---

Data Protection (Processing of Sensitive Personal Data) Order 2006

rose to move, That the Grand Committee do report to the House that it has considered the Data Protection (Processing of Sensitive Personal Data) Order 2006. The noble Baroness said: The order facilitates payment card issuers—that is, banks and building societies—in processing sensitive personal data, provided by law enforcement agencies, on customers who have received convictions or cautions for crimes in relation to child abuse images where their payment card was used to commit the offence. Card issuers’ contracts usually allow removal of a payment card or the closure of an account when it has been used to make an illegal purchase. However, card issuers need access to accurate information on illegal purchases and on whether their customers have been cautioned or convicted of an offence. Without that information, it is difficult for the card issuers to exercise their contractual rights and to remove the cards or close the accounts if they wish to do so. While some card issuers can already process these data based on the explicit consent of customers, others do not have adequate terms and conditions in their contracts. The order provides the necessary safeguards to permit the processing of data passed by law enforcement authorities to card issuers. The data on the offender will go directly to the card issuer who may, if they wish, act on the information. The processing of the data will be supported by a memorandum of understanding. The background legislation is set out in the Data Protection Act 1998. As noble Lords will know better than I do, the Act sets out how organisations use the personal information they hold on individuals. The data include how they acquire, store, process, share or dispose of information. Specific measures within the Act ensure that individuals’ sensitive personal data are processed in a manner that provides them with an appropriate level of protection. Under the power in Schedule 3(10), the Secretary of State may make an order setting out further circumstances where processing of sensitive personal data can take place. The order marks the completion of collaboration between my department, the Association for Payment Clearing Services, known as APACS, the UK trade association for payments and institutions that delivers payment services to customers and represents large numbers of card issuers, along with the Child Exploitation and Online Protection Centre—known as CEOP, a national resource that brings together law enforcement officers, specialist children’s charities and industry, all seeking to tackle the growing problem of child abuse. We are also, of course, working closely with our colleagues in the Home Office. APACS and the Child Exploitation and Online Protection Centre approached my department seeking a way forward to ensure that the necessary safeguards are in place to facilitate the appropriate processing by card issuers of convictions and cautions data from law enforcement authorities. Both organisations were very keen to act, and my department and the Home Office are very keen to support them. When making such an order, my department is required to consult the Information Commissioner’s Office, whose role, as noble Lords will know, is to ensure that personal information is properly protected and to prosecute those who commit offences under the Data Protection Act. The Information Commissioner’s Office was broadly content with the order but had some reservations regarding closure of accounts. We do not agree with the reservations. If the order did not allow for the closure of accounts and the debit card was used, the card issuer could cancel the card but would then have to keep open the account of an individual whom they knew had broken the terms and conditions of the card and the account. We feel that it is appropriate to allow card issuers, if they see fit, to process data on the closing of accounts based on a breach of terms and conditions—in other words, the contract between the customer and the supplier of the card. We do not wish to permit them to process this information for one purpose and then to turn a blind eye to conviction for other purposes. The order does not set up a list of those who have had their cards removed on this basis. The information on convictions and cautions, if passed to the card issuers, is purely to allow them to decide whether the card in commission has been used for an offence that constitutes a breach of contract. While processing the data, card issuers must comply with the principles of the Data Protection Act; they must not keep the data longer than necessary. The details of the offences will not be passed to credit reference agencies or to other card issuers unconnected with that particular card. The removal of the card or the closure of the account does not equal a further or second punishment. These are not criminal sanctions. The processing of the data allows the card issuers to exercise their contractual rights. When individuals use the card for illegal purposes, they contravene their contractual agreement with the card issuer and, as a result, their contract may be terminated. When the card involved belongs to joint accounts, the innocent party will be told that the card has been removed or the account closed due to a breach of terms and conditions. They will not be given any further details. Any outstanding monies will be returned to the parties as appropriate and the innocent person in this context will not suffer any detriment. Noble Lords will be as aware, as I am, that the viewing of child abuse images is not a victimless crime. For every image online, a child in the real world has been abused. We hope that this order will assist in the disruption of paedophilic activity and have an impact on reoffending. I beg to move. Moved, That the Grand Committee do report to the House that it has considered the Data Protection (Processing of Sensitive Personal Data) Order 2006—(Baroness Ashton of Upholland.)