be a civil matter and could, ultimately, lead to a fine from us.

Mr Beggs: You say that you have concerns about full information being transmitted but that sifted information about a good or bad tenant could be transmitted. Do you accept that there are an awful lot of grey areas? At what stage does the black-and-white situation arise? Might there be a very few cases in which people pass on the information that someone is a bad tenant? Is that not a danger?

Ms Shauna Dunlop (Information Commissioner's Office): It comes back to the data protection principles. In the legislation, this type of information will be sensitive personal data, so the test for relevancy and adequacy will be important. It may be determined on a case-by-case basis in some circumstances. Ultimately, it will be the decision of the organisation or perhaps the individual to apply that test. Is it relevant? Is it adequate? Is it not excessive for those purposes? That is a good starting point.

Dr Macdonald: If a complaint was raised to us by the individual whom it concerned, we would look to the organisation to justify what it had done. The requirement to provide guidance in statute was mentioned: an organisation should refer to that guidance, which should probably contain some examples, but, of course, there will be some things in the margins. If we were regulating or considering taking action, we would look at the arguments that the organisation put forward. If it was clear that they had just done it without thinking, we would be more likely to take some form of action against them. If it was clear that they had gone through a thought process but we disagreed with the outcome, we would recognise that they had been trying to comply with the Act and done their best. As you said, it is a grey area, and, although we disagreed, we would be less likely to take action.

Mr Beggs: Do you foresee any potential for landlords taking action if there has been a failure to transmit relevant information?

Dr Macdonald: We do not regulate on that. The decision is always made by the person holding the information. If they believe that they should not hand something on, that is their right. A landlord might want to take other action, but it would be outwith the Data Protection Act.

Mr Beggs: How have other regions dealt with this in practice? Are you aware of housing bodies in other parts of the United Kingdom that have set a threshold for the transmission of information?

Ms Dunlop: We are not aware of any specific similar legislation that allows that. We are not aware of it in practice, but it comes back to what we said about having the guidance to go alongside how the Bill, if it comes into law, might work. Even the Bill's memorandum of understanding (MOU) refers to having to share information with the PSNI. In those circumstances — this is one of the things that we fed back to the Department — there may well be a relevant exemption in the Act that would allow that to happen. That is the kind of information that it would be appropriate for any organisation or individual in those situations to consider.

Mr Beggs: Finally, on the issue of ensuring fairness in deciding whether information can be passed on, you said that one method of dealing with that would be to write something into a tenancy contract. Would that prevent information on any previous trashing of properties or causing huge nuisance in a neighbourhood being transmitted?

Dr Macdonald: No. If you tell tenants what will happen to their data, how it might be handled and where it might be disclosed, you comply with the Act. However, as I said before, how far back do you go? That is probably a question that will come up should the law come into force, but it would not stop the retrospective release of information on previous behaviour.

Mr Beggs: Do you acknowledge that there could be a danger of civil servants taking the safe route and saying nothing?

Dr Macdonald: Civil servants and others are sometimes wary of what they can do with data under the Data Protection Act. All too often, it is seen as a blockage rather than something that allows information sharing. In fact, it is very much the latter — it allows it; you just have to ensure that it complies with the principles. It is standard practice for us, as well as offering to become involved in the production of guidance, to go out regularly to organisations and explain what data sharing is allowed under the Act. It is a message that we have been pushing and pushing for years. We encourage it in the appropriate circumstances but in absolute compliance with the eight principles.

The Chairperson (Mr Maskey): As local representatives, a number of us deal with those matters fairly regularly, unfortunately. The fact that the private sector is not included in the Bill at this time will cause some people a bit of concern, because it is a huge player in the rented housing sector. I understand the arguments. A common thread in a lot of the submissions to us so far has been that people just do not think that the private sector has the capacity, that it is well enough structured or that there are enough protections built in throughout it to protect data as it needs to be protected under the 1998 Act. Some of us then grapple with how we protect the rights of other tenants.

For me, the question is one of relevance: what is the relevant information that needs to be shared? I think that all Committee members so far in all the evidence sessions are just trying to grapple with the notion of what is relevant. What I take from all the submissions is that it can be a grey area. We just have to think about that. I am trying to work out in my mind where the balance is to be struck, because we want to protect people's information. There is subjectivity involved. I might think that an individual is a shady person, and if you had known that, you might not have supported him or her in getting a tenancy. However, that might not be relevant to good or bad behaviour in the accommodation, which is what is relevant. Therefore, there is a better job of work needed to clarify what "relevance" means. I do not know whether you have any other comments to make on the issue of relevant data.

Dr Macdonald: For that, you really need to speak to housing practitioners and others engaging with individuals who have been involved in antisocial behaviour. They will be able to give you a much stronger idea of what is likely to be a signal of further disruptive behaviour, rather than something about the person hopefully maturing and moving away from that.

The Chairperson (Mr Maskey): In the worst-case scenario — this has been mentioned by members — someone could be a convicted criminal but a model tenant. What, then, would be the relevance of that person's history? Most laypeople would think that such a person could be a "bad person" and the landlord should know that. It again comes back to the issue of relevance.

Mrs D Kelly: From time to time, there are allegations made about people with convictions for sexual offences and concerns about there being a high density in certain areas of such individuals. I know that, in some parts of my constituency, there have been very strong views expressed about housing close to schools being given to people who are on the sex offenders' register for child sex abuse, which, on the face of it, seems very inappropriate. It just feeds that wider fear. If people want to do those things, they will do them, but we have to reassure communities, not only where there is a high density of those who are on the sex offenders' register but where there is a high density of those with a history of antisocial behaviour, alcohol abuse or whatever being deposited. Some communities can be very strong, and people can be chased out, if you like, through different means. I am not advocating that. Some people in some estates feel that they are put upon by the authorities and that the number of homes being given to such individuals just shows that they are the easy option. I wonder what consideration is given to those issues.

Dr Macdonald: The allocation and distribution of housing is really not something that we can comment on. The PSNI and other agencies have various types of multi-agency approach to dealing with that. Again, information — very sensitive information — is shared when they are making decisions. However, the density of people with such characteristics in any area is not something for us to comment on, I am afraid.

Mrs D Kelly: I just wonder whether any weighting is given. Are there a certain number of individuals who can be given housing accommodation in some areas to provide better distribution?

Dr Macdonald: That is a matter for the housing bodies to answer, not us.

Mrs D Kelly: OK. Thank you.

The Chairperson (Mr Maskey): OK. Fair enough. No other members have indicated that they have any further questions to ask.

Dr Macdonald and Shauna, unless there are any other issues that you want to raise, we are happy to leave it there for this morning. I thank you for coming along to give us your written submission and to help members tease out answers to some of their questions. Thank you for helping us in our deliberations.

Dr Macdonald: Thank you.