Hawktalk

The Hawk soars off for a well earned break.

It’s been an incredibly busy year in the life if Amberhawk Training Limited, so the Hawk has decided to flap its wings and soar away for a few weeks of rest and recuperation in the woods. We’ll be flying back in 3-4 weeks to continue with our fantastic training courses covering Data Protection, Freedom of Information and the ISEB qualification, held at venues in Leeds, London and Manchester or on site at a location of your choice.

 

You’ll still be able to book online, using our automated booking system, however any comments on our blog will not be read or added until we fly back onto our Data protection perches in August.

 

Best wishes,

 

Chris and Sue – the UK’s leading experts in DP and FOI

The Freedom of Information equivalent of “not tonight Josephine?”

In October 2007, in a speech on liberty at the University of Westminster, the Prime Minister announced that more “Freedom of Information is the right course because government belongs to the people, not the politicians” adding that “there is more we can do to change the culture and the workings of government to make it more open”.

He continued: “Public information does not belong to Government; it belongs to the public on whose behalf government is conducted. Wherever possible that should be the guiding principle behind the implementation of our Freedom of Information Act”. The PM concluded that “we are also today publishing a consultation document to consider whether additional organisations discharging a public function - including in some instances private sector companies running services for the public sector - should be brought within the scope of Freedom of Information legislation”.

A year and a half later, the result of this consultation was finally published - last week under the encouraging title of “Freedom of Information Act 2000: Designation of additional public authorities”.  So how many public authorities will actually will be designated immediately?  I think the real answer is somewhere between zero and a handful, and at the lower end of the spectrum.

To be fair, there were new public authorities identified to be covered by FOIA (e.g. Academies, the Association of Chief Police Officers, the Financial Ombudsman Service and the Universities and Colleges Admissions Service). However, as there will be “further consultation” with all of these bodies, actual inclusion in a FOI regime is actually being deferred until that “further consultation” is completed.

The Government is “attracted” to the prospect of bringing public utility service providers (e.g. gas, electric, telecommunications) into the FOIA regime but there will be further consultation with these organisations.  In the context of the Government proposals, the word “attracted” needs translating; it means not to be included in a FOI regime.

Government are to “keep under review” (another way of saying “not to be included in a FOI regime”) those contractors who supply major services to the public sector particularly those who provide services such as  prisons, detention centres and care homes.  These bodies are “encouraged” to proactively publish information. Finally the report explicitly states that charities and the regulator of professional and voluntary services are not to be included.

So, I have reluctantly concluded that if the proper title of the document should be “Freedom of Information Act 2000: Non-designation of additional public authorities”.

What is wrong with data protection? (DP)

Privacy is an important right that feeds into other rights; for instance, a lack of privacy can undermine family life, confidential services and a free press. Who would want to tip-off a journalist, reveal sensitive details about oneself, or engage in a controversial political idea or demonstrate in order to change public policy if the state can record you on CCTV, track where you drive with ANPR, or have access to records of who you have contacted by phone, or e-mail, or by social networking?

I have long argued that the Data Protection Act is not equipped to protect the individual (see the reasons specified in the blog “Government want powers over CCTV and ANPR”). I also think that reliance the Human Rights Act cannot be assumed as its protection is not accessible to the public at large; an individual complainant has to take on the state in the Courts and this is an unequal struggle. For example, when Marper took his DNA database case to the European Court of Human Rights, his legal advisors were “a man and his dog” acting in a pro-bono capacity; on the other side was a dozen Home Office lawyers and leading silk funded by the taxpayer.

I have concluded that the Data Protection Act needs strengthening in four ways. These are:

1. There should to be a linkage between the Human Rights Act and the Data Protection Act, implemented by the Sixth Data Protection Principle; the Information Commissioner would then be able take action if assessments under this Principle raised breaches of Article 8 (human rights). Note that by implementing a narrow privacy right limited to the processing of personal data, the exemption from the Sixth Principle for the Special Purposes (i.e. freedom of expression purposes in Section 32 of the Act) is left undisturbed. So, prior to publication of the material, an investigative journalist would be unaffected by this linkage (which is the current position).

2. There should be a new power for the Commissioner to serve a formal notice that could result in a Court determining whether or not legislation that requires the processing of personal data is consistent with Article 8. The ability to serve such a notice, in my view, would work in the same way that the nuclear deterrent works. Civil servants and Ministers would not want to take the risk of a notice being served, so the mere fact that the Commissioner could “drop the bomb” would encourage Civil Servants and Ministers to draft legislation that took account of the obligations under both Acts. It also reduces the risks associated with unscrutinised statutory instruments.

3. The Information Commissioner (and other important regulators) should report to Parliament, be funded by Parliament (and not funded by sponsoring Departments of State which may have vested interests to protect), and be able to raise matters to be scrutinised by Parliamentary Committees. This mechanism ensures Parliament is well informed on a particular matter and can express a view.

4. Finally, the Section 10 right to object in the Act should become simple to operate in circumstances where the processing of personal data is not justified by reference to the purposes specified in Article 8(2) (of human rights). Such a right would operate as easily as the right to object to the processing of personal data for a direct marketing purpose, and would not interfere with processing of personal data for powerful public interest purposes, such as crime prevention or national security. However, it would arise when personal data sharing is undertaken merely for purposes of administrative convenience.

Readers who are interested in the wider privacy concerns should access the downloads available on www.amberhawk.com and down load the two articles entitled “Nine principles for assessing whether privacy is protected in a surveillance society” The articles have been published in the academic press and explain: • In Part 1: why the current framework of privacy protection in the UK is deficient. • In Part II: nine principles that rectify the problems identified in Part 1 and promotes specific improvements to the data protection/human rights regime.

Finally, I should alert readers to the fact that we are going to announce the content of our Data Protection Update sessions in October and November, very soon. If you want advance details, just e-mail [email protected]

Fine of £5,000 reflects a wider data protection malaise

Ian Kerr, the private detective from Droitwich (Worcestershire), maintained a blacklist for use by the construction industry; he has just been fined £5,000 for breaching the Data Protection Act. Although the Information Commissioner has issued a press release explaining that this is the end of the matter, the real truth is that the prosecution exposes the fact that Government chose to exempt manual dodgy dossiers of personal details from the protection afforded by the Act and the weakness of the Information Commissioner’s current powers.

First, the prosecution of Mr Kerr was for the failure to register the processing of automated personal data. Note that the prosecution had nothing to do with any breach of any data protection principle – for example, disclosing inaccurate or irrelevant personal data unfairly or unlawfully. The only offence, the Commissioner could find in his armoury was that Mr Kerr’s company had failed to click onto his web-site, complete the necessary paperwork and pay the required £35 per annum.

If Mr Kerr had the data protection knowledge I would expect of our ISEB course attendees, then he would have known that if he had held his personal information in a manual form in a filing system that was reasonably structured (but not the high degree of structured demanded by a relevant filing system), then he could have waived the proverbial two fingers at the Commissioner. This prosecution would not have taken place; there would be no breach of the Data Protection Act, no fine and probably no publicity.

The Commissioner’s threat to serve Enforcement Notices on 17 construction firms that paid Mr Kerr for details on construction workers would probably come to naught and even thoughts of a Monetary Penalty Notice (when they eventually commence) would evaporate. Indeed, Mr Kerr, could look forward to enjoy continuing retirement income that amounted to £478,937 between April 2006 and February 2009.

Back in 1998, Harry Cohen MP, attempted to close this manual file loophole. In moving an amendment to the then Data Protection Bill, he said that the Bill’s manual file provisions would permit “a private sector organisation such as the Economic League, which kept dossiers on trade union members for the purposes of blacklisting them, will be allowed to keep whatever information it likes, however inaccurate or irrelevant it is, and to disclose it to whomever it likes, so long as it keeps the information on paper and in date order”.

He added that “The lack of data protection controls means that individuals will have no rights, and there will be unlimited disclosure to anybody of secret dossiers and files of irrelevant or inaccurate information, which may be kept for ever. In short, organisations such as the Economic League, and private investigators, will enjoy the same level of total exemption as MI5, MI6 and GCHQ. It is hard to believe that that is what Ministers really intend”. (Hansard, 2 Jul 1998: Column 616).

The Minister (Geoff Hoon) replied “...the Government do not believe that (Mr Cohen’s amendment) was necessary or desirable. To do so would be to impose additional burdens on business and others who use manual records in circumstances in which there is little or no threat to privacy”. This policy of excluding personnel manual records was repeated when the Freedom of Information Act was enacted; the Government introduced an exemption that maintained the exclusion of many manual employee files about public sector staff from the Data Protection Act (see section 33A(2) of the Act).

In short, what the Commissioner should have (and has been refused by Government) is the ability to prosecute anyone who deliberately sets out to flout a Data Protection Principle.  Instead, the Government’s policy has resulted in the prosecution of an offence that is the data protection equivalent of not obtaining a dog licence. This is very short measure, when Mr Kerr’s activities have probably resulted in an unknown number of data subjects not getting employment, possibly for years on end.

Finally, the Government has embarked on a consultation following this case (http://www.berr.gov.uk/consultations/page52145.html). It talks about defining “a blacklist of trade unionists”, “the prohibition of the compilation, dissemination and use of such blacklists” and making “it unlawful for organisations to refuse employment, to dismiss an employee or otherwise cause detriment to a worker for a reason related to a blacklist”. The consultation suggests that courts can “hear complaints from any persons that they have suffered loss or potential loss because of a prohibited blacklisting activity”.

I think this completely misses the obvious. All the above abuse in this case could easily have been avoided if Government classified employee records as an Accessible Record (thus giving employee records the same status as social work, education or health records). Thus would grant employees the full protection of a data protection regime, provide for rights of access, redress if there was damage and ask for independent assessments from an independent Commissioner.

If readers agree with me, they should go to the above web-site and remind the Government that this simple and more protective solution was suggested a decade ago.

Individuals can reclaim their privacy on the Internet at any time

Without doubt services such as Google Street View can be useful. Just imagine that you are going for a job-interview in an unfamiliar city-centre; isn’t it useful to know the lay of the land before you travel?

However, away from the city centres, some householders claim that Google’s Street View has invaded their private space by publishing pictures that can zoom through the upstairs windows or into front rooms. Sometimes, privacy campaigners have based their data protection arguments on the processing of images that show shadowy Street View figures in a compromising poses. However, several Privacy Commissioners have come to the view that subject to safeguards associated with data removal, there is no privacy issue.

In general, there is a current, lively debate as to whether data that contains no name but is linked to an Internet user session via an IP address, URL or similar reference number is personal data or not. The stakes are high: if the data are not personal data, then the person who controls the data has almost untrammelled power to decide the nature of the processing. By contrast, if the data are personal data, that controller would be constrained by the data protection obligations that serve to protect the privacy of the individual user concerned.

We have published details that describe a simple test of whether or not certain information linked to an IP address, reference number or URL is personal data. We show that if the individual user concerned provides the service provider (e.g. Google) with the necessary identifying information (easily obtainable as we show), then the data ARE personal data, unambiguously in relation to any future processing. If sufficient individual users each provide the necessary identifying details, then the data linked to ANY individual should be considered to be personal data.

In other words, any individual users can, at any time, seek the protection of a data protection regime by providing the necessary identifying details to any organisation that stores their IP address or URL. This also means that organisations will have to adjust their procedures to take account of the reality that any subsequent processing of URLs or IP addresses, can be, at any time the processing of personal data.

The process, in our view, puts the user in charge of his own privacy – if the user wishes it. We also believe that the technique applies to those who do not live in a “data protected zone” but who user services subject to a privacy policy similar to that of Google; this should be of interest to our cousins in the USA. The full legal analysis plus draft details on the download section of our web-site: amberhawk.com

The document below describes how individuals can protect their internet browsing by engaging a data protection regime. IP addresses and URLs linked to user sessions can be transformed into personal data at any time.

Download IPSTREETVIEW

Cartoon

 

©Chris Slane

The ID Card dead. Long live the database!

Am I the only individual on the planet who was surprised at the press response to the recent announcement by the Home Secretary that the ID Card would not be compulsory? As far as I know, ID Cards were never going to be compulsory until Parliament voted for compulsion. So what’s new?

The press coverage has overlooked the fact that the privacy problems lie not with the ID Card but with its related database, the National Identity Register (NIR). The NIR is now being integrated with the passport system, so that when you apply for a passport (and say “no thanks” to the ID Card, perhaps), an entry in the NIR relating to you will still be made. Section 9 of the ID Card Act 2006 can provide for a civil penalty not to update your NIR details (e.g. when you move address), and the personal data will still be shared by diverse public bodies without consent of the individual concerned. As the police and national security agencies can have access to all the NIR (including the audit trail), then applying for a passport and the obligation to keep details up to date is almost the equivalent of registering your new address with most law enforcement bodies.

The NIR is also growing from the 50 or so items of personal data originally identified. The “Identity Cards Act 2006 (Information and Code of Practice on Penalties) Order 2009” requires the “particulars of every person who has been named as a referee by the individual on an application for an ID card or a designated document, so far as those particulars were included on the application” to be added to the NIR. This infers the existence of a cross-linking functionality (e.g. between records on the NIR) applies to all those who guarantee that a photograph of an individual is a likeness of that individual.
The “Identity Cards Act 2006 (Prescribed Information) Regulations 2009” also requires that the (voluntary) ID Card contains a record of “the individual’s ten fingerprints” – which of course implies that the NIR will keep a record of all ten fingerprints. Pause for a moment:  what will most people think when asked for all fingerprints? If individuals think that DNA of the innocent should not be retained by the police, will they have the same reaction when asked for all ten fingerprints (retained for the lifetime of the citizen on the NIR) when obtaining their passport?

The “Identity Cards Act 2006 (Provision of Information without Consent) Regulations 2009” permit disclosure to a number of public sector bodies in a way that lowers the thresholds established by the Data Protection Act. For example, the Department for Work and Pensions can obtain personal data “for the functions of the prevention, detection, investigation or prosecution of offences relating to social security”. This means that the test in Section 29 of the Act is not applied (i.e. the test of failure to disclose personal data prejudicing an investigation); instead the test is whether the disclosure just relates to the investigatory function (without any test of prejudice).

Consider also that the National Identity Card Commissioner has not yet been appointed. The legislation was enacted in 2006, yet there is no regulator to offer advice on the content of these regulations. In summary, regulations are being enacted to extend the NIR in ever expanding directions using procedures that minimise scrutiny by Parliament in the absence of a Commissioner who is supposed to protect individuals. Combined, this sends the message that privacy and data protection is still NOT an important consideration.

Finally, the use of the word “voluntary” in relation to the ID Card scheme, as widely reported in the press, really jars. The Home Secretary said: “Holding an identity card should be a personal choice for British citizens - just as it is now to obtain a passport. Accordingly, I want the introduction of identity cards for all British citizens to be voluntary”. So obtaining a passport is a voluntary personal choice is it?

What do think would happen if I made a choice not to have a passport and turned up at the Channel Tunnel wanting to go to France? This meaning of “voluntary” is not in my dictionary.