Hawktalk

Data Protection: applying the Principles to the surveillance of a demonstration

Does it breach the Data Protection Act to process personal data about all demonstrators in order to identify those demonstrators who are also “domestic extremists”?  To answer this question, it is instructive to apply the Data Protection Principles to the photographing of a demonstration by the police.

The relevant explanation of the term “domestic extremism” is found on the website of National Extremism Tactical Coordination Unit (NETCU is the Unit that is at the centre of the controversy (http://www.netcu.org.uk/de/default.jsp). Its website states that “Clearly, the majority of people involved in animal rights, environmentalism and other campaigns are peaceful protesters and are never considered extremist” and that “The term only applies to individuals or groups whose activities go outside the normal democratic process and engage in crime and disorder” – for example - “criminal acts of direct action in furtherance of a campaign”.

The web-site continues: “Domestic extremism is most commonly associated with 'single-issue' protests, such as animal rights, environmentalism, anti-globalisation or anti-GM crops. Crime and public disorder linked to extreme left or right wing political campaigns is also considered domestic extremism”.  This is because “these people and activities usually seek to prevent something from happening or to change legislation or domestic policy, but attempt to do so outside of the normal democratic process”.

So, have you got the picture? “Domestic extremists” are those people who we have all seen on TV engaging in a range of criminal damage (e.g. pulling-up GM crops or smashing shop windows) or in a range of public disorder events (e.g. throwing smoke bombs or having a punch-up). Anything more serious would probably fall within the UK’s wide definition of “terrorism” (e.g. using Molotov cocktails).

However, note NETCU’s admission that demonstrations form part of the normal democratic process and most demonstrators are not “domestic extremists” and that the “extremist” is the exception rather than the norm. Hence, it follows that in terms of the Fifth and Third Principles, that the undue retention of personal data on law abiding demonstrators is likely to be excessive. In terms of the First Principle, the mere presence at a demonstration should not be sufficient grounds to legitimise the undue retention of personal data on those who are not connected with “extremists”. Fair processing obligations (e.g. signage) similar to that which is familiar with CCTV should be employed and visible to demonstrating data subjects.

Yes, I think that under the Act, it would be deemed lawful and legitimate for NETCU to process images of all data subjects for a reasonable period of time in order to identify any “domestic extremist”, but once that reasonable time has elapsed, that legitimacy expires in the context of those who aren’t domestic extremists.

In addition, for most law abiding demonstrators, the section 29 subject access exemption will not apply to these personal data because there is no prospect of prejudice to any criminal matter. It follows that data subjects on demonstrations should be able to exercise their right of access to personal data (i.e. the police photographs). Indeed, for a mere £10, you should be able to get high quality mementos of your participation in any demo. (However, you should keep a record of where you were and at what time to help locate the personal data obtained by the police photographer or CCTV operator who took your picture). Finally, I see no reason why the right to object to the processing of personal data should also not be applied if a demonstrating data subject considers that the personal data should not have been retained.

The policing of demonstrations requires a difficult balancing act – we all know that. The Data Protection Act can help make that balance transparent and fair to both sides. So I conclude that if the NETCU have nothing to hide, it will have nothing to fear from the application of the Data Protection Principles to the policing of a demonstration.

Finally, it is possible that the Home Secretary could sign one of those all embracing National Security Certificates in order to make the data protection issues “go away”. Arguably such a Certificate could be applied to most demonstrations on the grounds that a demonstration would be ideal cover for terrorists (hence the need to photograph everyone). However, this approach would merely expose the unacceptable and unaccountable nature of these National Security Certificates.

 

Police surveillance of demonstrators misses Congestion Charge angle

This week, the Guardian has run a major exposé of police surveillance of demonstrations and of the fact that the police have amassed a photo-library of individuals, many of whom do not possess a criminal record, but who involve themselves in lawful protest.

The photo-library is used to make “spotter cards”. This spotter card is a police version of those I-Spy games I used to have as a child; spot the demonstrator (or “domestic extremist” to use the official description) and call the Metropolitan Police’s Public Order Intelligence Unit to see how many points you get.

According to the newspaper, police surveillance also uses Automated Number Plate Readers (ANPR) to track cars driven by the leading “domestic extremists” of the day. As most demonstrations occur in London, it is possible that the pivotal role played by London’s Congestion Charge Cameras has been overlooked.

In an earlier blog ( “Can national security agencies disclose communications data or ANPR images to anybody?", 06/10/2009), I explained that the exemption described by the National Security Certificate that relates to the Congestion Charge Cameras permits the disclosure of ANPR images to anybody on the planet (e.g. any national government agency including the unsavoury ones) for any purpose (e.g. for a purpose that has nothing to do with crime and national security).

As most demonstrations occur in London, the Certificate is likely to apply to cars driven by “domestic extremists” as they make their way to a demo. The breadth of this exemption would thus permit a list of “extremists” attending a particular demo to be compiled and circulated (perhaps with relevant driver information from the DVLA) to interested national governments, perhaps as some kind of good will gesture. As the ID Card Act 2006 permits wide disclosures from the National Identity Register, it is easy to see that in future, the photograph of the ID Card holders could also be attached.

The policing of demonstrations calls for checks and balances. Such balance should be achieved by detailed legislation which has an independent regulator that can act as arbiter; that is why you have a Parades Commission in Northern Ireland and that is why it is important that the Information Commissioner investigates properly. It will be an interesting test of the new Commissioner who has just gone public with his “information rights” agenda (see yesterday’s blog).

However, in the case of these National Security Certificates such as the one signed in relation to the Congestion Charge ANPR cameras, there is a constitutional problem that is beyond the Information Commissioner. The Tribunal’s decision to chuck out the Privacy International’s Appeal limits such hearings to case-by-case circumstances when an individual tries to exercise data subject rights, and fails. Yet this Certificate, in data protection terms, legitimises mass surveillance of all those who drive into London.

All mass surveillance should be subject to detailed primary legislation. Yet these National Security Certificates are not even subject to the low standard of Parliamentary scrutiny that occurs when Secondary Legislation is enacted (e.g. by Statutory Instrument). In effect, the Certificate system established under the Data Protection Act substitutes administrative fiat for legislation and public debate.

Such a prospect, in my view, is simply unacceptable – especially when one considers these Certificates in the context of the Guardian revelations.

Information Commissioner contemplates unpopularity

At yesterday’s Update session in Manchester, Stephen McCartney, Head of Data Protection Promotion, at the Commissioner’s office outlined several changes to the structure of the ICO’s office and in the ICO’s modus operandi.

First the Office of the Information Commissioner is being reorganised and the division between Data Protection and Freedom of Information is being removed. Instead, staff at the ICO will be expected to deal with both subjects. The new focus will be on “information rights” rather than DP or FOI and in this context, the name of the Tribunal will change. From mid-January, the Information Tribunal will be known by the catchy title of "First Tier Tribunal (Information Rights)” (of the General Regulatory Chamber) as it will become a part of the First Tier Tribunal established by the Tribunals, Courts and Enforcement Act 2007.

In this context, appeals from the First Tier Tribunal can be heard by an Upper Tribunal. This Upper Tribunal will take over from the courts when arguments arise from the decisions of the First Tier Tribunal (e.g. when there are judicial review considerations). In the FOI context, this is likely to mean there will be more appeals from the decision of the lower First Tier Tribunal  (the old Information Tribunal) as the costs of a further legal appeal are reduced significantly (e.g. it is likely that each side will carry its own costs).

Cases of significance (e.g. a FOI request that raises a matter of significant public interest) can be heard by the Upper Tribunal (thus avoiding the lower Tier).

The focus of the ICO’s office will be on operational aspects, using powers where this is necessary to enforce information rights laws. The ICO will make the reduction of operational backlogs (e.g. assessments, Decision Notices) a priority. Policy matters, for example, delving into the Surveillance Society will still continue where appropriate but with a lower priority.

The Commissioner is to be known as the Chief Executive of the ICO to reflect the Information Rights agenda. When asked about the overlap between data protection and other Commissioners (e.g. in the context of access to communications data), the response was that if personal data were processed, then the Commissioner would have a remit to use his powers where appropriate.

The Commissioner is pressing for his ability to audit data controllers in the public sector to be extended to the private sector.

The ICO mission is to “uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals”. This statement says nothing about educating data controllers or public authorities in their obligations.

In anticipation of the power to fine (e.g. Monetary Penalty Notice) or imprison (e.g. custodial Section 55 offences) and the increasing use of signed undertakings when data protection matters go significantly awry, the ICO is expecting to become “less popular” with data controllers. As a result, I expect that more Information Notices to be served as data controllers (and public authorities) might be reluctant to confess all to a Commissioner that has significant powers and an information rights agenda to push.

In short, “no more Mr Nice Guy”. These new powers, when implemented, will result in a more normal relationship between the regulator and regulated.

Note: there are still places on our Edinburgh Update next Monday - details on www.amberhawk.com.

Data Protection: Is the 2011 census the last one of its kind?

Yesterday’s BBC news website carried a story headlined “Bedroom snooper row over census”.

“For the first time”, the report says “people will be asked to provide details of the number of bedrooms they have as well as the names, sex and birth dates of any overnight guests in their homes”. “Other new questions”, the report adds “include how well people can speak English, the date overseas nationals entered the UK, how people define their national identity and whether they are in civil partnerships”.

Nick Hurd, a Shadow Cabinet Office minister is quoted as saying “An increasingly invasive and intrusive census will erode public support ”

However, the BBC has probably missed a more controversial aspect of its story as the National Identity Register (NIR) -  the ID Card database - is intended to act as a population register so that it can deliver a rolling census in future. The current Government intends that the 2011 Census is the last one of its kind.

Back in 2004, the Office of National Statistics had promoted a separate adult population register as part of the Citizen Information Project (CIP). However by early 2005, the Government had decided that all CIP functionality (including the census and population register) would be incorporated into its plans for the wider use of the NIR. A draft Written Answer was prepared for Ministers in July 2005 so that the changes could be made public. However, political expediency meant that the actual statement was only given to Parliament after the ID Card Act 2006 had received Royal Assent.

There is a telling paragraph in the document that contained the delayed Written Statement. Civil servants advised Ministers: "Home Office believe there would be advantages in making an announcement before Parliament rises on 21st July (2005)" as "that would confirm the Government's intention to use the ID Cards register in this way while the ID Cards Bill is still being debated and so avoid subsequent criticism, say from the Information Commissioner, that the ID Cards register is subject to 'function creep' ".

Minutes released in relation to the CIP (dated 2004 and 2005) show that the NIR will be used in conjunction with the Census and could check that citizens are eligible to vote at elections. These Minutes show the Home Office:

• "should design the take-up profile of the NIR to be such that population statistics can be realised for the 2021 census".

• "has responsibility for delivering an adult population register that enables basic contact data held on NIR to be downloaded to other public sector stakeholders" (The "Treasury and Cabinet Office should ensure that NIR delivers CIP functionality as planned");

• "takes responsibility for ensuring from around 2021 basic contact data held by stakeholders can be up-loaded to the NIR";

The CIP's final report states (at page 17) that secondary legislation will allow "public services to be provided with NIR data without the need to obtain specific citizen consent".

I think this attitude towards data protection says it all – no further comment is needed.

Note: if readers are interested in knowing what else was withheld from Parliamentary scrutiny of the ID Card Act, see my Written Evidence to the Constitution Committee on the “policy download” pages of www.amberhawk.com

 

Data Protection: Enforcement action for making false Safe Harbor claims

In a way that mirrors the undertakings signed by UK data controllers, six U.S. businesses have agreed to settle Federal Trade Commission (FTC) charges that they deceived consumers by falsely claiming they were abiding by the EU/U.S. Safe Harbor framework. 

According to six separate complaints filed by the FTC, the six companies deceptively claimed they held current certifications under the Safe Harbor framework. The framework is a voluntary program administered by the U.S. Department of Commerce in consultation with the European Commission. To participate, a company must self-certify annually to the Department of Commerce that it complies with a defined set of privacy principles.

The FTC complaints charge World Innovators, Inc.; ExpatEdge Partners LLC; Onyx Graphics, Inc.; Directors Desk LLC; Collectify LLC; and Progressive Gaitways LLC with representing that they held current certifications to the Safe Harbor program, even though the companies had allowed their certifications to lapse.

Under the proposed settlement agreements, which are subject to public comment (unlike the UK type undertakings), the companies are prohibited from misrepresenting the extent to which they participate in any privacy, security, or other compliance program sponsored by a government or any third party. Each violation the final agreement may result in a civil penalty of $16,000 (there again unlike the UK undertakings).

The interesting point arising from the USA action is the link to unfair processing if this kind of claim were to made by a UK based data controller. So suppose a UK data controller made a claim that its USA business partners were in Safe Harbor with respect to any transfer of personal data, then this claim would open the UK data controller to a breach of the First Principle if the USA self-certification certificates had lapsed. In general, therefore, if you are making claims to reassure data subjects in fair processing notices about the processing of personal data (e.g. on your web-site), then make sure such claims are justified and up to date.

The agreements can be accessed from http://www.ftc.gov/opa/2009/10/safeharbor.shtm and will be finalised after a period of public consultation. If you want to make a comment, be my guest; just download http://www.ftc.gov/os/2009/10/sixcasespubliccomment.pdf. Details of Safe Harbor on http://export.gov/safeharbor).

DNA database: the press is wrong to report a civil libertarian victory over DNA retention.

According to Monday’s Guardian: “Home Office climbs down over keeping DNA records on innocent”. On the same day the BBC reported: “The government has dropped plans to give ministers wide powers on holding innocent people's DNA data on record”.  Both news outlets reported the Government’s actions to withdraw clauses on DNA retention in terms of a victory for civil liberties.

‘Scuse me – I think these journalists have jumped the gun.

The Policing and Crime Bill had proposed providing Ministers with powers that set time limits on holding DNA and related personal data; innocent individuals could expect their DNA data to be retained for six years or possibly longer is some cases. The Home Office said that this time period had been backed by “evidence” from the Jill Dando Institute for Crime Science. Unfortunately the Institute is on the record as saying that its evidence should not have been used to decide the six- to twelve-year time limits because its research was incomplete.

The DNA retention provisions had also received trenchant criticism by scrutiny Committees in Parliament. The Delegated Powers and Regulatory Reform Committee reported that because of the breadth of these powers they “should not be allowed to remain in the Bill in their present form”.  A similar message came from the Joint Committee on Human Rights Committee; it reported that “we are alarmed that the substance of these proposals (on DNA data retention) will not be contained in primary legislation, subject to the usual scrutiny by both Houses. We strongly urge the Government to think again”.

In other words, the Government had a political headache in the Lords. There was no evidential base to support its DNA retention proposals and a great deal of Parliamentary opposition had assembled; in addition, both main opposition parties want DNA data on innocent individuals to be deleted.  That is why Lord Brett, bowed to the inevitable and said that the Government “have decided to invite Parliament to remove Clauses 96 to 98” adding that “as soon as parliamentary time allows, we will bring forward appropriate measures which will place the detail of the retention periods in primary legislation”.

In other words, the Government ditched its DNA retention proposals rather than waiting for them to be defeated.

However the removal of these clauses means “DNA business as usual”. Even if the Government were to immediately introduce new primary legislation on DNA retention, if it is not in tune with Opposition demands, such legislation is unlikely to get through as the current Parliamentary session ends in April 2010 (at latest).  This in turn could mean that any “DNA Retention Act” will not receive Royal Assent until well after next year’s General Election.

In effect: “no change to the DNA collection and retention rules about the innocent until at least 2011”. Last year, the DNA database expanded by 10%; it now contains 5 million entries, 20% of which relate to the “not convicted”. The delay means another half million entries can be expected to be added in the next year.

This is hardly a victory for civil liberties. That is why some journalists were premature in their judgments.

Data Protection: “violent markers and libel: everyone a winner except the taxpayer”

One of the things I like about our Update sessions is that you get to know what you missed. And so it was with the case of Jane Clift v Slough Borough Council (Neutral Citation Number: [2009] EWHC 1550 (QB)) – a judgment delivered in June 2009 – which deals with the “violent warning marker”.

What happened was essentially this. Ms Clift reported to a council official (Ms R) an incidence of  anti social behaviour that upset her. That telephone call got heated and the phone call was cut off by Ms. Clift before Ms R said she was terminating the call. Ms Clift then wrote to the Council saying “"I did not want to give [Ms] R the self satisfaction of terminating the call – I slammed my phone down so hard I broke it. I felt so affronted and filled with anger that I am certain that I would have physically attacked her if she had been anywhere near me. I truly am not of that nature and so, surely, this should act as a wake up call to the Borough as to the capacity she has for offending people".

The colourful phrases used in the letter caused Slough to activate its “violent warning” mechanism. This resulted in an investigation by Mr  Kelleher that concluded that Ms Clift’s actions amounted to violent and threatening behaviour. Mr K said that a marker was to be placed against her name for 18 months and shared with other council departments and government agencies within the borough by electronic means. The result was that Ms. Clift sued for libel and the Council dug in to resist the action.

I recommend the judgment to all our readers involved with the violent marker issue; there is a lot to take in and consider. However, the outcome was that Ms Clift was awarded damages of £12,000, the Council and its investigator (Mr Kelleher) were deemed not to have acted maliciously, and the lawyers involved were suitably enriched for their troubles. Only the taxpayer lost out as he was left picking up the tab.

(By the way, there are places still available in Manchester and Edinburgh Update - details on www.amberhawk.com!. If you Google the case reference you will find it - if having difficulty, email [email protected]).

Data Protection: CRB could stop misuse of irrelevant criminal data in employment vetting

I might be old fashioned, but I think it’s OK for the police to retain those criminal records they need to do their job. So I am not surprised by yesterday’s Appeal Court decision that allowed them to do so, even when there were disclosures of trivial and ancient criminal details for employment purposes.

For example, the Appeal Court considered the case of HP, who in March 1984 was 16 years of age. He stole items from a display in a M&S store and at the Juvenile Court was convicted of theft and fined £15. In 2006, the offence was disclosed on an enhanced disclosure certificate dated when HP had applied for a position as a care officer with Hull City Council. HP was then informed by his employer that an enhanced disclosure certificate had revealed his conviction, which he had not previously disclosed and he was informed by his manager that he may be disciplined.

Shocking isn’t it! I wholly agree that this kind of misuse of personal data in these kinds of circumstances should be stopped.

However, the wrong data controller has been dragged through the Courts. The real problem is not the police processing of such records or making a disclosure to employers, but rather employers using irrelevant criminal detail when making employment decisions.

In theory, employment vetting using criminal records needs the employer to register with the Criminal Record Bureau. To obtain disclosure, the employer must then comply with the CRB’s Code of Practice which has been approved by Parliament, developed after a lengthy public consultation and is intended to reassure job applicants that the vetting process is fair.

Indeed the CRB boasts that it “takes seriously its statutory duties relevant to the rehabilitation of offenders, data protection and human rights legislation. It will therefore seek to ensure strict compliance with the Code through the full range of CRB assurance management processes”.

The Code requires that those who use the CRB’s vetting services to: “have a written policy on the suitability of ex-offenders that is available upon request to potential applicants”; to “notify all potential applicants of the potential effect of a criminal record history on the recruitment and selection process and any recruitment decision”; and to “discuss the content of the Disclosure with the applicant before withdrawing any offer of employment”.

I have found is no evidence that suggests that the CRB has done anything to enforce its own Code of Practice. I have seen no information that suggests to me that employers, subject to the Code, have adhered to its terms.  It appears to me that the CRB’s much vaunted Code or Practice could easily be window dressing – nothing more, nothing less.

However, it can be so different as the Code, if implemented and enforced properly, would resolve all the relevant data protection issues. All that needs to happen is the following:

(a) The disclosure of all criminal details to each employer should be by secure electronic means (this includes enhanced criminal intelligence detail).

(b) This form of disclosure would ensure that the employer would be a data controller with respect to the disclosed sensitive personal data.

(c) The failure to apply the CRB Code of Practice can then be enforced as not to comply with its terms is unfair (the CRB actually say the purpose of the Code is to be "fair").

(d) The use of irrelevant criminal personal data by an employer when making an employment decision would constitute a breach of the Third Principle.

Note that the data subject can sue for compensation (if damaged), the Information Commissioner can enforce the Act on the correct target, the police can retain their records, and irresponsible employers who improperly use criminal details can be castigated.

Everybody then would be happy.

Data Protection: no new powers for the Commissioner in 2010?

So the Government has finally published its consultation on whether or not there should be custodial sanctions relating to selling or offering to sell personal data that have been unlawfully obtained (i.e. without the consent of the data controller).

At the moment, the offence under section 55 of the Data Protection Act 1998 is non-custodial with a £5,000 fine maximum. The Government is consulting on whether or not the maximum summary penalty at the Magistrates Court should be increased to 12 months in prison and/or a fine of up to the statutory maximum of £5,000. On indictment by the High Court, the maximum penalty could be increased to 2 years in person and/or a £5K fine. This brings it into line with similar offences, for example in the Computer Misuse Act.

So why the public consultation now? I think there are two drivers. First, there is a critical report coming from a Parliamentary Select Committee on the horizon; it took evidence on “Press standards, privacy and libel” and asked questions as to why there had been 18 months of governmental inaction on these penalties. After all, the relevant provisions to activate the custodial offences were hastily put in the Criminal Justice and Immigration Act in January 2008. Having a consultation before the Select Committee reports allows the Government to deflect that criticism.

Secondly, I think the public consultation boots the issue into the grass until after the General Election. For example, the consultation closes on Jan 7th 2010. Suppose it takes about 3 months to “reflect and decide”: that takes us to mid-March/April. As Parliament could be dissolved in April (likely) in relation to the General Election in May (latest June 3rd), it follows that there won’t be much time to introduce the necessary Regulations. The Easter weekend is April 2nd / 3rd; this removes another fortnight from the Parliamentary timetable.

Interestingly, the consultation states that “the Government proposes to bring in the new custodial penalties from April 2010, when the intention is that the ICO be given enhanced powers”. This means the Monetary Penalty Notice is supposed to start in April 2010 – something else I really don’t quite believe. I was assuming there would be a consultation on the extent of the powers that allow the Commissioner to fine data controllers?

Another problem is that in May/June, after the Election, an incoming Government has a difficult political mandate to follow with important economic problems to address. Do you really think they will spend Parliamentary time on a data protection issue?

That is why I am going down to the bookies to see whether I can get decent odds on these new powers and penalties not appearing in 2010.

Special Branch would have protected Elvis

Since it is a Friday, I raise a curiosity that relates to a FOI request to all information on John Lennon held by Special Branch. Naturally being Special Branch, the applicant no doubt received all that extra special loving care and attention we expect of such public authorities.

The Branch told him that he could not get the requested details because of the application of exemptions relating to sections 23(5) (information supplied by or relating to national security bodies), S.24(2) (national security), S.31(3) (investigations), S.38(2) (health and safety) and finally S.40(5)(b)(i) (personal information). After internal review, the matter went to the ICO for a Decision Note (FS50154349).

Hang on a second – the “personal data” exemption and “information about John Lennon” in the same sentence. OOPS! “Houston. We have a problem!”.

The ICO’s staff soon asked Special Branch to specify “to whom this personal data would relate” and “which of the data protection principles it believed would be breached through disclosure and to explain how this breach would occur”. The ICO helpfully added that “given that for information to constitute personal data it must relate to a living individual” and that even “the confirmation or denial (that information about John Lennon was held) ...would not constitute the personal data of John Lennon”.

No reasoned response was given to the ICO’s impertinent question so he concluded that the exemption was not engaged, adding for good measure “Had the request been for information relating to a living individual the stance of the public authority may have been stronger”.

Now everybody in the know realises that Elvis is alive and well and living anonymously in Barnsley; it also well known that Elvis was an informant for Edgar J Hoover in the 1960s. That is why, I have concluded, that Special Branch would be right to withhold personal information on Elvis if there were to be a similar FOI request to his personal details.