---

Data Protection in the Areas of Police and Criminal Justice (EU Directive)

I do, and I was going to deal with that matter after raising a number of specific points of concern. I am grateful to the European Scrutiny Committee for its report, which states that"““there is now the possibility of establishing a comprehensive data protection framework ensuring both a high level of protection of individuals' data in the area of police and judicial cooperation in criminal matters and a smoother exchange of personal data between Member States' police and judicial authorities, fully respecting the principle of subsidiarity.””" The report then adds:"““The Commission concludes that the practical difficulties encountered by a number of Member States in distinguishing between rules for domestic and cross-border data processing could be solved through a single set of rules covering data processing both at national level and in a cross-border context””." The aim might be laudable, but the solution appears to say that, in order to avoid confusion, principles of subsidiarity should in fact give way to an overarching system controlled centrally. One consequence of that that the Minister has already alluded to is an extension of the scope of data processing to include domestic processing for the purpose of policing and judicial co-operation. In other words, the directive will regulate the passing of data between purely domestic organisations, such as neighbouring county police forces, and I share the Minister's concern in raising that. In the area of data protection, the draft directive is stronger and, I think, should be broadly welcomed. It includes: new rights of access and information for data subjects, such as the identify of the data controller, the purpose of the data processing and the period for which the data will be stored; a right for data subjects directly to demand the erasure of their personal data by the data controller; an obligation on data controllers to inform supervisory authorities and data subjects of data breaches, informing the former within 24 hours of discovery and the latter without undue delay; and an obligation for data controllers or processors to appoint data protection officers. The incorporation of human rights legislation—the Human Rights Act 1998—into UK law by the previous Labour Government has improved the right to privacy and to protection from intrusion into family life, but we still have some way to go.