Report - Guardian

148 The LSE Identity Project Report: June 2005The Register will also include a great deal of transactional data such as dates ofapplications, modifications and disclosures of information on the Register; the purposesof the Register are insufficiently precise to understand how such data retention will notbe in breach of the 3 rd , 4 th and 5 th Data Protection Principles.The information held on the Register will be disclosable without the consent of theindividual to the Security Services, Chief Police Officers, Inland Revenue and Customs& Excise, any prescribed government department and any other person specified byOrder by the Secretary of State. Again the potentially wide audience to whom this largeand powerful amount of information might be disclosed to will go the fairness andtransparency features of the 1 st Data Protection Principle and the specificity requirementof the 2 nd .Section 29 of the Data Protection Act does make provision for disclosures to bodiessuch as the police and Inland Revenue, however, the body making the disclosures isrequired, in the absence of warrant, court order or other legal compulsion, to assess on acase by case basis whether the information should be passed on. Cl. 19 of the Bill doesnot require such an assessment, but is merely qualified by Cl. 23 which states it is notreasonably practicable to expect the requestor to obtain the information by other means.There is no exposition of this test and with a growing centralized database ofinformation about the UK populace one can imagine both security and law enforcementforces arguing that obtaining information from other sources will not be ‘reasonablypracticable’, particularly if they believe their request is likely to fail the s.29 test.If the argument for a National Register is accepted then the actual practical aspects ofadministration, maintenance and compliance with the information quality principles(3 rd , 4 th , 5 th ) present very serious concerns.One particular concern is the requirement upon individuals to notify the Secretary ofState of any changes to the registrable facts on the Register in Cl. 12 of the Bill. Underthe provisions of the 4 th principle, it is the responsibility of the data controller to take allreasonable steps to ensure the information they hold is accurate and up-to-date. Not onlydoes Cl. 12 shift this responsibility onto the individual but imposes a penalty of up to£1,000 for failing to do so even though later on at Cl. 37 an individual may eventuallyhave to pay a fee in order to alter their records. One can anticipate the difficulties thatare likely ensuring that it is up to date bearing in mind the range of information that isgoing to be held on the Register. There may well be issues about policing of suchrequirements.Finally, there are already several other initiatives underway to collate information aboutcitizens in the UK: the Citizen’s Information Project initiated by the National CensusOffice and the database of all children under the Children’s Bill. There is clearly furtherpotential for the amount of information to be linked or transferred to the NationalIdentity Register if the Secretary of State chooses to make this happen by Order. It isunclear at present how these initiatives are to work together in practice. Other policiessuch as the retention of communications data by communications service providers andthe tracking of vehicles for taxation of road usage also have the potential to becombined to provide the government with a comprehensive and all pervasive databaseon the lives of its citizens.