---

Immigration, Asylum and Nationality Act 2006 (Duty to Share Information and Disclosure of Information for Security Purposes) Order 2008

My Lords, I am grateful to the Minister for his explanation of the order. We have had the benefit in this case of reading what was said last week in the Delegated Legislation Committee, much of which was repeated in the noble Lord’s introductory statement. For example, Project Semaphore, which is the pilot on the sharing of passenger name records and freight records, has already contributed to the arrest of 1,600 people for serious crimes such as offloading passengers not qualified for entry to the UK, to the seizure of false documents and to contraband tobacco and drugs, as well as helping to combat terrorism. These are all objectives that I am sure all noble Lords will share. The Minister told the committee in another place that the PNRs for an estimated 355 million passenger movements will be handled by 2015. I do not share entirely the concern of the noble Baroness, Lady Hanham, about the volume of data, considering that IT systems are continually able to share more and more information. I carry around two gigabytes in my pocket, and some USB dongles now on the market at very low cost carry four times that amount. It is not difficult to imagine that the IT system will be capable of dealing with the volume of information required. I understand that the information will be shared initially by the three agencies involved in the new combined UK border agency—the BIA itself, HMRC and UKvisas—but there are also proposals under consideration for sharing the data with equivalent agencies in other EU countries. Presumably the Minister will correct me if I am wrong, but I assume that that will require a further order; it would not be allowed by this particular instrument. As the noble Baroness, Lady Hanham, said, the order also provides for the transfer of data in bulk to the security and intelligence agencies. We, too, would be grateful for an assurance that the transfer of these data will be electronic only and not by DVD, and I would add that it should be encrypted for the transfer. I hope that we can have that assurance from the noble Lord. I gather from the reply given by the Minister to the Delegated Legislation Committee that for the time being fellow European Union member states will be able to consult the database only on a need-to-know basis. What is the statutory authority for that process and what criteria would need to be satisfied in order to trigger a successful request from another EU member state? Are the PNR data to be recorded and exchanged under this order in the same way as the PNR data that we are now providing under the interim EU-US agreement of 2006, or will provide under the further agreement that was under negotiation when your Lordships’ European Union Committee reported on the matter last June, and will they be held in a common database? Surely it would be absurd to collect PNR data for the purpose of transfer to the United States and our own internal purposes in a different format. There is a description of the information in paragraphs 7.4 and 7.5 of the Explanatory Memorandum. It consists of information about the passenger’s travel document details, held in the machine-readable section of the passport, and information normally collected for the commercial purposes of the carrier, such as the name, address and telephone number of the passenger, as well as information about the ticket itself. If the carriers are already collecting and storing this information, what are the additional costs of £242 million that they are expected to incur over the 10 years from 2007 to 2017? The Explanatory Memorandum refers in paragraph 7.13 to capital expenditure by ““most carriers””, but surely, if my assumptions are right, this cost will fall entirely on carriers that do not fly to the US and therefore have had no need until now for computer systems that will store the data that are mentioned. The Minister also told the Delegated Legislation Committee in the Commons that the estimated cost of the programme to the Government was £1.224 billion over the same 10 years. That struck me as being a surprisingly precise figure, unless it depends on contracts with the e-borders suppliers that have far stronger penalty clauses than is usual in these matters. How far have we progressed towards establishing the e-borders operations centre and developing the computer systems that will be needed to receive, process and store the data that are transmitted to it by the carriers? Maybe the experience with Project Semaphore allows us to have greater confidence in predicting the costs, but could the Minister say who the suppliers are so that we can look at their previous records of delivering systems on time and to budget, which, as the noble Baroness, Lady Hanham, said, is not always the case with public sector IT systems? The Minister told the committee in another place that the estimated average cost per passenger movement was 14p. I assume that this includes the cost of the stringent safeguards that are imposed by the code of practice that is to be issued under Section 37 of the 2006 Act. There is no doubt about the need for the collection and sharing of information about passengers and goods entering and leaving the UK for security purposes. As with any very large IT system, however, there is a small risk of erroneous data being recorded and I share the anxiety of the noble Baroness, Lady Hanham, about whether the code of practice to which the Minister referred will deal adequately with the mechanisms available to persons who claim that wrong data have been recorded against them. Will it allow them not only the means of having access under freedom of information to the information that is recorded but good opportunities for making corrections?