Hawktalk

Fax off. The PECR marketing privacy rules are different for e-mail

So the Information Commissioner has taken enforcement action against Ivor Cox, trading as Orion Forklift and Plant, following breaches of the Privacy and Electronic Communications Regulations (PECR). The action comes after more than 1700 complaints about the organisation were received by the Fax Preference Service (FPS) and by the ICO.

The complainants were blessed with unsolicited marketing faxes about Ivor’s forklift trucks, sometimes in the early hours of the morning, even when the recipient was registered with the FPS. Given that Ivor also faxed his missives to some individual’s home fax machines, I think he is lucky he did not also get an ASBO; it can be argued that the demand for “domestic” fork-lift truck services is obviously close to zero so it follows that his faxes constituted an anti-social nuisance.

And so far so good. However, if Ivor shifted his unsolicited marketing to e-mail he would find that the PECR regime would be different. Instead of sending a fax by fax, he can scan it in and send his unsolicited text as an attachment to business e-mail contacts extracted from the web. Under PECR, business contacts would not have the same ability to object.

The reason is that when the Government implemented PECR, it arranged for the “prior consent to unsolicited e-mail marketing” rules to apply only to individual subscribers. This means that e-mail marketing to most businesses and their employees requires no prior consent because, under PECR, it is the business that is the subscriber and not the individual employee.

Just to make this point clear. Most of the readers will have e-mail addresses from a corporate subscriber (e.g. [email protected] ; [email protected]) whereas their individual domestic subscriber e-mail would be of the form [email protected]. This means that a simple analysis of the various e-mail addresses would distinguish those belonging to likely "individual subscribers" from the rest.

So, if I want to complain about unsolicited marketing which involves my work e-mail address, I have use the data protection rules, but if my own personal domestic e-mail is involved, I have the protection of PECR’s consent rules.

This is far too complicated. I have never understood why the Government decided that, under PECR, spam sent to my work e-mail should be treated differently from spam sent to my e-mail address at home.

How a £750 printer could affect everybody’s privacy

Yesterday’s Evening Standard, London’s newest free-sheet, published a story about “Police war on fake ID factories”. Evidently, a £750 printer from PC World is all one needs to produce convincing replicas of “the propose new ID Card and EU driving licence” as well as “passport entry stamps and national insurance cards”. According to the Standard, the police have initiated “Project Genesius” to stop these kinds of printers falling into the hands of criminal gangs.

The development has implications for privacy – thanks to the UK’s ID Card Scheme. For example, the original intent of the ID Card Scheme was to allow organisations to do inspection-type checks. For example, retailers or licensees might want to check proof of age by looking at the date of birth on the Card, or car rental outlets might want to check the photograph of someone hiring a car before handing over the keys. Now, thanks to a £750 printer, if someone shows you their ID Card you will not know, by inspection, whether that ID Card is a false one.

The resolution of the problem of whether or not an ID Card is a valid one, is to swipe the Card to perform a check against the National Identity Register (NIR). As the vast majority of individuals will have valid ID Cards, this check will be registered in the audit trail associated with the NIR.  This in turn means the authorities now have records that point to the fact that Fred Bloggs Jnr may have bought some booze from a specific off-licence or Joanne Smith has probably hired a car from a specific hirer.

In other words, the existence as something such as cheap as a £750 printer has meant that inspection checks cannot be relied on with the result that the audit trail of the National Identity Register will map more and more detail of everybody’s personal life.

 

Being a “General Identifier” is not a data protection safeguard.

As you know I love the ID Card; in fact I love the idea so much I think I will try and get two.

However, today’s blog is inspired by my reading of the document “Identity Cards Act Secondary Legislation: a response to the Consultation”, published by the IPS in May 2009. Within a discussion about safeguards it says:

“It has also been asked whether the National Identity Registration Number will be considered a 'general identifier' and accordingly an order made under the Data Protection Act 1998 to reflect this. Given the limited nature of the initial rollout of the Service and that the National Identity Registration Number will not be printed on the card, it is the Government’s view that the National Identity Registration Number could not be considered a general identifier at present. However, it is still intended that it will be designated as such in due course, once identity cards have been issued in greater numbers”.

I am sure this response has been prompted by submissions to the consultation process that promoted the designation of the National Identity Registration Number as a General Identifier as being a safeguard.

I have to say that this view is wrong. All the Data Protection Act does is to provide powers for the Secretary of State to order that general identifiers “are not to be treated as processed fairly and lawfully unless they are processed in compliance with any conditions so prescribed in relation to general identifiers of that description”. So if there is an Order, the processing of the designated General Identifier becomes fair and lawful.

So a harmless Statutory Instrument on the lines that “the National Identity Registration Number shall only be processed for purposes that are necessary in the public interest” seems a limitation. However, because of the breadth of the definition of “necessary in the public interest” in the ID Card Act 2006, it would mean that the Number would be used by the obvious agencies (police, immigration and national security) but additionally “for the purposes of the enforcement of prohibitions on unauthorised working or employment” and “for the purpose of securing the efficient and effective provision of public services”.

Note the last two. The National Identity Registration Number could be processed by all employers in vetting and checking, and by all public authorities in respect to the efficient and effective provision of their public services. If processed, therefore, the Number would provide links between many public and private sector databases.

This potential explains why the National Identity Registration Number is so problematic, and more importantly, why being a “General Identifier” is not necessarily a safeguard!

 

Can the Scots Nats strengthen its Human Rights Commission?

 

The political party conference season has ended and it is very clear there is little in the way of privacy policy emerging. The Tories have a policy document on the surveillance state (see blog – not coherent); the Lib Dems are deliberating what to do via a Privacy Commission (we have to wait for white smoke), and Labour offers the same as before. Only the Scottish Nationalists seem to be trying something new.

 

The Tories do promise a Bill of Rights. However the difficulty is not defining the individual rights but rather when the rights do not apply. If the Bill of Rights is to substitute for the Human Rights Act (HRA), then it cannot be to too different from the HRA. If there were to be significantly differences from the HRA, then the demand for Easyjet flights to Strasbourg is likely to increase.

 

I think the main privacy problem is that the Government is an “active” data controller wanting to exploit its data assets; it is in a special position in that it can enact legislation that makes the processing lawful. It is very difficult to restrain privacy busting projects like the National Identity Register if you have a weak Parliamentary system of pre-legislative scrutiny combined with a weak system of post-legislation regulation (the UK has both).

 

Two decades ago you had what I call “benign” Government processing where the processing of personal data was mainly limited to individual Departmental needs. Now you have the “active” Government and the development of cross Departmental needs for the processing of personal data – that is why you have all these data sharing initiatives. The real problem is building a Parliamentary and regulatory structure that reduces the risk that the currently “active” becoming a future “malign”.

 

For example, it took ages for Marper’s DNA case to get to Strasbourg.  I think it wrong that individuals have to take the UK Government to court on a privacy issue; this is a David v Goliath struggle where an under-resourced individual takes on an opponent who dips into the infinite kitty created by all taxpayers.

 

I think Article 8(2) of the HRA is an important safeguard as it identifies when public authorities can process personal data without consent; it follows that most other processing should be undertaken with consent (or a “no questions asked, right to object”). I also think that my construction of the definition of personal data in the “Reclaiming Privacy on the Internet” (see www.amberhawk.com) can afford wider protection. It the usual personal data definition plus the fact that if the data subject can easily provide the identifying information (e.g. to orgs like Google), then processing of IP address type data becomes the processing of personal data.

 

As it is the anniversary of Monty Python, now for something completely different.  Given that the Scottish Nationalist Government is wanting to distinguish itself politically from all Westminster parties at the forthcoming General Election, how about the idea of the extending the role of the Scottish Human Rights Commissioner to protecting the rights of those domiciled in Scotland in terms of the Human Rights Act in terms of Westminster legislation (e.g. someone who could possibly assist in actions on behalf of individuals whose Human Rights have been breached by Westminster legislation)?  If I were thinking of something unique to a Nationalist Party,  offering additional protection to its electorate that its Conservative and Labour  opponents would be unlikely to offer, then the idea Commissioner has a certain appeal.

 

The establishment of a Commissioner would also protect all of us in the UK as well. Perhaps we should all develop an interest in Scottish politics (as well as the malts).

 

 

NOTE: This blog has changed slightly from originally published in that I overlooked the establishment of the Scottish Human Rights Commission which started work in January 2009; the Commission was established by the Scottish Commission for Human Rights Act, 2006. The current Commission is mainly limited to the actions of Scottish Public Authorities and it is excluded from devolved matters. The idea here is to provide a limited role for the Commission with respect to the impact of UK-wide legislation in Scotland. For example, if regulations under the ID Card legislation, were in the opinion of the Scottish Human Rights Commission in breach of Article 8 of the Human Rights Act, I see no problem in them investigating the matter, holding evidence sessions, and writing a report, or indeed taking action or assisting action under the Human Rights Act in order to strike out the regulations.

We can’t disclose because of the Human Rights Act

It used to be the Data Protection Act, but now it appears that the Human Rights Act has caught the disease described by the statement: “we can’t do anything because of the Human Rights Act”.

Dominic Grieve, Shadow Minister of Justice, has just contracted the infection. He said yesterday at the Conservative Party Conference: “How many times have we seen police or probation officers say they can’t disclose the identity of a criminal because of his privacy under the Human Rights Act?”. For example, the “Police in Derbyshire refused to disclose photos of fugitive murderers” and “the Serious Organised Crime Agency say they can’t name gangsters”.

He added that the position was a “complete nonsense” and announced that a future “Conservative government will change the rules for people charged with protecting the public on the frontline. Why?  So it’s clear crystal clear that protecting the public takes precedence over the privacy of criminals”.

In practice the law is not a barrier and the publishing of criminal personal data is bounded by two human rights cases. The first one is the Gary Ellis case. He contested Essex Constabulary’s decision to feature his photograph, name and conviction details on posters in his home town. His successful human rights argument was based on the fact that he was currently serving a three-and-a-half year sentence for theft offences, and the use of posters would unfairly stigmatise him and his family especially his young children (e.g. who might become targets of bullying at school or other forms of ostracism).

The Ellis ruling specifically referred to the "inappropriateness" of using any offender in the scheme who was a parent. This implies that if Essex Constabulary had chosen a criminal who did not have children, the outcome could have been different; in fact, I think that the position of the children was the pivotal in the case.

The other bound to the act of publishing criminal details is the judgment surrounding the naming of teenagers by the London Borough of Brent. A gang of seven youths had created mayhem over two years and the Council gained an Anti-Social Behaviour Order (ASBO) in September 2003.  The Council wanted to publish their photographs to enforce the ASBO. However the youths argued that publishing personal details and photographs in this manner had been unnecessary, especially if the information ended up on the internet, gaining worldwide exposure.

In this case, the Court decided that there was no breach of Article 8 and the publicity was a proportionate response to target enforcement of a punishment on those responsible for the anti-social activity. This is in contrast to Gary Ellis, where the target of the publicity was to target individuals other than Gary Ellis.

Such publicity is not contrary to the Data Protection Act 1998, as section 29 of the Act permits the disclosure of personal data where failure to disclose would prejudice to a criminal inquiry. This means that personal data can be published with a view to compliance with a statutory function that is necessary for the “apprehension of offenders”. That is why the police can publish details of sex-offenders who have gone missing.

So if details can be published to enforce an ASBO, I see no barrier in publishing the details of “fugitive murderers” and violent criminals where this is necessary to protect the public or apprehend the offender. Note that “necessary” is a limitation, it does not mean “useful”.

There are problems with the Conservative approach to more general publicity. In the UK, we have the presumption of innocence and the willy-nilly activity of publicising individual photos in relation to criminal activities has to be weighed the context of jeopardising the criminal trial itself. In addition, what would publicity do to an offender who has a history of violence and mental illness; could any publicity cause the offender to panic in a way that harms the public? If the police publish the details of any offender, will that encourage identity theft or more crime if the individual concerned goes underground?

In short, publishing details of criminals or suspects needs to be considered on a case-by-case basis and care is needed as to the possible consequences. The current statutory framework allows publishing but also requires such due care and deliberation.

So what advice do I give to patient Dominic Grieve to treat his infection? How about “Please do the analysis before you speak and not afterwards”.

 

What lies beneath the extradition of hacker Gary McKinnon to the USA

Should extradition arrangements between the USA and the UK, established in connection with counter-terrorism and serious crime, be used against Mr Gary McKinnon who suffers from Asperger’s Syndrome? Asperger’s is a disability on the higher functioning end of the Autistic spectrum, and I must declare a special interest, as a close family member has it.

Mr McKinnon is a computer hacker who admits he broke into various USA defence systems in an attempt to find out about “UFOs, free energy and secret government”; occasionally he left helpful comments that imparted the obvious (e.g. “your security is cr*p”).   However, as the hacking straddled the events of 9/11, the breaches in security came at a very sensitive time for the Bush Administration.  Overlooking all embarrassment caused by the inadequate security employed by US Government Agencies, the authorities wanted McKinnon extradited to the USA to face up to 70 years in jail.

There have been a number of court hearings in the UK on this extradition; McKinnon has lost them all. On 14th July 2009, the BBC reported that the Director of Public Prosecution “decided there was insufficient evidence to support a UK prosecution under the Computer Misuse Act” (under Section 2 of the Computer Misuse Act which carries a significant custodial sentence).

This declaration raises a very curious conundrum that has always troubled me about this extradition: there is not enough evidence to send him to jail in the UK but there is enough evidence to extradite to the USA where McKinnon faces a life-time sentence.

I think part of the answer to this conundrum can be found in a 50 page document that leaked from the DPP’s office. It confirms the Section 2 offence was in the DPP’s mind, and was published on the Computer Weekly web-site. It contains statements such as the following:

• there is no evidence that the ACPO guidance concerning the examination of digital evidence has been followed, nor is there evidence of continuity”.
• Witness statements from USA witnesses “all tend to refer to reports concerning the examination of machines by others and their statements contain a lot of hearsay”.
• “Without sight of the reports themselves it is not necessarily possible to ascertain how much of the material will be admissible” (as evidence), and
• “there is insufficient evidence currently available to prosecute Mr McKinnon”

The DPP’s lack of evidence raises two very important questions: (a) “why did the USA authorities hold back on providing the evidence?” and (b) “why did the DPP not ask for the missing evidence that he identified in his reports before rejecting the option of undertaking a prosecution in the UK under Section 2 of the Computer Misuse Act?”. After all Parliament deliberately enacted the Computer Misuse Act so that hacking in the USA, from the UK, could be prosecuted in the UK?

Could the answer to these questions be something like not wanting to harm that “special relationship” at a time when the “war on terror” was in full swing? If so, the risk is that McKinnon’s extradition is motivated by politics rather than by justice. However, I think there is much simpler answer to this question; it is quite simply that the DPP could not trust the jury if the case were to be prosecuted in the UK.

In 1993, a four-week trial of Paul Bedworth, a 19-year-old student, accused of unauthorised access to several computer systems under the Computer Misuse Act, ended with his acquittal. Like McKinnon. Bedworth said was he now understood that hacking was illegal and, by his own admission, “stupid”.

However, Bedworth’s barristers introduced an unusual defence of “computer addiction”. Expert witnesses testified to his compulsive behaviour, and after testing Bedworth, described him as an obsessive person, totally besotted by computers. Now anyone who knows anything about Asperger’s Syndrome knows that obsessive behaviour is one of its main characteristics; both Newton and Einstein were obsessed with physics, for example.

So I also conclude that it is likely that the DPP also knew that any UK prosecution could easily fail if the obvious “obsession” defence was mounted. When this is combined with the unpopularity of the Bush Administration over the War in Iraq, the poor security that would be described in open Court, I think the DPP concluded that a jury might acquit, irrespective of what evidence he laid before the Court.

That is why, I think, the DPP did not ask the obvious questions of the Americans. He simply did not want to know the answers that would mean he would be in a position to prosecute in the UK.

Magna Carta, in 1215, established the idea that any judgement is by a “jury of one's peers”. In McKinnon’s case this does not mean a jury of individuals drawn from the community in which he lives; it means deliberately choosing a jury which is over 3,500 miles away for fear that a UK jury might acquit.

Other reference added (2016)

There is a similar prosecution to McKinnon (Lauri Love) using the Computer Misuse Act (October 2016) discussed on

https://amberhawk.typepad.com/amberhawk/2016/10/should-computer-misuse-act-offences-committed-in-the-uk-be-prosecuted-in-the-uk.html

Can national security agencies disclose communications data or ANPR images to anybody?

Idly browsing through the National Security (Information Tribunal) web-site (as one does when one has spare time to kill), I noticed that a new appeal involving Privacy International (PI) has been posted.  Evidently the privacy pressure group was raising questions about the National Security Certificate that allows for the real-time transmission of ANPR images of cars entering London’s Congestion Charge to the national security agencies. PI’s appeal fell at the first hurdle because it was an organisation and not a data subject.

The substantive data protection points raised by PI are very serious and interesting, as the relevant Certificate, signed by the Home Secretary under S.28 of the Data Protection Act,  specifies an exemption from the Second and Eighth Principles (amongst other more obvious things). It is these wider aspects that PI wanted to challenge, and it is easy to understand why this is the case.

The Second Principle requires a data controller that is deciding whether or not a disclosure of personal data is incompatible with the purpose of its processing to have “regard ...to the purpose or purposes for which the personal data are intended to be processed by any person to whom they are disclosed”.

Thus, if there is an exemption from this obligation, it means that the disclosure of personal data can occur without any regard for any processing purpose undertaken by the person to whom the data are disclosed. It follows that the exemption in the Certificate permits the agencies described by the Certificate to disclose ANPR images within Europe for purposes incompatible with the national security or serious crime purpose.

Similarly, the Eighth Principle can require a risk assessment to be taken prior to the transfer of personal data outside the European Economic Area. So any Certificate that exempts this Principle also extends the disclosure of ANPR images to any organisation outside the Euro-zone without any such risk assessment.

Hence PI argues, with some justification, that the exemption from these two principles described in the Certificate permit the disclosure of ANPR images to anybody on the planet (e.g. any national government agency including the unsavoury ones) for any purpose (e.g. for a purpose that has nothing to do with crime and national security).

The Home Office lawyers defeated PIs appeal by demonstrating that PI had no standing before the Tribunal’. This “technical success” did not diminish the real substantive issues; it just avoided the need to defend them as being necessary.

What is alarming is that a brief study of my collection of national security certificates (don’t tell me you haven’t got a collection?) shows this Second and Eight Principle exemption occurs in other certificates– most notably in the certificate dealing with the use and disclosure of communications data. It follows that the issues PI raised about ANPR images also applies to the onwards disclosure of communications data (of which there is a great amount in the hands of the national security agencies).

The Security Service is justifiably proud of yesterday’s “glasnost” moment with publication of its history which details the fact that it carried out extensive surveillance of CND and other legitimate political activities in the 1980s.

All this is very welcome. However, an exemption from the Second and Eight Principles in many Certificates carries the implication that national security agencies can disclose personal data to anyone for any purpose. It is this unbridled freedom to disclose to anybody for any purpose that can, in time, undermine the claim that questionable national security activities are all now in the past.

Cartoon

  
©Chris Slane

Are data retention policies misguided?

One of the points not reported in connection with the horrific crimes of paedophile Venessa George  is the failure of the comprehensive vetting system. The reason: there was no record of her involvement in such activities. She wasn’t even uncovered by staff at the nursery (why? – another question), but picked up when the police arrested another individual who had retained copies of electronic communications linked to her. If that person had been more careful, then most likely George would still be active.

There are two messages here. The first is that the absence of a record does not mean an individual is “in the clear” – it just means that there is no record. The most successful criminals are those with few records – that is why they are successful. As a fan of “The Wire” programs recently screened on BBC2, most drug dealers portrayed in that program used methods of communication that avoided records of phone calls. So a policy of keeping everyone’s communications would not help in providing any evidence in such cases.

Secondly, there is the matter of public trust. The spending of millions of pounds of public establishing a comprehensive “vetting of everyone” system was justified in its aim of protecting the public. Yet in this case, the vetting failed. How many other failings will take before the public loses faith in the system? And if faith is lost, so is the money spent on the system.

In my view, the George case indicates the flaw in the “mass retention of data” policy. The existence of data can reveal a problem; the absence of data does not mean there is no problem. However, it is the absence of data that leads to a careless assumption that there is no problem. So in an era of mass retention of data, all the clever miscreant will do is ensure that there is no identifying data or links when they ply their unsavoury trade.

In summary: data retention is no substitute for vigilance, and if you establish good vigilance why do you need such mass data retention?

General Election approaches - no UK strategy for privacy in sight.

Well the political conference season is nearly over, a General Election is round the corner, and no major political party (apart from the Scottish Nationalist Party) has a policy to establish a framework of privacy protection. The result, I fear, is that we will continue onwards as before. All the English opposition political parties seem to think that if they do something like scrap the ID Card scheme, drop the NHS central spine database etc then everything in the privacy garden will be lovely. No it won’t – there is a dangerous policy vacuum developing.

Uncle Gordon, God bless him, made three privacy statements at Labour’s conference.

1. “But in the last two years we have looked again at how we can give the best security to our British citizens whilst never undermining their liberties”. Isn’t it reassuring to know that proposals such as six years’ DNA retention if you are innocent do not undermine liberties.

2. “We will reduce the information British citizens have to give for the new biometric passport to no more than that required for today’s passport”. I had always been taught at school that if you “reduce the information” you need to what you already collect, then that is not a reduction. In any event, the intention is to begin to collect all ten fingerprints – something which does not happen with “today’s passport”. So if this is what is meant by “reduction”, watch out as soon as this Government talks about “addition”.

3. “And so conference, I can say to you today, in the next Parliament there will be no compulsory ID cards for British citizens”. Obviously compulsory additions to the National Identity Register if you are vetted or when you renew or obtain your new passport obscure this particular message.

The Conservatives have gone further than anybody else and have at least published a policy document which contains proposals to limit the advance of the surveillance state. However, as soon as the pressure of being in Government comes, then I think the risk of resumption in the advance of the surveillance state cannot be ruled out (my favourite is a proposal to save money by linking Passport and Driving Licence). In addition, the Party wants to substitute a Bill of Rights for the Human Rights Act, which means that Article 8 might be under “attack” so to speak.

The Lib Dems follow a similar path. They want to limit “Labour’s surveillance state” (e.g. scrap ID cards, limit CCTV etc) and want a Constitutional Convention to define what should be in a Bill of Rights.

The only political party that has made inroads into privacy policy are the Scots Nats. In late August they published “Privacy principles to improve public confidence” which involved the following draft principles for discussion.

1. “People should only be asked for identity when necessary and they should be asked for as little information as possible” – arguably this is a requirement of the Third and Fifth Principles

2. “Private and voluntary sectors which deliver public services should be contractually bound to adhere to the principles” – limited to public sector and if they are data processors, they should be doing this already

3. “Privacy Impact Assessments should be carried out to ensure new initiatives identify and address privacy issues” – hopefully these will be published

4. “Organisations should avoid creating large centralised databases of personal information and store personal and transactional data separately”  - see this as a Scots Nat statement of “we are not like Labour”

5. “Public bodies must explain why information is needed and where and why it is shared” – arguably the obligation under the First Principle.

So it can be seen that the policy is not perfect, but at least a political party in Government has bitten the bullet and are open to suggestions and improvements – even from low-life Sassenachs.

I wonder whether they have someone standing in Chingford.