Hawktalk

Do privacy enhancing technologies have an Achilles Heel?

I want to return to the claim that “security versus privacy is a false dichotomy” made by Dr. Ann Cavoukian in her Seven Principles (see last week’s blog). The reason: I am beginning to think that this dichotomy is alive and well and the Principle that asserts a “false dichotomy” is wrong. I want to explore this issue in the context of CCTV cameras but I think the problem I raise could apply to many Privacy Enhancing Technologies or Privacy by Design solutions, so much so, that the issue needs a fuller analysis.

In a recent speech made by Dr. Cavoukian, she noted that at the University of Toronto, Professor Kostas Plataniotis and Karl Martin have developed a privacy-enhancing approach to video surveillance cameras. Their work, as described in “Privacy Protected Surveillance Using Secure Visual Object Coding”, uses cryptographic techniques to secure a private object (a face/image), so that it may only be viewed by designated persons.

Their technique means that objects of interest (e.g. a face or body) are stored as completely separate entities from the background surveillance frame, and strongly encrypted; this in turn means that the actual image of the individual appears ghosted. If you look at Dr. Cavoukian’s presentation at http://www.ipc.on.ca/english/Resources/Presentations-and-Speeches/Presentations-and-Speeches-Summary/?id=890 (slides 38-44) you will see what I mean.

So let’s cut to the chase as it is a blog. I think the major risk to privacy relates to processing of personal data by the public sector and not by the private sector. This risk is a result of the public sector wanting to use technology to process personal data obtained for one purpose by one public authority for other purposes by different authorities. The way that this is effected is via Governments enacting legislation through Parliament in order to provide that statutory gateway. I have already demonstrated that in the UK, that this creates circumstances where the privacy protection is very weak (see the two part Nine Principles papers on www.amberhawk.com).

Note that for the public sector, data subject consent does not make the processing of personal data lawful. However, as soon as you have that statutory gateway, there is no need to consider such consent because the processing is now required by law. This means that the Parliamentary processes that enact laws (and regulatory regime) become the important consideration; user centric designs dependent on consent are largely irrelevant.

The private sector wants to exploit its personal data assets also. However, the private sector cannot usually rely on statutory gateways to achieve this end, unless the Government enact legislation to permit this exploitation. If this law is enacted, one reverts to the situation described in the two paragraphs above. That is why Credit Reference Agencies can obtain complete Electoral Registers – no consent needed.

In summary if you have legislation, then there is no need for consent; if you don’t have legislation, consent rears its ugly head. It follows that it is only in these latter categories that privacy by design techniques are important because they allow data subjects detailed control of their consent. It also follows that privacy by design concepts are only a relevant to the private sector; for the public sector they are not particularly relevant.

A change in the law that allowed any organisation to process personal data lawfully if there was data subject consent is a possible solution, but I would be very wary of this step. The Home Office have a curious notion of consent (see blog of 14th September where individuals “freely consent” to get their “voluntary” ID Card), and parts of the NHS are still wedded to concepts such as “implied consent”.

Now back to CCTV images. If the individual does not do anything “wrong”, then there is no need for any person to see the full image – if the individual does something “wrong” then the image becomes available. Now ask yourself the question: who decides what is wrong? Well it is the law, the system of regulation and how the political process decides what is “wrong”. Because images of “right doers” are privacy protected, you can have more CCTV cameras because “wrongdoers” are the only concern; in this way the technology becomes the embodiment of the statement “if you have done nothing wrong, you have nothing to fear”.

Dr Cavoukian’s “security and privacy” Principle is, in my view, mistaken for another reason. Privacy focuses ONLY on the individual; whereas in the post 9/11 world, public sector processing has a significant component focused on the security of the state. It cannot be right therefore to say that “privacy of the individual” is in harmony with “security of the state” where wrongdoing is effectively defined by the state in circumstances where the usual democratic checks and balances are very weak.

That is why I think that the European Commission’s Directorate of “Freedom, Security and Justice” is such a fundamental error. This structure has arguably produced a situation where individual privacy has become subservient to security – but that is a subject for the future.

Parliament, sensitive personal data and the National Identity Register

During the following week of the Labour Conference I am taking a keen interest as what Charles Clarke MP, serial critic of Gordon Brown, says. Whether, for example, he talks about “integrity”, “transparency” or “accountability” - that kind of stuff. “Ahhhh”, I can hear you say, “this is proof positive that Chris really needs to get out more”. But you would be wrong; the issue affects us all as it strikes at what Parliamentary accountability really means.

One example should suffice. In all the early public consultation documents about the ID Card database (the National Identity Register), the Government said something like "None of this information (in the Register)...falls within the category of sensitive personal data". These public reassurances were reversed by an amendment tabled by Mr Clarke at the Report stage of the ID Card Bill. However, Mr Clarke’s failed to mention this reversal and the explanations given to Parliament for this amendment do not even pass the minimal threshold of being “economical with the truth”.

To understand this position, you must look at section 1(5) and 1(6) of the ID Cards Act.  S.1(5) provides a list of data types to be stored in the Register; it states that "In this Act “registrable fact”, in relation to an individual, means—

(a) his identity;

(b) the address of his principal place of residence in the United Kingdom;

(c) the address of every other place in the United Kingdom or elsewhere where he has a place of residence;

(d) where in the United Kingdom and elsewhere he has previously been resident;

(e) the times at which he was resident at different places in the United Kingdom or elsewhere;

(f) his current residential status;

(g) residential statuses previously held by him;

(h) information about numbers allocated to him for identification purposes and about the documents to which they relate;(my emphasis)

(i) information about occasions on which information recorded about him in the Register has been provided to any person; and

(j) information recorded in the Register at his request.

S.1(6) says "But the registrable facts falling within subsection (5)(h) do not include any sensitive personal data (within the meaning of the Data Protection Act 1998 (c. 29)) or anything the disclosure of which would tend to reveal such data". For convenience, that is why I italicised the relevant subsection above.

Government Ministers explained the purpose of the clause was to “to rule out the use of sensitive personal data” in the Register (Hansard, 18 Oct 2005, Column 741) whilst Mr Clarke added at Third Reading (Hansard, 18 Oct 2005, Column 799) that the Register would not contain “criminal convictions, financial records or political or religious opinions” and that the purpose of the amendment was “that it will not be possible to add a police national computer number to the register”.

Both these statements to Parliament are clearly wrong, as can be seen through the asking yourself a simple question: “If section 1(5)(h) cannot contain sensitive personal data by law, what does a specific exclusion limited to 1(5)(h) imply for all the other sub-sections 1(5)(a)-(j) (except (h))?”. Do you see that all these categories now might contain now sensitive personal data, because if the exclusion in 1(5)(h) was meant to apply to more subsections, the amendment tabled by Mr Clarke would have specified these other subsections?

Was this explained to Parliament? Of course not. In my opinion, Charles Clarke MP was in charge of the ID Card Bill when Parliament was repeatedly misled as to the purpose of the Register, and this explains why I am listening out for what Mr. Clarke’s says.

(Readers who want to know the full extent of the numerous times that Parliament was misled or ill-informed should read: “Evidence to the Constitution Committee in its inquiry into the Surveillance Society (Parts 1 and especially Part 2)” on www.amberhawk.com”).

Canadian Commissioner promotes the principles of privacy by design

Dr. Ann Cavoukian, the Information and Privacy for Commissioner for Ontario, has been championing the cause of Privacy by Design concepts for years. I can remember an International Commissioner’s conference over a decade ago where she presented her paper on Privacy Enhancing Technologies showing that there were technical solutions to real data protection problems. Now she has published two new documents: the first sets out seven principles for Privacy by Design; the second sets out the possibility of using of untraceable biometrics. Readers who have a strong interest in this field are recommended to look at these issues; she normally leads other Privacy Commissioners by years mainly because she is that rarity of a regulator that understands the technology.

Dr. Cavoukian sets out Seven Principles that define the Privacy by Design (PbD) approach. These are that the PdB approach is:

1. Proactive not reactive; preventative not remedial: PdB does not offer remedies for resolving privacy infractions once they have occurred; it aims to prevent them from occurring.

2. Sets privacy as the default: this means that if individuals do nothing, their privacy still remains intact.

3. Embeds privacy into the design: PdB is embedded into the design and architecture of IT systems and business practices; it is not bolted on as an add-on or after the fact.

4. Offers full functionality: PdB seeks to accommodate all legitimate interests and objectives not through a dated, zero-sum approach, where unnecessary trade-offs are made. PdB avoids the pretence of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both.

5. Permits end-to-end lifecycle protection: PdB, having been embedded into the system prior to the first element of information being collected can offer cradle to grave privacy protection.

6. Visible and transparent: PdB seeks to assure all stakeholders that whatever the business practice or technology involved, it is in fact, operating according to the stated promises and objectives, subject to independent verification. Its component parts and operations remain visible and transparent, to users and providers alike and operates by the mantra “trust but verify”.

7. Respects user privacy: PdB requires the design to be user-centric by offering such measures as strong privacy defaults, appropriate notice, and empowering user-friendly options.

Also published is a discussion document on “Untraceable Biometrics (UB), a term developed by Dr. Cavoukian to define a new class of emerging privacy enhancing technologies that embody standard fair information practices and provide for user control, data minimization, and a high degree of data security. UB has five distinguishing features:

1. There is no storage of a biometric image or conventional biometric template;

2. The original biometric image/template cannot be recreated from the stored information, thereby rendering it untraceable;

3. A large number of untraceable templates for the same biometric may be created for different applications;

4. Untraceable templates from multiple applications cannot be linked together; and

5. An untraceable template may, however, be revoked or cancelled.

Commentary

So will it work? Of course it will – I am sure of that. However, my own view is that most data controllers and governments start from the instinctive position that they want to exploit their personal data assets to make savings, or a profit, or to deliver policy objectives. Hence they are unlikely to trust a technology that is perceived to be designed to protect data subjects by restricting that potential for exploitation. This is especially the case if policy-makers see that their choice is, for example, between leaving policy options open by data retention or closing them through data minimisation.

In addition, I am sure the spooks and police forces will simply love the concept of “untraceable biometrics”; as soon as this causes a problem they will pressurise Ministers for laws that require the untraceable to become the traceable. That is what the UK Government is doing at the moment; it wants telecommunications companies to capture communications data that they don’t collect now.

Dr. Cavoukian’s counter argument to this is that her technical solutions can deliver both “security and privacy” (see her 4th Principle). There is “security” because the untraceable can be traced (if need be), and “privacy” as those who do not need to be traced remain untraceable. I worry about this argument. If one postulates that there are circumstances when the anonymous becomes the identifiable, the untraceable becomes the traceable and the encrypted becomes the unencrypted, then why not allow the authorities to collect more personal details, safe in the knowledge that these extra data will only be accessed if there is a pressing need?

In addition, if there is “security and privacy” there has to be a mechanism that transforms “privacy” into “security”. This in turn leads to the laws that govern this transformation, the political system that enacts these laws, the way privacy laws work in practice and the role of the privacy regulator. This in turn leads to detailed questions such as: “do we have a judicial warrant to allow access to the encryption algorithm or will a billet-doux signed by a senior police officer suffice?”; “Should the regulator report to Parliament or the Home Secretary?”and, “What powers should the regulator have?”. Very familiar territory isn’t it.

I think that a cultural change is needed. Currently, the data protection regime is often seen by data controllers as a barrier to the “proper” use of personal data. Indeed, I wish I had a £10 for the number of times Data Protection Officers have been asked to be “innovative” in an attempt to get round a data protection requirement. It is this cultural view that explains why all Commissioner-pleadings to data controllers to implement a privacy enhancing solution to protect data subjects usually fall on deaf ears.

In my view, that culture will only change when individual data subjects in the market place demand a change. When consumers or voters begin say “my choice of supplier or government depends on how well they protect my privacy” then the political and managerial system will consider responding with the implementation of privacy enhancing solutions.  That change in culture is developing slowly on the Internet and aided by some lackadaisical security practices; however I think we are years or even decades away from that user-centric, privacy, nirvana.

In short, Dr. Cavoukian’s ideas do allow privacy advocates to argue a convincing privacy case to data controllers; however, we should realise that it is the ultimately the attitude of data subjects (forcing data controllers to respond to their expectations) that will deliver eventual cultural change.

Information Tribunal changes likely to result in more FOI/DP judicial reviews.

Hawktalk’s own informants and spies have managed to glean significant intelligence about the discussions at the first General Regulatory Chamber (GRC) Conference held recently at Warwick University.  No, this wasn’t a meeting of a Grand Masonic Lodge but rather an event that will be of significance to all DP and FOI practitioners, the latter being most affected. The reason: there is the prospect of a further appeal beyond the decisions made by a new Information Tribunal where that appeal does not involve the expense of going to Court.

In mid January, the Information Tribunal is being transferred to become part of “the First-tier Tribunal”. This First–tier Tribunal is a generic tribunal established under the Tribunals, Courts and Enforcement Act 2007, and according to the Tribunal’s website “its main function is to hear appeals against decisions of the Government where the Tribunal has been given jurisdiction”. This is slightly misleading - it will also hear appeals in other areas as well.

The First–tier Tribunal is currently divided into six chambers. It looks as if the Information Tribunal is to become known by the catchy title of "First Tier Tribunal (Information Rights) of the General Regulatory Chamber". All lay Members of the Tribunal will become known as "Other Members" which if I am honest sounds like something rude. The Chair becomes “Principal Judge” and the Deputy Chairs “Judges”.

The interesting point for practitioners relates to the GRC Rules of Procedure as it includes a new right for appellants to appeal against the First-tier Tribunal's ruling to an Upper Tribunal also divided into “Chambers” (just like in Harry Potter films). Appeals with respect to Decision Notices impacting on the release of documents relating to the War on Iraq, or the Gateway Reviews of the much loved ID Card Project, readily spring to mind as illustrations of the type of issues that are likely to qualify for an appeal to the Upper Tribunal.

The main functions of the Upper Tribunal are:
• To take over hearing appeals to the courts from the decisions of local tribunals;
• To exercise powers of judicial review in certain circumstances ; and
• To deal with enforcement of decisions, directions and orders made by tribunals.

So instead of the expense of going for judicial review or appeal to the Courts on a point of law, an aggrieved complainant can ask for the case to be placed before the Upper Tribunal. Obviously the Upper Tribunal will not hear cases without merit or are vexatious, but where the case is of significant public interest etc, the cost of a judicial review will be reduced as I understand that both sides will be expected to carry their own costs.

The Upper Tribunal can also consider certain cases that because of their nature do not go to the First-tier Tribunal (e.g. an appeal against the ICO’s Decision Notice that involves requests of a controversial nature). If this happens, a further appeal on narrow “points of law” grounds is possible (e.g. to the Court of Appeals and thence to the House of Lords) but this means that FOI applicants whose case is set before the Upper Tribunal will face extra costs if the Upper Tribunal’s decision goes against them and they want to continue legal action.

However, the new arrangement in many cases should mean that simple blokes like me (or pressure groups) should be able to refer cases of particular interest or merit to the equivalent of the High Court without the risk of paying the other side’s costs. Now that’s a prospect to think about.

Cartoon

©Chris Slane

Aussie dossiers subject to the right of access?

Justin Langer, the veteran Australian batsmen, in a farewell interview published in the Sunday Times yesterday mentioned the fact that “Our assistant coach gives us a thick dossier on every opposition side.... This happens every day in county cricket nowadays, let alone international cricket”. Justin Langer also told the paper that he himself had added to one Aussie dossier, referring to James Anderson, England’s opening bowler as “pussy” (whatever that means).

Of course private dossiers of personal information held by a data controller in the UK can be subject to the Data Protection Act and hence the right of access. So I see no objection for James Anderson to exercise the right of access to personal data to see what kind of “pussy” he really is.

Of course, as a football fan with an expansive knowledge of the game (Barnsley FC are giving the rest of the teams in the Championship a 5 game start first before we get going), I am eager to ensure that my excellent team are not put at a disadvantage by the likes of a Newcastle or an Arsenal. So I have advised the club to take advantage of the Government’s approach to manual files held by private sector bodies as specified in its Data Protection Act.

I have suggested that they keep their dossiers in manual form in a folder marked with the club’s name (e.g. Manchester United) where division of the folder into details of individual footballers of the opposing team are not in any particular order. In this way the dossiers do not form a Relevant Filing System but are easily accessible. This means the personal information is not “data” as defined in the Act, and therefore cannot be “personal data”.

It follows that the right of access does not apply, thus allowing all pussies to purr in private.

Home Secretary spends 90 minutes per day with interception warrants?

Home Secretaries down the ages always say that when they sign a warrant that allows the authorities to intercept the content of a communication, they consider the matter very seriously. And in fact Section 5 of the Regulation of Investigatory Powers Act (RIPA) requires the Secretary of State not to issue an interception warrant unless he believes, that the warrant is proportionate and necessary either (a) in the interests of national security; or (b) for the purpose of preventing or detecting serious crime; or (c) for the purpose of safeguarding the economic well-being of the United Kingdom. In addition, Section 10 of RIPA allows the Secretary of State to modify the provisions of any previously signed interception warrant.

 

So if you were Home Secretary, how long would it take for you to satisfy yourself that a warrant was necessary and proportionate? I reckon it is at least about 10-15 minutes to mull over the details of a new warrant and say 1-3 minutes to refresh one’s memory in relation to a modified warrant. This is especially the case as a warrant, according to Section 8, relates to “one person as the interception subject” or “a single set of premises”.

 

As with my comments concerning access to communications data (see the blog of 9th September), a “person” means “individual” or “organisation”. Section 8 of RIPA thus allows a single interception warrant to refer to one specific individual (e.g. Fred Bloggs), or one specific organisation (e.g. Royal Bank of Scotland) or a “single set of premises” (e.g. properties within 100 yards of Canary Wharf Underground Station). The point of these examples is to show that a single warrant could relate to many individuals and one would expect that the more expansive the warrant, the more time (care) the Home Secretary takes.

 

Helpfully, the latest Annual Report of the Interception of Communications Commissioner shows that there were 1508 new warrants signed last year and 5344 modifications. This means that each warrant can be expected, after signing, to be modified, on average, about 3 or 4 times. There is no explanation in the Commissioner’s Annual Report as to what comprises a modification, but clearly it could be something as simple as a change of phone number.

 

Now pause for a moment. Assume 225 working days per year – this would mean the Home Secretary signs, on average, five or six new warrants per day (say 60 mins) and, on average, about 24 modifications per day (say another 24 minutes being briefed ). So if our time-frames mentioned in the above are more or less correct, the Home Secretary is having a little warrant signing ceremony each working day that lasts around an hour to an hour and a half.

 

Is it credible that a very busy Cabinet Minister spends his or her time like this – every working day?  Of course not. This in turn means that the Commissioner’s published statistics provide evidence that the system of regulation that is supposed to protect our communications is fundamentally flawed.

Conservative policy to limit the surveillance state has significant privacy gaps

If the press response is anything to go by, the policy paper “Revising the rise of the Surveillance Society”, published by the Conservative Party yesterday, promises much in relation to enhanced privacy. Indeed, there is much to be welcomed. However, if you apply the principles underpinning “Nine principles for assessing whether privacy is protected in a surveillance society” (a download section of the main Amberhawk web-site), you will soon find significant gaps.

For example, the policy paper’s commitment to Parliamentary scrutiny is limited to “any new powers of data sharing to be introduced into law by primary legislation”. This is welcome, but it only relates to new powers. Thus all existing data sharing powers in relation to all legislation enacted by all previous governments do not fall within this commitment, which also does not apply to existing general order making powers relating to the content, use or retention of personal data.

The commitment to “replace the Human Rights Act with a British Bill of Rights” could serve to diminish privacy rights. The problem is that a Bill of Rights that contains a privacy right has to define exemptions from that privacy right for law enforcement purposes, public health, public safety etc etc. If these exemptions are drafted differently from those specified in Article 8 of the human right’s construction, then it means that more individuals may have to seek protection of the European Court of Human Rights. This prospect arises because the policy document does not state that there is to be a compete derogation from the European Human Rights Convention.

In any event, the actual commitment in the policy is to “examine the current level of protection afforded to individuals against the surveillance state”; it is not a commitment to improve the level of protection afforded to individuals. After examination, nothing could be changed.

In addition, the policy paper is silent in its definition of a privacy right in the context of the press. I have always argued that there can be a linkage between the Data Protection Act and Article 8 in a way that does not interfere with the exemption in the DPA in relation to the press. This linkage would also mean that the Information Commissioner could act where excessive powers are used by Ministers – something that is a clear policy objective of this document.

There is a welcome commitment to make an empowered Information Commissioner report to Parliament. However, other Commissioners in the privacy field (e.g. the Surveillance Commissioner, the Interception of Communication Commissioner or the Intelligence Services Commissioner) are left untouched by its analysis. These Commissioners will still report to the Home Secretary (not to Parliament) and the wider order making powers that Home Secretaries enjoy in the context of national security and serious crime will still apply (as they exist in legislation already enacted).

In my Principles article, I argue that if there is a prospect of very intrusive surveillance, then this should be balanced by more powers for the regulator. This is not the case in the context of these Commissioners (who have far too few powers) and the policy document does not change their status.

Some of the proposals relating to security are curious – for example, to task the Information Commissioner to issue security advice. This is ill-advised – best practice security advice from security experts is already widely available from widely recognised international standards bodies (for example), and it is difficult to see what the Commissioner can add.

The proposals with respect to the access to communications data do not target the correct problem. As I mentioned in a previous blog about the Annual Report of the Interception Commissioner (see 9th September), there were 504,000 requests for communications data in total, of which 1,553 requests were made by 123 Local Authorities. The policy document focuses on Local Authorities and requires them to obtain a judicial warrant; however such Authorities only make 0.3% of total requests and their frequency of request is just over one request for access a month each.  In other words, 502,500 other requests are left unaltered by the policy document.

Finally I make a comment about the commitment to scrap the ID Card scheme and the National Identity Register. This commitment is much diminished as the policy is silent about the Passport database. As this database is intended to collect biometric fingerprints, names, addresses and other items that would have appeared on the National Identity Register, this omission in effectively means that some ID Card functionality can be continued via the Passport database. The fact that the Royal Prerogative applies to passports means “no Parliamentary approval is needed”.

If the Conservative Party means what it says about accountability, this important Passport database should become subject to primary legislation.

Finally, I do not want to appear too negative as it is important to recognise that a major political party has issued a detailed policy document on privacy to lead a public debate. This is an important publishing event. But I do think that this policy document been hastily issued to deal with short term issues that are in the public consciousness. In my view, it lacks a long-term policy focus on how to settle privacy policy so it correctly balances the interests of the state with that of the citizen.

“Reversing the rise of the surveillance state” document is linked to http://www.conservatives.com/News/News_stories/2009/09/Reversing_the_rise_of_the_surveillance_state.aspx

Labour will keep the ID Card scheme.

It’s Wednesday, so how about an exercise in reading the political runes? Given the recent pronouncements by leading Government politicians, what do you think is going to happen to the ID Card scheme and its related database, the National Identity Register (NIR)? Is the ID Card scheme on the back burner (Lord Mandleson) or is it a necessary frontline service that needs protecting from the cuts (Mr Brown)?

Clearly, the NIR is not dead because the ID Card Scheme Commissioner has just been appointed (last Monday). Put aside the fact that the Commissioner is an ex-civil service mandarin with limited statutory powers or that he is merely another example of a regulator who protects the public and reports to a Home Secretary (who is responsible for all the key public bodies that will be allowed to use the NIR to interfere with private and family life). I think it is inconceivable that Government would make such an appointment if the ID Card scheme were dying.

Nor do I think the ID Card scheme is proceeding with full steam ahead because the purpose underpinning the NIR changes as often as does the Home Secretary. Confucius would no doubt have said something like “it is difficult to set out on a long journey when the direction of travel and the final destination are both unknown quantities”, and such a Confucian construction describes the range of official purposes associated with the ID Card scheme.

First the scheme was to protect us from terrorism or illegal immigration or to reduce crime. Next the scheme was to help identify which public service we are entitled to, which later morphed into making our daily life much easier and convenient. Indeed the Home Office is so enamoured with the latter objectives that it has positioned the NIR as the centre-piece of identity management requirements of “Transformational Government” arguing that NIR database is badly needed to deliver joined up public services electronically.

However, if this were to happen, the NIR’s audit trail would record any use of public and private services that required an ID check (e.g. opening a bank account, hiring a car, registration at a GP surgery), and allow these details to be disclosed to the law enforcement authorities.  In addition, we could be fined if we failed to register our home address or keep that address up to date or failed provide all ten fingerprints (all of which will be shared with the police and others). Oh. I forgot – don’t worry about privacy you ninnies – all 60 million of us will be protected by the ID Card Commissioner.

In fact, I think putting the ID Card scheme on the “back burner” will suit Labour perfectly as it gives time to decide what to do. If the issue is booted into touch, Labour can say it is “listening” and there will be no need to deal with awkward questions during next year’s General Election campaign. Indeed, the ID Card scheme could even be sold to the public as a “saving” by resurrecting the ID Card idea of the 1990s, where the ID Card serves as joint passport and driving licence (thus getting rid of the need to have the DVLA).

So what is the answer to the question I originally posed: is it (a) backburner or (b) necessary and frontline. The answer is of course “both”:  the ID Card scheme is being placed on the backburner so that someone in the Party can come up with ideas as to why the scheme is necessary.

Information Commissioner wrong to blame Parliament and the Courts

Ten days ago, the new Information Commissioner, Christopher Graham, was given a difficult time by MPs of the House of Commons Culture, Media and Sport Committee. The reason: he admitted to the Committee investigating “Press Standards, Privacy and Libel” that he did not have the resources to enforce the Act against the three hundred or so journalists who had used private investigators to obtain personal data unlawfully. He also said that Parliament and the Courts had let him down in not implementing his enforced powers in the Act (e.g. powers to fine and the increased custodial sentence)

 

The MPs were concerned that the Commissioner was reluctant to take on a powerful interest group and had failed to apply his powers to journalist excess. In countering this charge, the Commissioner pleaded that the market in personal data was not limited to journalists and that there were evidential problems in pursuing the matter. Foremost, for example, was whether or not any personal data obtained for a story by the use of a private investigator was in “the public interest”.

 

However, I think the real reason for not taking on the press is a pragmatic one. First, the Commissioner would take on a group of data controllers who have a special status thanks to the “special purpose” provisions of the Act. It is obvious that the press would argue that their ability to report freely was being impeded and any serious legal action would be defended, if need be, up to the House of Lords and beyond. In addition, there is the risk that the Press Complaints Commission could claim that the Commissioner was disturbing the delicate balance between press freedom and privacy by crudely placing his tanks on their lawn.

In other words, if the Commissioner were to take on the press, he would become stuck in a legal quagmire and would get nowhere, fast. He could also kiss goodbye to any chance of sympathetic press headlines.

 

With respect to the Courts and Parliament, I think the Commissioner is wrong to blame Parliament and the Courts. Readers with long memories will recall that it was Jack Straw who as Home Secretary ensured that the Data Protection Commissioner was a weak regulator with little powers. By some strange coincidence, it was the same Cabinet Minister who gave us a FOI Act with a very large number of exemptions. Now, by quirk of fate, he is deciding when to produce the Statutory Instruments that commence the Monetary Penalty Notice and the custodial sentence.

 

Clearly, the Government is having difficulties “getting the right balance” as to when to start these enhanced powers. This, of course, has nothing to do with the fact that personal data are continuing to be lost by public bodies subject to Ministerial control, and the fact that there is a need to keep the press “on-side” in the run up to a General Election.

 

The Commissioner’s evidence session can be watched on http://www.parliamentlive.tv/Main/MeetingDetails.aspx?meetingId=4645.

Uncorrected transcript on http://www.publications.parliament.uk/pa/cm200809/cmselect/cmcumeds/uc275-xiv/uc27502.htm.