---

Immigration, Asylum and Nationality Act 2006 (Duty to Share Information and Disclosure of Information for Security Purposes) Order 2008

My Lords, I thank noble Lords for their contributions to the debate and for the good points they raised. On the use of bulk information and what is presently known as the JBOC—when e-borders comes into operation it will become the EBOC, the information centre—data are fed into what is effectively a sealed area, where it is recorded, held, sorted out and analysed. This is done by operators who will have gone through specific security training because, as has been said already, there has not been a good track record, not only in government but in private companies as well, of looking after data and making sure they are correctly protected. These operators have to undertake and pass a training course before they are even allowed to operate and use the machines. The procedure has been tightened-up well and will ensure that that is done properly. The bulk information is analysed within the JBOC—in future the EBOC—and when one finds data that are of interest to an agency in one of the other areas, that information is passed and that agency deals with that information about that specific subject. I was asked whether discs would be flying around. There is a facility to produce a disc although some of the machines are disabled so that they cannot produce discs because it is so easy to put data on them and remove them. If discs are going to be used, there is a mechanism in place to ensure that these are looked after, logged properly and are only transferred by hand. That is how that will be dealt with within the structure. Beyond the JBOC or EBOC, it will deal with specific data about someone of interest to that agency, which they will be able to pass to each other. For instance, if it goes to BIA, BIA will be able to talk to HMRC about that specific person. But the bulk data that has been fed in will not be flashing around to different people. On the issue of Project Semaphore and how long data will be held, at the moment the information is held for about five years, although some police forces hold it for six and HMRC has said that some data may have to be held for longer for various customs and excise reasons. The order does not cover sharing information with other countries although it is open to us to enter into agreements to share data with states. Clearly when we do that we will have to make certain that all the data protection guarantees and so on are in place, using the commissioner and other methods to achieve that. The question of costs was touched on by the noble Baroness and the noble Lord, Lord Avebury. The costs for industry are variable. At the bottom end they are down at 0.04p and at the top end they are £6.31. When we worked it out, the average cost was 14p, as has been mentioned. It is up to the carrier to decide how to meet these costs but we feel that for that amount of money it is incumbent on an organisation to help in what this achieves for the security of the nation. As has already been said, it is amazing what has been achieved with Project Semaphore; the benefits from that have been quite huge. The noble Baroness raised the importance of protection and balancing that against causing harassment. Exactly what the balance is going to be is the same in almost every context in the counterterrorist area. It is always a balance and we believe that we have it correct. The data that have been gathered and the way we are looking after that data are necessary to help our security, in the fight against serious crime and so on. We have put in place many data protection measures. We are constantly aware that when we are collecting huge amounts of data on people—and, as has been rightly said, more and more data are being held—there are risks. But nowadays, I am afraid, in any big organisation, to be able to do these things you need to get that data. We have got to become better as a nation at looking after data, not only in pure physical security terms but in making sure that everyone who ever gets their fingers on it and works with it has been correctly trained and understands the full implications of doing so. However, I do not think that means we must not do it. In this modern world, we cannot avoid doing these things; instead, we must become very good at it. Within this context, the way that we will run JBOC—and then, in the future, EBOC—will achieve that. The noble Lord, Lord Avebury, raised the encryption of data and whether they would be passed encrypted. The plan is that they will be passed by a secure means and encrypted, but this is an issue that I want to check again, so I shall get back to the noble Lord in writing. All my experience is that people are often not as good at that as they should be. I want to make absolutely certain that that is done. The European Union is not really part of the order. There will be further debate about the EU and US aspects of it. The carriers are already collecting some of these data. Clearly they have them there because they need to be able to issue tickets and do other things, but not always in a format that they can pass to us easily, which is why there is an extra cost aspect to all of this.