---

Data Protection and Freedom of Information

I beg to move,"That, in respect of service from 30th November 2007, the salary of the Information Commissioner shall be at a yearly rate of £140,000." The position and role of Information Commissioner arise out of two sets of decisions by this House and the other place: the Data Protection Acts of 1984 and 1998 and the Freedom of Information Act 2000. Even when the post was simply concerned with data protection, its duties could involve a conflict with the Government of the day, since the commissioner acts on behalf of the individual to protect personal information held on those individuals, not least by Government. Still more, there is a fundamental conflict of interest in the commissioner's role under the Freedom of Information Act, which this House and the other place passed after much debate in 1999 and 2000—and, indeed, strengthened as a result of pressure from both sides of the House and in both Houses, including in respect of making Parliament subject to the Act. That Act involves enforcing the public's right to have access to information against public authorities and the Government where, by definition, the issue will only land on the desk of the Information Commissioner if the public authority has refused to provide the information requested. The commissioner, therefore, is a role that requires great independence and integrity, legal facility and an ability to make difficult and balanced judgments. I think I speak for the whole House in expressing my gratitude to Richard Thomas for the way he has conducted himself in this post through the birth pangs of the implementation of the Freedom of Information Act. He showed that he has those qualities of independence, integrity, legal facility and an ability to make difficult and balanced judgments. The Government have carefully considered the commissioner's salary in the light of the changes to his role and responsibilities since it was last reviewed in March 2001, shortly after the Freedom of Information Act was formally passed by this House and received Royal Assent, but a full four years before it came into force. The extraordinary prevailing economic conditions quite properly place constraints on public sector pay settlements. However, the Government position is that the particular circumstances of the Information Commissioner's case warrant the increase set out. There are three reasons for that. First, the world has changed considerably since the data protection registrar was originally appointed in 1984 to safeguard personal information. There is no need to explain to the House the astonishing revolution in the collection and dissemination of personal information of all kinds as a result of the IT and internet revolution. Secondly, the implementation of the Freedom of Information Act 2000 effectively doubled the range of the commissioner's responsibilities, combining those for data protection and freedom of information in one job description. Recently, there have been two further sets of changes, both of which add to the commissioner's responsibilities. First, as all Members are aware, there has been great public and parliamentary concern about data security within both the public and private sectors. This has led to a great deal more work for the Information Commissioner and, so far as Government are concerned, it has led to us proposing to the commissioner— which he has acceded to—spot checks of Government Departments and the production by him of an annual surveillance report. Secondly, and more fundamentally, on 25 October 2007 my right hon. Friend the Prime Minister announced that he had asked Professor Mark Walport, director of the Wellcome Trust, and Mr. Thomas, the Information Commissioner, to undertake a major review of data sharing in the public and private sectors. The report of the review was published on 11 July 2008 and, in a written ministerial statement today, I have announced the Government's response to it. The consequence is that the commissioner will be taking on further responsibilities, including greater inspection powers to ensure data protection compliance, powers to demand information necessary to assess compliance, a statutory duty to publish a data sharing code of practice, and a new tiered notification fee with an extra penalty for false registration. Those changes will improve the transparency and accountability of organisations dealing with personal information, and that is important if we are to regain public confidence in the handling and sharing of that personal information. The significant expansion of the commissioner's responsibilities has been matched by an increase in the importance and status of his post.