---

Sale of Student Loans Bill

I thank the noble Baronesses, Lady Sharp and Lady Verma, for their comments, giving me the opportunity, I hope, to offer significant reassurance on their concerns. I should like to say to the noble Baroness, Lady Sharp, that I do not think that identity fraud and concerns about the internet are irrelevant. They are extremely important and I know through other work unconnected with this Bill how seriously my department takes these issues, particularly with regard to the student loan companies. I appreciate her concerns. I agree wholeheartedly with the noble Baroness, Lady Verma, about scrutiny and hope that we do not appear to be rushing this Bill through. We very much appreciate and enjoy detailed scrutiny in this House and I am sure that we will see some improvements as a result of our discussions. I hope that I can offer reassurance, particularly on the progression of protection through the Data Protection Act. I welcome this opportunity to restate the Government’s wholehearted commitment to the proper protection of borrowers’ personal information, which is very important. These amendments are proposed by the noble Baroness, Lady Sharp, in respect of Clauses 1 and 6, and by the Government with respect to Clause 6. I share the noble Baroness’s determination that there should be no doubt as to the purchaser’s obligations to protect borrowers’ information. These provisions ensure that in addition to purchasers of loans being subject to the Data Protection Act in how they handle borrowers’ data, they will also be covered by the criminal sanction of improper disclosure of HMRC personal information, as set out in Clause 6. That is a significant step. Amendment No. 1 seeks to ensure that purchasers will take on the Secretary of State’s obligation to protect personal data. Under the Data Protection Act, an owner of sold loans who was in possession of personal information about a borrower would be a data controller in respect of it and would automatically have the same obligations as the Secretary of State for unsold loans. So it is unnecessary to include the specific provisions set out in Amendment No. 1 because the obligations are there. In any event, the Secretary of State’s obligations would neither cease nor transfer so long as he, too, remained in possession of the information, whatever the status of the loan. Amendment No. 26 is motivated, as the noble Baroness said, by the same concern to protect personal data. Clause 6 relates to what is known as a statutory gateway that allows the disclosure and onward disclosure of HMRC information. However, there is an important distinction made between two different sorts of data. Subsection 4(a) specifically relates to the onward disclosure of anonymised information. No individual could be identified from such data. While I fully recognise that it must still be handled with care, we should reserve the strongest safeguards for personal data concerning identifiable individuals. By applying the same standards to anonymised data, the amendment would raise a difficulty in relation to letting relevant interested parties view models relating to the loan portfolios that contained such data. I shall say more about that in a moment in relation to the Government’s amendments. So for those reasons, and given the other safeguards in the Bill, I believe that Amendment No. 26 is unnecessary, although I entirely understand the motivation behind it. On the basis that a purchaser unequivocally has obligations to protect personal data under existing legislation, I hope very much that the noble Baroness will consider withdrawing her amendment. I turn now to the government amendments. It makes sense for me to talk to Amendments Nos. 22 to 25 as a single set of broadly technical changes clarifying Clause 6. As I said at Second Reading, and as has been made clear in greater detail in another place, the Bill intends that only anonymised data can be disclosed to potential purchasers, or those who advise them. However, the personal data of borrowers are subject to greater safeguards, and can only be made available to the actual purchasers and their agents. As I have indicated, the existing criminal sanction on wrongful disclosure of personal information originating from HMRC is being extended by the Bill to cover personal data on sold loans. The proposed changes to subsections (1) and (2) in Amendments Nos. 22 and 23 provide a similar expression that disclosure of anonymised data may relate both to loans being offered for sale and those that have already been sold. As Members of the Committee will be aware, we expect that sales will include a securitisation process. That means that a range of parties will properly need to consider financial models, containing anonymised data on loans, to assess how the loans to be sold may perform and make informed decisions about whether to be involved in the purchase of student loans and bonds. In addition, Amendment No. 24 proposes a change to subsection (4) to describe a class of disclosure of anonymised HMRC financial information, so that it may go to those who have a purpose connected with the loans being offered for sale or that have been sold. We believe that this is the most effective way to ensure that such non-personal data can be given to those who need it, including potential purchasers and investors, and financial institutions involved in the transaction. Across a long-term programme of loan sales we could never create a complete list of such parties that would stand the test of time. If this amendment is passed, we will describe the parties in the next version of the Explanatory Notes to the Bill. I stress again that such parties would only ever be entitled to anonymised data. There is no question of the personal details of any borrower being released to this wider class of individual or of any individual being identifiable. Finally, on the much more restricted access to personal data, Amendment No. 25 is intended to make it clear that the narrower definition of actual purchaser or its agent should include the purchaser’s auditor. Without the explicit reference we were advised that this might be misunderstood. I hope that with this rather dry, technical explanation, the noble Baroness will consider withdrawing her amendment. I take very seriously her comments and I hope that with the reassurance I have given about the role of the Data Protection Act and the additional criminal sanction for the wrongful disclosure of HMRC data, she will consider supporting the government amendments.