Hawktalk

Vetted volunteers to “volunteer” fingerprints and obtain a “voluntary” ID Card?

The brouhaha surrounding the vetting undertaken by the Independent Safeguarding Authority (ISA) with respect to the safeguarding the vulnerable has tended to overlook that such volunteers are likely to “volunteer” to obtain their ID Card. In addition, the link to ID Cards may increase the cost of “volunteering” to about £170 (the vetting fee of £64 and the ID Card cost of £100 plus).

Although such a prospect has not been discussed by the press or by Ministers, in my view, such links will be made at a future time when both the ISA scheme and the ID Card scheme have bedded down. The reason why I think this is the case is explained below.

In October 2007, a Criminal Records Bureau (CRB) press release reported that “In line with recommendations from the Bichard Report, the CRB is examining the security benefits that ID cards may bring. In a joint trial with the Identity and Passport Service, 160 volunteers piloted two online services aimed at accelerating and toughening-up background checks on people who want to work with children and vulnerable adults”.

The CRB later reported an 87% approval rating for “the ID card-linked service” as this would “improve the vetting service”. Home Office Minister Meg Hillier added that “Clearly, establishing identity quickly and accurately is absolutely crucial when dealing with people who want to work with children or vulnerable adults”. The Minister then added that “By linking your details to your fingerprints, the National Identity Scheme will make it easier and quicker to prove identity”.

In November last year, the CRB reported that “One of the provisions of the proposed legislation is to link ID cards to ‘designated documents’ under the Identity Cards Act 2006” where “One of those designated documents is to be, subject to the consultation, the Basic Disclosure”. The “Basic Disclosure” is a simple criminal record certificate that reveals to any employer, the unspent convictions of the applicant for a job. (The legislation facilitating the Basic Disclosure was enacted by the Major Government in the Police Act 1997).

However, since the ISA have access to criminal intelligence from the police and the criminal record from the CRB, it is reasonable to assume that the ISA will prefer if the applicant possessed an ID Card. It must be an obvious concern  to the ISA that its credibility would be completely “shot” if it allowed an ID-theft imposter to gain access to the vulnerable!

In last November, the Home Secretary made the political decision to abandon the requirement that airside workers obtain an ID Card – he stated that access to the ID Card would be “voluntary” in all cases. However, the meaning word “voluntary” becomes stretched if a “volunteer” in ISA terms, has also to provide a full set of fingerprints, permit personal data on the National Identity Register to be used for purposes such as the “efficient and effective delivery of public services”, allow an audit trail to track every use of the voluntary card, and stump up £100 for the pleasure of getting an ID Card.

In summary, very little has been said about the potential links between the ISA and the ID Card. If there is to be an informed public debate about the current vetting controversy, then this linkage should form part of that discussion.

The data protection arguments surrounding the DNA database are clarified

In July this year, the Times reported a Whitehall briefing paper that discussed the use of portable equipment that provided the police with a DNA analysis within one hour, rather than the three days it currently takes. In ten years time, it easy to envisage that DNA checking will occur in real-time,  raising the spectre of instant DNA checks for those stopped in connection with road traffic offences or with street incidents. If we are really lucky, such DNA checks might ensure that the biometrics associated with the much loved ID Card scheme work reliably.

Last Wednesday, to mark the 25th Anniversary of the discovery of the DNA technique, Professor Sir Alec Jeffreys of Leicester University told the BBC that "innocent people do not belong on that database". This contradicts the assertion made by the Home Secretary that if the DNA of innocent individuals who have been arrested but not convicted is removed, then criminals who have perpetrated horrific crimes will escape justice. This justification underpins the minimum six year retention period for DNA that has been proffered by Government in these cases.

My own view is that the portable equipment clarifies by the nature of the Data Protection debate over the DNA database. I am not going into the recent legal submissions from Michael Beloff QC that argue the Government’s proposals would constitute a continuing and unlawful breach of Article 8, but rather apply some rather basic data protection principles.

The starting assumption is that all relevant DNA samples from a crime scene are loaded onto the DNA database and that these records are retained until the crime is solved, Because DNA can be matched within an hour or quicker, then even in the coldest of cases of serious crime, a match should occur if an individual is arrested for whatever reason. As DNA from criminals can already be retained beyond the lifetime of the data subjects concerned, then a match will always occur if there is also a criminal record (even a caution).

I should add that the vast majority of the cases I have seen reported in the press, by politicians or in Home Office documents fall in this category: the DNA from the crime scene is on file and a person involved has been arrested at a later stage in relation to an unconnected matter. The DNA taken on the later arrest is then matched to the previous scene of crime.

It thus follows that the debate on the retention of DNA is a limited one. It focuses on retention in those circumstances when there has been an arrest, and where DNA sample does not match an entry in the DNA database, and when it has been decided not to proceed with the case or the individual concerned is acquitted. It follows that example of cases that do not fall into this narrow category (of which there are many) are frankly irrelevant.

I can see four broad reasons why there is not a match to a previous crime scene following an arrest:
1. The individual arrested is not linked to any previous crime scene (obvious but has to be stated).
2. Resources might have not been deployed in sufficient quantities to load DNA from a crime scene in the correct time frame (i.e. the individual has been arrested, released and DNA deleted before the DNA from the crime scene has been loaded onto the database).
3. The crime scene might not contain DNA in a form that can be analysed using current techniques (e.g too little).
4. The crime has not yet occurred or the crime scene has not been discovered.

In relation to reason 2, it can be seen that it is not common. In addition, I see no reason why DNA data should be retained merely because insufficient resources have been deployed. I have not seen the Government argue that it can’t meet the requirements of the security obligations in the Act so it should negate them in legislation. Why, therefore, should it do so in relation to retention? Instead of lengthy retention periods and mass data retention, the obvious solution is to increase the necessary resources and shorten the retention period to months.

In relation to reason 3, there is little to do except to identify those cases that can be reprocessed as soon as techniques improve. It cannot be justifiable to argue that DNA data should be retained en-masse for six years just in case there are technical improvements to come.

I thus conclude that the main reason for retention of DNA relates to reason 4. The purpose of retaining DNA of those arrested but who are not convicted is to provide intelligence as to the identification of such individuals on the basis that they may be involved in future crime. Note I say, may – because it is obvious that if DNA becomes a major intelligence technique used by the police, then leaving somebody else’s DNA at the scene of a crime will become the obvious counter-measure to employ. If this is the case, the result will be unfair processing because someone who is innocent may have to prove they were not guilty (i.e. not at the crime scene).

In general, there may be complex cases where there are arguments for retention of DNA in specific circumstances. If there are such exceptions, the answer lies in a mechanism for the police to argue in favour of retention on a case-by-case basis, and not in blanket retention of all DNA of those affected. For instance, if someone were to be arrested in relation to a sex offence and is subsequently acquitted.

That is why I think that any legislation to implement the Government’s six year retention proposal is intended to neuter the application of the Fifth, Third and First Principles. Such legislation is designed to permit the retention of personal data that are excessive to the policing purpose, and where their processing is not necessary for a policing purpose, and where unfairness to some data subjects is likely to result. It is for these reasons, that I also think that such processing is likely to be disproportionate in terms of Article 8.

Note readers who are interested in this subject should look at the document “Document discussing the relationship between the Human Rights Act/Data Protection Act and the DNA database - 2009” and “Evidence to JCHR re powers in Police and Crime Bill – 2009” which discusses the clauses that give Home Secretary control over regulation, retention and use of DNA database, CCTV, & ANPR images. Both are available as downloads from www.amberhawk.com

Is there is no chance of winning a privacy complaint?

For the last 20 years, Home Secretaries have been signing warrants that allow for the access to the content of intercepted communications and as well as powers of entry, search and seizure for the national security agencies. Not many people object to these powers because the interception, search or entry is in a good cause that protects the public.

But how do we know this? The answer is that the Government has established a number of independent regulators (e.g. Surveillance Commissioner) and an Investigatory Powers Tribunal (IPT) to sort out claims of abuse; this system too has been around now for almost two decades. As I mentioned yesterday’s blog, these Commissioners are appointed by, and report to, the Government whose agents undertake the surveillance.

The IPT replaced the Interception of Communications Tribunal, the Security Service Tribunal, the Intelligence Services Tribunal and the complaints provision of Part III of the Police Act 1997 (concerning police interference with property) in October 2000. The Investigatory Powers Tribunal and Commissioners have thus operated with a number of guises since 1985. This history means that statistics from all the cases heard by these Tribunals can be compiled from the various annual reports published on the web (and from Parliamentary Questions – see Hansard, 20 Jun 2005: Column 767W for example).

In summary, I calculate that there has been about 1,700-1,800 cases before these Tribunals concerning the alleged misuse of powers. Only three cases have been resolved in favour of the complainant, and two of these were in the 2008. This means there has been an overall dismissal rate for complaints of about 99.80% in total.

Pause a moment to consider that 99.80% number. Ask yourself two questions, the first being “would you use a complaints procedure that had a 0.2% chance of success?”. If you answered “No”, this implies that a number of putative complainants are unlikely to their waste time in using these formal complaints channels. The second question is “whether a 99.80% figure is credible?”. To assist the reader, in this analysis, it is useful to assess other figures around this level – for example, the 99.96% approval rating that Saddam Hussein obtained in his 2002 re-election as President of Iraq springs to mind.

That’s enough of statistics! However, I do think these numbers point to the lack of a credible complaints procedure which risks engendering mistrust in those who wield these wide ranging powers.

Is “one adult in 78” subject to surveillance of their communications?

Whilst on holiday abroad (late August), I spotted a Daily Mail headline that baldly stated that “one in 78 adults came under state-sanctioned surveillance last year”. Perusing the newspaper at a safe distance of 1.625 metres, it did not take me long to work out that the story had missed some other interesting statistical points in relation to the Annual Report of the Interception of Communications Commissioner, just published.

Any informed analysis of this controversial subject must start with the Regulation of Investigatory Powers Act (RIPA) and its definition of “communications data” in S.21(4). Such data includes “any traffic data comprised in or attached to a communication...”  or  “...any information which includes none of the contents of a communication... in connection with the provision to or use by any person of any telecommunications service”. Note that word “person” – most of our data protection ISEB delegates would recognise it from its use in the definitions of the Act where it means “organisation” or “individual”.

So if a public body demands “communications data” by virtue of Section 22 of RIPA, that demand relates to communications made to, or by, a “person”. So when the Commissioner reports 504,073 requests for communications data, each one of these requests could relate to a “person”. The implications of this are profound; for example “Please give me the communications data relating those who called Boots the Chemist last week” is technically one request for communications data relating to a person.

Given that each request for communications data usually involves a minimum of two individuals (the caller and called), it follows that up to 1.08 million citizens may have been affected by these provisions in the year as reported by the Commissioner. Given that there are 60 million plus in the UK, one can see that the Daily Mail statistic of 1 in 78 figure could well underestimate the scale of the surveillance.

In my missive (“Nine principles for assessing whether privacy is protected in a surveillance society (Part 2)” – see Amberhawk web-site), I argue that public trust requires that Government should not define the criteria that is intended to reassure the public about the degree of surveillance. I argue that it should be the responsibility of the Commissioner to be able to define what records are kept by those doing the surveillance and what statistical information is collected and published in order to reassure the public.

To do otherwise is to risk collecting data that are designed to obscure rather than to illuminate. For example, Regulation 9 of SI 2007 No 2199 (dealing with the retention of communications data) limits one statistical item required by Government to "the number of occasions when data have been disclosed". This means, for example, that a disclosure of communications data pertaining to say 3,000 individuals would count as one “occasion” of disclosure, when perhaps the 3,000 affected individuals is the more interesting number.

In the same piece, I argue that any Commissioner has to be well resourced. In his report, the Interception Commissioner says that he is supported by a “Chief Inspector and five Inspectors” – that makes seven investigatory staff, excluding office support.  So if 504,000 requests are supervised by seven staff, this means that each staff member is acting as a public watchdog for over 1,600 different requests for communications data per week. This stark statistic does not reassure with respect to the resources needed for effective supervision.

Finally, it is interesting to note that the Commissioner reports to, and is appointed by, the Prime Minister, the politician most responsible for the surveillance undertaken by the state. That is why I argue that in such a structure, there is a significant risk that the Commissioner does not possess the independence needed to guarantee the delivery of effective scrutiny.

So what should be done? My top three simple suggestions are:
(1) The Commissioner should report to, be financed by and appointed by Parliament
(2) There should be no “no-go” areas of supervision; a Parliamentary Committee can decide what to redact in any report, not the Prime Minister.
(3) The Commissioner decides what records of surveillance should be kept by those doing the surveillance and what statistics to report.

Without something like the above, the system of supervision of the wider use and disclosure of communications data is, in my view, unfit for purpose.

Information Commissioner’s staff are mystery shoppers

Isn’t coming back to work after a two week holiday a drag?

One of the things I should have blogged about before the summer break was the discussion at launch of the Information Commissioner’s Annual Report about “mystery FOI shoppers”.  You should realise that ICO staff are already mystery FOI shoppers but in my view, it is only a matter of time before such activity extends to data protection.

The Commissioner stated at the Annual Report launch that in the context of FOI, “his office will begin proactive monitoring of the adoption of, and publication in accordance with, the new publication scheme, as well as proactive dissemination under the EIR”. He added that “such monitoring will also provide an important opportunity to review more general compliance with the FOIA and the EIR and to assess the practices of public authorities”.

The ICO guidance on such monitoring (on his web-site) adds that certain sectors will be targeted for specific periods of time (for example, police forces for 3 months) and that the Commissioner expects to monitor at least 20 public authorities per month. To this I would observe that through the work relating to a vast array of Decision Notices, the ICO has a readymade list of target authorities whose procedures might not pass muster.

The ICO expects that remote monitoring of public authority websites is likely to involve:
• confirming that the public authority has adopted the model publication scheme and has produced a guide to information.
• an initial check against the types of information identified in the ICO sector-specific guidance or template guides, e.g. about the availability of information about directorate structures, expenses and allowances paid to senior personnel, or an authority’s performance against official targets.
• a review of an authority’s guide to information and policies with particular emphasis on accessibility and any charging regime.
• establishing that FOI procedures and timeframes conform to ICO guidance (e.g. concerning internal review, transfer of requests, performance statistics in relation to requests and complaint handling).

If the ICO gets a “taste” for this kind of activity, it would be easy to extend mystery shopping to data protection. For instance, the checking of a data controller’s fair processing notice against the standards of the new Fair Processing Code of Practice or seeing whether subject access points advertised on a web-site actual can deal with a request. Perish the thought, if mystery shoppers started to look at the nonsense that often appears on the Register of Data Controllers!

In summary, I think that as the ICO’s audit functionality in data protection gains more experience, one would expect ICO staff to become mystery shoppers before undertaking any inspection.

So your next inquiry might be from a mystery shopper working for the ICO? Nice to be back, isn’t it.

Shelagh Gaskill bursary launched to help Charities, Voluntary Groups and Housing Associations with cost of Data Protection compliance

Amberhawk Training today announces the creation of the Shelagh Gaskill Bursary, which provides up to £1,000 towards the cost of legal training in freedom of information and data protection.  The bursary is a progression of the Shelagh Gaskill Scholarship that was successfully administered by international law firm Pinsent Masons following Shelagh’s death in 2006.  The scholarship operated for three years and provided training in data protection and freedom of information for charities and those in the voluntary sector.  It supported a number of major charities such as Shelter and Barnardos as well as smaller ones. The new bursary carries on this work.

The Shelagh Gaskill Bursary is intended to help charities, hospices, housing associations, voluntary and community organisations.  These bodies are subject to some very difficult data protection issues but have limited resources available to fund the cost of training employees in information law. The bursary continues to mark Shelagh’s significant contribution to this area of law and her role in championing the rights of individuals. 

Rosemary Jay, partner at Pinsent Masons said, “Pinsent Masons has a strong commitment to support for the voluntary sector, as shown by our award-winning CR programme. We were proud to launch and support the scholarship during the past three years and delighted to see that Amberhawk is carrying the excellent work involved.”

Sue Cullen, director of Amberhawk Training, said, “I knew Shelagh for more than two decades and worked with her for much of that time.  The bursary is created in her name to commemorate her drive to apply her unrivalled knowledge and skills in defence of individual rights.”

The bursary gives individuals working for not-for-profit organisations responsible for information law compliance the chance to obtain data protection or freedom of information training by taking the Amberhawk courses at a reduced cost.  As well as providing the tools to perform their jobs more effectively, candidates who succeed in the examinations will benefit by acquiring a formal, nationally recognised qualification from the Information Systems Examination Board (ISEB).

Sue Cullen concluded, “We hope that the new bursary will help successful applicants to apply their learning and new skills for the benefit of the wider community.”  Further details of the Shelagh Gaskill Bursary and a personal memory of Shelagh are available from the link on the home page of Amberhawk (www.amberhawk.com).