---

Immigration (Supply of Information to the Secretary of State for Immigration Purposes) Order 2008

I totally agree with the noble Viscount. The problem is security in transferring the information. We do not object to the order or to the use of the information specified in it but, in view of the history on this matter, we think that your Lordships should be doubly careful to scrutinise the methods by which the transfer of information is to be achieved. The Minister mentioned that it would comply fully with the recommendations in the Cabinet Office review of December 2007. He also referred to the appointment of a senior information risk owner, which I must say was news to me, but very welcome. I should like to know what the exact functions of this official are and whether reports will be made to Parliament on his assessment of the risks involved, particularly in the transfer of information. I am also grateful for the Minister’s assurances that all the powers in this order will be exercised in full compliance with the Data Protection Act 1998 and the Human Rights Act. Presumably, under the Data Protection Act there will be oversight of the procedures involved. The note on the order says that there were no specific consultations on it, and I wonder why that was. Surely, particularly on the risks involved in the transfer of information from one department to another, competent technical advice would have been available from, for example, the professional computer bodies. I noted what the Minister said about the use of non-encrypted laptops, which in the past have been the occasion for the disappearance and theft of information on a large scale. Can he assure us that no information of the kind dealt with in the order will be on unencrypted laptops? I should have thought that where a transfer of information took place between, for example, the Department for Transport, the DVLA and the Home Office, it would be done electronically over a secure link and that that would be the only possible method by which this kind of information could be transmitted from one department to another. If there are exceptions to that and information is put on to a disk or a CD or used on a laptop, I think we should know about that. We should also know what safeguards will be considered by the senior information risk owner to ensure that the information does not go astray.