Data Protection: applying the Principles to the surveillance of a demonstration

Does it breach the Data Protection Act to process personal data about all demonstrators in order to identify those demonstrators who are also “domestic extremists”?  To answer this question, it is instructive to apply the Data Protection Principles to the photographing of a demonstration by the police.

The relevant explanation of the term “domestic extremism” is found on the website of National Extremism Tactical Coordination Unit (NETCU is the Unit that is at the centre of the controversy (http://www.netcu.org.uk/de/default.jsp). Its website states that “Clearly, the majority of people involved in animal rights, environmentalism and other campaigns are peaceful protesters and are never considered extremist” and that “The term only applies to individuals or groups whose activities go outside the normal democratic process and engage in crime and disorder” – for example - “criminal acts of direct action in furtherance of a campaign”.

The web-site continues: “Domestic extremism is most commonly associated with 'single-issue' protests, such as animal rights, environmentalism, anti-globalisation or anti-GM crops. Crime and public disorder linked to extreme left or right wing political campaigns is also considered domestic extremism”.  This is because “these people and activities usually seek to prevent something from happening or to change legislation or domestic policy, but attempt to do so outside of the normal democratic process”.

So, have you got the picture? “Domestic extremists” are those people who we have all seen on TV engaging in a range of criminal damage (e.g. pulling-up GM crops or smashing shop windows) or in a range of public disorder events (e.g. throwing smoke bombs or having a punch-up). Anything more serious would probably fall within the UK’s wide definition of “terrorism” (e.g. using Molotov cocktails).

However, note NETCU’s admission that demonstrations form part of the normal democratic process and most demonstrators are not “domestic extremists” and that the “extremist” is the exception rather than the norm. Hence, it follows that in terms of the Fifth and Third Principles, that the undue retention of personal data on law abiding demonstrators is likely to be excessive. In terms of the First Principle, the mere presence at a demonstration should not be sufficient grounds to legitimise the undue retention of personal data on those who are not connected with “extremists”. Fair processing obligations (e.g. signage) similar to that which is familiar with CCTV should be employed and visible to demonstrating data subjects.

Yes, I think that under the Act, it would be deemed lawful and legitimate for NETCU to process images of all data subjects for a reasonable period of time in order to identify any “domestic extremist”, but once that reasonable time has elapsed, that legitimacy expires in the context of those who aren’t domestic extremists.

In addition, for most law abiding demonstrators, the section 29 subject access exemption will not apply to these personal data because there is no prospect of prejudice to any criminal matter. It follows that data subjects on demonstrations should be able to exercise their right of access to personal data (i.e. the police photographs). Indeed, for a mere £10, you should be able to get high quality mementos of your participation in any demo. (However, you should keep a record of where you were and at what time to help locate the personal data obtained by the police photographer or CCTV operator who took your picture). Finally, I see no reason why the right to object to the processing of personal data should also not be applied if a demonstrating data subject considers that the personal data should not have been retained.

The policing of demonstrations requires a difficult balancing act – we all know that. The Data Protection Act can help make that balance transparent and fair to both sides. So I conclude that if the NETCU have nothing to hide, it will have nothing to fear from the application of the Data Protection Principles to the policing of a demonstration.

Finally, it is possible that the Home Secretary could sign one of those all embracing National Security Certificates in order to make the data protection issues “go away”. Arguably such a Certificate could be applied to most demonstrations on the grounds that a demonstration would be ideal cover for terrorists (hence the need to photograph everyone). However, this approach would merely expose the unacceptable and unaccountable nature of these National Security Certificates.

 

Comments

[Ian Brown]

How would Durant affect subject access requests for photos that were not indexed by name or other obvious identifying information?

[Antoinette Carter]

Following a recent protest I attended in the City of Westminster, the organisers were threatened by the Council with prosecution for "littering" ie. handing out leaflets and "criminal damage" for putting up demonstration posters on lamp-posts using blu-tack....

[cp]

Assuming that the photos were not processed automatically in any form (e.g. the police did not use electronic cameras), the images would still constitute personal data. However as category (e) data held by a public authority, only the right of access and correction would apply.