---

Sale of Student Loans Bill

moved Amendment No. 1: 1: Clause 1, page 1, line 13, at end insert ““including the obligation to protect personal data”” The noble Baroness said: I shall speak also to Amendment No. 26, which stands in my name on the Order Paper. All the amendments in this group are concerned with data protection issues. The first of the two amendments tabled by the Liberal Democrats is the more substantive. The reason for it is that there is concern that public sector organisations do not treat personal financial data as securely as they should. We have seen several examples in the past year of failures of public sector organisations in this respect, most famously the loss of personal data by Her Majesty’s Revenue and Customs, including the names, addresses, bank account details and national insurance numbers of 1.2 million people who were claiming child tax credits, but other examples have come to light of public sector organisations—for example, the Child Support Agency or the agency dealing with pension credits—where personal financial data have been treated in a very cavalier fashion by public servants. The incident last November at Her Majesty’s Revenue and Customs in relation to the child tax credit is a case in point. The full details of what happened have never really come to light, but it appears that the National Audit Office asked for data for its investigation, that request was passed to a relatively junior official who copied the data on to an ordinary CD without proper encryption which he sent through the internal mail by TNT and somehow it never arrived where it was supposed to arrive. The result was to waste many hours of police time in what ended up being a totally futile search. Why does this worry us, and what relation does it have to the Bill? I was involved in the report of the Science and Technology Committee of the House of Lords on internet security. Identity fraud is one of the big issues that came up in the debate on internet security. From the point of view of those wishing to hack into the internet, what better than to provide them with all these data linking names, addresses, bank accounts and earnings on a CD-ROM? What a blessing that would be. The question arises: why were procedures so lax? The Minister may well argue that these incidents are totally irrelevant, that the collection of money from former students through the Student Loans Company, as well as the loans, will be sold off in tranches, and that it is quite clear from the Bill and the details we have been provided with that these data will anonymised. There will not necessarily be any need to hand over the data, although it is also clear that should the purchaser ask for the data they have the right to see them Clause 6(3) makes it clear that Her Majesty’s Revenue and Customs may be asked to pass over information to the Student Loans Company—whether the person or body requires the information in that capacity or the capacity of any agent of the loan purchaser. Subsection (4)(b) of that clause expressly permits onward disclosure of information to a loan purchaser or its agent in relation to the loan transfer. Information is clearly going to be exchanged. The amendments merely reinforce the obligation on Her Majesty’s Revenue and Customs, the Student Loans Company and any other body involved in that exchange to treat all these personal financial data with the normal precautions and protections. Experience has indicated that directives and regulations are not enough. These days, civil servants, teachers and social workers are subject to so many regulations that they almost fall off them like water off a duck’s back. It really helps for these matters to be reinforced by being mentioned in the Bill. The aim of the amendments is to put into the Bill the need for public servants to take the normal protections and precautions. I beg to move.