Dr. Anne Cavoukian, the Privacy Commissioner for Ontario, is a leading expert on Privacy by Design and the use of technology to protect privacy. Last year, she published a report into “Whole Body Imaging in Airport Scanners” which has become especially prescient as Gordon Brown rushes to introduce the technology into UK Airports.
In her report (reference at end), Dr Cavoukian states that the “privacy-invasive potential” of these scanners can be addressed if privacy enhancing techniques are designed into the hardware. For instance, the images produced by millimetre wavelength radiation can be processed by software that has “modesty” algorithms to blur facial features and genitalia. In fact, Dr Cavoukian’s clearly favours the use of “Backscatter Privacy Algorithms” that result in the display of an image that resembles a human shape in chalk outline (similar to those depicted as being drawn on the floor following a murder in a TV detective series).
Operating procedures also play a part. In particular, to engender “public confidence and trust” Dr Cavoukian recommends “a complete prohibition against retention or transmission of the images in any format”. In addition, security personnel viewing the images should not see the scanned passengers before or after the scans, and should not have access to passenger details of those they have viewed. Such personnel should also be banned from bringing photographic devices, storage devices or communications equipment into a separate viewing area. Finally Dr. Cavoukian states that travellers have to be fully informed as to the screening process, and preferably have an alternative of a personal body-search if they don’t want to stand in front of the scanner.
Note that all of Dr Cavoukian’s recommendations can be transformed into obligations under the UK’s Data Protection Act. For example, if all passenger images were retained, it could constitute processing that is in breach of the Third and Fifth Principles. Any failure to provide passengers information about the scanning process could breach the Act’s fair processing obligations, and procedures relating to security personnel clearly link to the Seventh Principle.
In other words, if UK airlines want to avoid data protection issues, they should consider Dr. Cavoukian’s recommendations very seriously; they provide a benchmark through which the procedures adopted by UK airports can be assessed.
As an experienced privacy regulator herself, Dr. Cavoukian has immense credibility with most European Data Protection Commissioners. Her recommendations therefore are likely to be the basis for Europe-wide data protection procedures.
Reference: “Whole Body Imaging in Airport Scanners: Building in Privacy by Design”, Dr. Anne Cavoukian, June 2009”. http://www.ipc.on.ca/images/Resources/wholebodyimaging.pdf