Hawktalk

Government proposals permit DNA database to expand with minimal scrutiny

The Home Secretary’s statement on DNA retention confidently states “we propose the indefinite retention of DNA profiles of convicted adults”. So far so good as most people, when they think of “convicted adults” think of a burglar, a bank robber or a rapist.

However, this is not what the Home Secretary means. He has in mind something far more lowly in the hierarchy of criminal acts to justify indefinite retention of DNA; it includes the actions of people who do one-off stupid things in their life (e.g. get cautioned for being drunk or reprimanded for some youthful prank).

The Government’s proposals allow the police to obtain a DNA sample (and therefore retain that sample and related personal data) if the offence is a “recordable offence”. It follows that an expansive meaning of a “recordable offence” will result in a DNA database that will be more densely populated with entries.

So what is a “recordable offence” and how does Parliament scrutinise its definition?

The answer lies in Sections 27(4&5) of the Police and Criminal Evidence Act 1984. It tells us that “The Secretary of State may by regulations make provision for recording in national police records convictions for such offences as are specified in the regulations” where “regulations under this section shall be made by statutory instrument and shall be subject to annulment in pursuance of a resolution of either House of Parliament”.

So have you got it? The Home Secretary orders “I want so and so be a recordable offence” and, hey presto, the offence is recordable and DNA samples can be collected. To reject the Home Secretary’s Order, Parliament would have to vote down his proposal – a Parliamentary event so common that it has yet to occur. In short, the Home Secretary has “Alice in Wonderland” powers over this definition: effectively “a recordable offence” is what the Home Secretary wants it to mean.

This is what happened in 2000, when the National Police Records (Recordable Offences) Regulations were enacted. With no Parliamentary debate (see reference below) cautions, reprimands and warnings became “recordable offences”; subsequently individuals arrested in relation to these minor matters (and not charged or convicted) had their DNA sample retained indefinitely.

The Explanatory Memorandum to the Bill (produced by the Home Office) fails to mention that the Home Secretary is in control of the term: it merely says that: “‘Recordable offence’ is defined in sections 118 and 27 of PACE. In practice, all offences which are punishable with imprisonment are recordable offences, as are around 60 other more minor offences which are specified in regulations made under section 27”. It only takes three words in parenthesis (“negative resolution procedures”)  after ther word "regulations" to give the complete picture. The omission of these three words is not something I would expect to see in a document purporting to be an “Explanatory Memorandum”.

So any future Home Secretary wanting to extend the DNA database, could equip transport police forces with mobile DNA sampling technology and arrest drivers who commit a certain type of motoring offence (in 2000 there were over 10 million motoring offences so there is a lot to choose from).

Oh – by the way – it doesn’t matter whether the driver is innocent or guilty. That is not relevant as an arrest should do the trick for six year’s retention at least!

Comment: It is also interesting that there are amendments to Section 27(1-3) of Police and Criminal Evidence Act 1984, but not to Sections 27(4-5) which is the subject matter of the blog. I raise this point merely to note that the Home Office did look at Section 27 and must have concluded that sections 27(4-5) did not need changing.

In “Nine principles for assessing whether privacy is protected in a surveillance society” (see www.amberhawk.com/policydoc.asp) I argue that the organisation wanting powers to undertake the surveillance should not regulate the balance that provides protection from misuse of those powers or surveillance. Section 27(4-5) provides another clear example which shows that the risk of letting that balance be determined by the organisation responsible for the surveillance (in this case, the Home Secretary).

References: The only Parliamentary scrutiny of the 2000 Regulations was made by the “Joint Committee on Statutory Instruments Nineteenth Report” (http://www.publications.parliament.uk/pa/jt199900/jtselect/jtstatin/47-xix/6503.htm); it said there was nothing to report.

Long retention of DNA personal data has little to do with detecting ordinary crime

The Human Genetics Commission Chair, Professor Jonathan Montgomery, has asked a simple question: "It is not clear how far holding DNA profiles on a central database improves police investigations?".  The HGC has just published a report containing the damaging allegation that police were arresting individuals in order to populate the DNA database.

Well I think I have found the answer to the Professor's question with an analysis of the Government’s own crime statistics. My answer undermines arguments for long DNA retention periods based on improving criminal detection in general, and suggests that the much vaunted Scottish retention period for DNA data is also questionable.
 
The first statistic I am using reads as follows “Research recently carried out on men born in 1953 revealed that one in three had a conviction before they were 46 years old. The same research shows that of the male offenders born in 1953, around half of them had been convicted on only one occasion”.
 
The second set of statistics is from a table “Time to reconviction: by gender, 1995-97”. This includes details of under-21 offenders who are released from prison; the commentary adds “Overall there was little difference in the reconviction rates for those released from prison and those who had served community sentences” (references at bottom of blog). The statistics relate to male young offenders under 21 serving custodial sentences are as follows:

16% of males re-offend within 3 months
35% of males re-offend within 6 months
50% of males re-offend within 9 months
60% of males re-offend within 12 months
67% of males re-offend within 15 months
71% of males re-offend within 18 months
74% of males re-offend within 21 months
77% of males re-offend within 24 months

The table shows that within 2 years (24 months) from release from prison, 77% of young male offenders who have been in custody will re-offend. This is a rather shocking statistic in itself (how useful is prison then?) but it appears that 60% of those who will re-offend do that re-offending within 1 year (12 months). This means 17% will re-offend in year 2. The table shows a tailing off towards the end of the two year period (months 18-24) which is significant and pronounced.
 
We can extrapolate the figures in the above table on a forward yearly basis by using the ratio (17/60=0.28) as a multiplier for each year of DNA retention (i.e. multiply the increase in offending by 0.28 for each year and add it to obtain the total of offending for the next year). We are thereby assuming that the rate of increase in re-offending in year 1 can be used to estimate the total offending in year 2 and so on to all subsequent years of the Government’s 6 year DNA retention period.
 
Such an assumption as tabulated below reproduces the tailing off displayed in the raw data and it is reassuring to note that the assumption does not permit 100% of offenders to re-offend (which of course is a nonsense). In other words, the extrapolation method does not provide rubbish and looks reasonable. The other tables in the survey (Male adults over 21; female offenders) show exactly the same.
 
Applying this to the extrapolation we make we find that:

60% re-offend in    1 year
77% re-offend in    2 years
82% re-offend in    3 years
83% re-offend in    4 years
84% re-offend in    5 years
84.5% re-offend in 6 years

So in relation to those with a criminal record, a three year retention period for DNA appears opitimal in that it would allow most reoffending (82%) to be caught (assuming that the DNA was the only means of identifying the offender). The extra three years retention add about an additional 2.5%.

However, if you factor in the first statistic that “Research recently ...  shows that of the male offenders born in 1953, around half of them had been convicted on only one occasion”, and include arguments such as “if someone has not re-offended in three years, then there is a very good prospect that they are not going to re-offend at all” then it looks as if the benefit of DNA retention is around three years and that further retention does very little with respect to ordinary crime. This is the answer to Professor Montgomery's question.

As readers know there is not three years retention but indefinite DNA data retention on criminals which is the current policy in all parts of the UK - but the police would get 97% of the benefit needs only a three year retention.
 
In other words, a 6 year retention period borders on the excessive for criminals and obviously excessive in  relation to non-criminals (i.e. those arrested but not convicted). Put simply, if a 6 year retention period is hard to justify in terms of active criminals, it won't be justified in terms of prospective criminal activity of people who have no criminal record.

It also follows that the reason why the police want to retain DNA on the maximum number of people for the maximum time has nothing to do with ordinary crime as a three year retention criteria would do that.
 
It could be that the real reason is to get assistance in relation to serious random crime (e.g. rape and violence). But if that is the case, then the Government should be honest enough to focus public policy debate on this issue.
 
References:  1953 statistic from http://www.statistics.gov.uk/STATBASE/ssdataset.asp?vlnk=4480. Raw data table of offenders from http://www.statistics.gov.uk/STATBASE/xsdataset.asp?More=Y&vlnk=405&All=Y&B2.x=16&B2.y=7.
 
More details on the extrapolation: the increase in offending in 1 year is 60%; so an additional 0.28*60% = 17% re-offend in year 2. 60%+17% = 77% gives us the number who re-offend in the second year. In the third year, there is an additional 0.28*17% = 4.76% (5%) re-offend in year 3 so at the end of year 3, 77%+5%  = 82% have re-offended.

Information Commissioner makes offers you can’t refuse

Just a few brief comments about an exchange that occurred during the data protection conference recently run by the National Association of Data Protection Officers (NADPO), which had Deputy Information Commissioner, David Smith, as a keynote speaker.

The questioning surrounded the Enforcement Notice issued to M&S in 2008 relating to a data loss following the theft of an unencrypted laptop which contained the personal information of 26,000 M&S employees. Evidently M&S was offered an undertaking which they were reluctant to sign because a contractor was at fault.

David Smith pointed out that it was now the policy of the Commissioner to issue an Enforcement Notice if a data controller refused to sign an undertaking.

The effect of this is as follows. Undertakings are only required when there has been a serious breach of any data protection principle where the issue is not so serious that an Enforcement Notice is a more appropriate sanction. Note that the Commissioner has identified the loss of unencrypted personal data on a laptop or memory stick as qualifying for consideration for a Monetary Penalty Notice – so getting an Undertaking in these circumstances can be considered to be a “let off”.

In addition, if an Enforcement Notice is served, the Notice will dictate what the Commissioner wants the data controller to do; failure to diligently follow the directions described in a Notice is a criminal offence. By contrast, with an Undertaking, there is a chance of negotiating something that at least considers some of a data controller’s specific problems when implementing new data protection requirements.

Finally, if a data controller accepts an “Undertaking”, it does not require the Commissioner to obtain the evidence that is needed to serve an Enforcement Notice. It also means that the Commissioner does not have to have one eye on an appeal against the Notice, or on the possibility of prosecuting an offence of not complying with the terms of a Notice. “Undertakings” are a quick way of getting a problem off the books so to speak.

In other words, if you are in the unhappy position of being offered an Undertaking, sign up like a man and take it on the chin. The alternatives are far worse.

Note: NADPO members qualify for a £250 discount on Amberhawk’s long DP and FOI courses leading to the ISEB qualification and £150 off our intensive DP and FOI courses. However, if you want to take advantage of this, contact [email protected] with your booking.

Data Protection Act fails to implement 50% of the Directive?

Some readers may know that in 2004, I made a FOI request to the European Commission to obtain details of possible infraction proceedings brought against the UK Government by the Commission. The Commission claimed that legal proceedings might be needed as the Data Protection Act did not properly implement the parent Data Protection Directive (95/46/EC).

The reason for my renewed interest in this subject is the Court of Appeal’s linkage between the “purpose of the processing" as used in three data protection principles and the “purpose” as notified to the Information Commissioner (see last Thursday and Friday’s blog). I have discovered that this linkage does not appear in the list of possible infractions identified by the Commission back in 2005.

Then, the Commission claimed that Articles 2, 3, 8, 10, 11, 12, 13, 22, 23, 25 and 28 of the Directive had not been implemented properly by the UK Government – just under a third of the Directive. These Articles relate to: the definitions used in the Directive; the scope of the Directive's application to manual files; the conditions when sensitive personal data can be processed; the fair processing notices give to individuals; the rights granted to data subjects; the application of exemptions from these rights; the ability of individuals to seek a remedy when there is a breach; the liability of organisations for breaches of data protection law; the transfer of personal data outside European Union; and the powers of the Information Commissioner.

Although the Commission eventually identified the Articles subject to possible proceedings, both Commission and the UK Government have consistently refused to provide any other specific information about the disputed implementation.

I now think the linkage introduced by the Court of Appeal also damages the UK implementation of Articles 6, 7, 14, 18 and 19. For example, the three Principles themselves (Article 6) and those parts of the Directive that relate to the purpose of the processing (Article 7(f)) or Article 14 (the data subject’s right to object to the purpose of the processing). In other words, half of the Directive’s Articles are now possibly defective.

It is important to stress that the notification requirements in Articles 18 and 19 of the Directive are also now improperly implemented: these Articles modify the “purpose of the processing” to permit simplified notification of the purpose to the Commissioner BUT NOT any other linkage.

In fact, thanks to the Court of Appeal, the UK Act linkage between “purpose of the processing” and the notified “purpose” has arguably allowed for the defective implementation of any Article or Principle that uses the word “purpose”.

Perhaps the last paragraph is too far. But if I am correct in my analysis, many Directive provisions that rely on the word “purpose” are compromised. It follows that certain “fractious” events might happen sooner than one thinks.

Reference: for original commentary on the infraction proceedings please look at http://www.out-law.com/default.aspx?page=8472. Durant v Financial Services Authority [2003] EWCA Civ 1746. If anyone wants a comprehensive analysis of Durant, just e-mail [email protected] with “Durant Heaven” in the subject title of the e-mail. I will then send you your Xmas reading!

Information Commissioner looks at an Article 8 role

The recent decision of the Information Commissioner to appeal the recent judgement of the Court of Appeal with respect to the retention of criminal records (see last Thursday and Friday’s blog) raises an intriguing question. Is the Information Commissioner with a mission statement that focuses on information rights seeking to expand the protection of those rights into the Human Rights arena?

In his press statement David Smith, Deputy Information Commissioner says the Court of Appeal judgment “engages serious questions about the applicability of Article 8 of the European Convention on Human Rights to conviction data held by the police”.  Consequently “we have applied to the Supreme Court for leave to appeal and we hope that the application will be successful so that these issues can be examined by the Supreme Court”.

I welcome this move as there is an indirect link between Article 8 of the Human Rights Act and Schedule 2 of the Data Protection Act through the use of the word “necessary”. So, for example, when a public authority claims that its processing of personal data is “necessary for the exercise of any functions conferred on any person by or under any enactment” (Sched 2, para 5), it implicitly means that there exists an enactment that allows for an interference by a public authority into private and family life and correspondence etc.

In particular, Article 8(2) requires that any law that permits interference is “necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”.

If the Supreme Court were to cement a strong link between the two regimes, there is a prospect that the Information Commissioner could subsequrntly apply to a Court so that it can use powers in the Human Rights Act to strike out statutory instruments that provide for wide ranging powers of data sharing (that this Government is too fond of enacting). This action could be justified on the grounds that the processing does not have a Schedule 2 ground because it is “not necessary for the exercise of any functions conferred on any person by or under any enactment”. And that processing is “not necessary...”  because a particular SI is not “necessary in a democratic society....” (the link to Human Rights Act).

So, if the Commissioner is given leave to appeal to the Supreme Court, data subjects can, for a moment, dream of an intriguing linkage that could significantly extend privacy protection.

Reference: In  Part 1 of “Nine principles for assessing whether privacy is protected in a surveillance society” (see download section of www.amberhawk.com), I provide a full analysis of the links between the HRA and DPA. In Part II of that analysis, I suggest the Sixth Principle should be used to make that linkage explicit (this has the advantage over the above as it does not disturb the Special Purposes, in particular investigative journalism).

Cartoon

©Chris Slane

Cartoon

©Chris Slane

Could notification to the Commissioner undermine three Data Protection Principles?

When a data controller says that he is processing personal data for “purpose X”, what does “purpose X” mean in practice? The answer is important because the word “purpose” is used in the legislation to describe the Second, Third, and Fifth data protection principles.

For example, suppose a data controller claims that "personal data item Z is relevant to a housing benefit purpose". That claim can objectively be assessed; is the data item relevant or not relevant to the housing benefit purpose? However, if the purpose is broadly specified this assessment becomes more difficult.

Suppose the “housing benefit purpose” was broadened to become part of a general “housing related purpose”, then details that were irrelevant to the former can become relevant to the latter. For example, details of nuisance neighbours are unlikely to be relevant to personal data of a single person claiming housing benefit, but could be very relevant to a broadly specified “housing related purpose”.

Note the rule: the wider the purpose specification, the narrower the protection afforded by any Principle that is linked to that “purpose”. The converse is also true: the narrower the purpose specification, the wider the protection.

So when considering the retention of criminal records, the Court of Appeal had to grapple with the specification of the “policing purpose”. What did it do?  Did the Court look at what data controller actually did with personal data? Was it what was stated on the data controller’s fair processing notice? Or was it what the data controller notified (registered) to the Information Commissioner? So, have a guess - where would you look?

The Court of Appeal went for registration to the Commissioner. At para 32, Waller LJ started his analysis with the words: “It is thus important in this case to identify what purposes were registered. It is important that the full details of the particulars are looked at including the persons to whom the data would be disclosed in order to identify the purposes registered by the data controllers”.

Those of you who can remember notification under the 1984 Act will recall it was very specific beast of burden. There were about 100 odd purposes and for each purpose there were 80 data classes, 40 data subject types, 60 disclosure and source categories, and 70 or more overseas transfers to choose from. There were 10 pages of registration form to complete per purpose and often data controllers had 10-20 purposes. In short, it was a bureaucrat’s form-filling nirvana.

This paperwork was cut by the Government when the 1998 Act was introduced and registration was replaced by the broadly based notification criteria that we have today. It was said that the Data Protection Act 1998 refocused data protection compliance on the application of eight Data Protection Principles, and notification requirements were kept, mainly as a means of paying for the Commissioner and his staff.

Now, thanks to the Court of Appeal notification is back with a vengeance, integrally linked to these Principles and indirectly linked to others. As the notified purposes are very broadly defined, it follows that the protection afforded by affected Principles now has the potential to be significantly diminished.

By how much? Only time will tell. But whenever matters are examined in a context of a Court or Tribunal hearing, the linkage between the notified “purpose” and the Principles that derive their meaning from that “purpose” will inevitably, in my view, conspire to weaken the protection afforded to data subjects.

UK Courts view any data retention as human rights compliant.

A major difference has emerged between the approaches adopted by the UK Courts and the European Court of Human Rights. In summary, the higher UK Courts have consistently stated that data retention does not significantly engage Article 8 of the Human Rights Act, whereas the European Court of Human Rights has consistently judged that the Article is fully engaged.

The consequences are important for any forthcoming public debate on data retention policy – for example, with respect to the retention of communications data, DNA data, ID Card data. It means that any legal challenge with respect to data retention has a real prospect of failure in the UK courts; this will force litigants to take a long march through the legal institutions that ends in Strasbourg at the European Court of Human Rights.

This prospect could especially important if the Conservative Party forms the next Government. The Party has promised to replace the Human Rights Act with a Bill of Rights, and if that Bill of Rights has different wording to the current Article 8, then it could weaken the protection afforded to UK citizens, and offer even more legal protection to data retention by government agencies.

In its landmark decision S v Marper, all 17 judges of the European Court of Human Rights agreed that (at para 67): “The mere storing of data relating to the private life of an individual amounts to an interference within the meaning of Article 8 (see Leander v. Sweden, 26 March 1987, § 48, Series A no. 116). The subsequent use of the stored information has no bearing on that finding (Amann v. Switzerland [GC], no. 27798/95, § 69, ECHR 2000-II)”.

So this is clear cut – the act of retaining personal data engages Article 8.

This is to be contrasted in the recent Court of Appeal case involving the retention of criminal records by the police where Waller LJ said (at para 50): “A further argument was addressed to the IT (Information Tribunal) on Article 8 independently from the arguments on construction under the Data Protection Act. I am not persuaded that Article 8(1) is engaged at all in relation to the retention of the record of a conviction. Disclosure might be another matter but this appeal is not about disclosure” (emphasis by Waller LJ).

This view reflects the judgment of Lord Steyn in House of Lords (in S v Marper) who said at para 31: “Looking at the matter in the round I incline to the view that in respect of retained fingerprints and samples article 8(1) is not engaged. If I am wrong in this view, I would say any interference is very modest indeed”.

In other words, in the UK, the Courts have expressed the view that to engage Article 8 to any significant degree, there has to be something other than mere retention of personal data – for example, a further use or disclosure beyond retention.

So what does this mean in practice? Imagine a law requires the retention of personal data on millions of data subjects for law enforcement purposes. Suppose further, that this law then states that any further use or disclosure of these personal data has to be necessary “in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”.

The Regulation of Investigatory Powers Act follows this construction when permitting the authorities access to communications data. The purposes in the paragraph above are the purposes where there can be legitimate interference with private and family life (and are described in Article 8(2)).

Note that in such a database there will be two kinds of data subjects: those data subjects who are being investigated and those who are not. In relation to those who are not being investigated, their personal data are not used for any investigation. Hence such personal data are merely retained, and this retention, according to the UK Courts, does not breach Article 8.

In relation to those who are investigated, their personal data are further used or disclosed for an investigation. This means that although there is a further use or disclosure (hence Article 8 is engaged), that the further use or disclosure is covered by an exemption from Article 8(1) that is described in Article 8(2).

It then follows that data retention cannot possibly breach Article 8, the Government can safely claim that all its data retention policies are compliant with its obligations to human rights (and data protection), and the public can sleep safely in their beds. Except for those neurotic privacy activists of course.

References: Case of S. and Marper  v. The United Kingdom, (Applications nos. 30562/04 and 30566/04; judgement delivered 4 December 2008); Chief Constable of Humberside Police,  Staffordshire Police, Northumbria Police, West Midlands Police and Greater Manchester Police v the Information Commissioner,  [2009] EWCA Civ 1079), judgement delivered 19 October 2009); Regina v. Chief , Constable of South Yorkshire Police (Respondent) ex parte LS and Marper [2004] UKHL 39, judgment delivered 22 July 2004).

 

Data Protection: are the new EU data loss notification provisions worthless?

So the European Union has enacted changes to the telecommunications directive (Directive 2002/58/EC  on privacy and electronic communications) that require telecommunications companies to notify data subjects about any loss of personal data.  If you read EU spin on this step, this is a great deal for “data subjects”. However, as with most things, the devil is in the detail and I have found nothing new.

One modification provides for measures that shall “ensure that personal data can be accessed only by authorised personnel for legally authorised purposes”. Now pause for a second: this provision is really aimed at telcos when they provide external authorities with secure access to personal data so long as they are “legally authorised”. So ask yourself a question: “is it likely in these circumstances that a telco would provide insecure access?”.

Other recommendations also repeat the obvious. For example, telcos are “to protect personal data stored or transmitted against accidental or unlawful destruction, accidental loss or alteration, and unauthorised or unlawful storage, processing, access or disclosure, and to ensure the implementation of a security policy with respect to the processing of personal data”. OK guys, tell me what is not already in the Seventh Data Protection Principle!

The provisions relating to security breach notification add up to less than a string of beans. For example, “in the case of a personal data breach, the provider of publicly available electronic communications services shall, without undue delay, notify the personal data breach to the competent national authority”. However “notification of a personal data breach to a subscriber or individual concerned shall not be required if the provider has demonstrated to the satisfaction of the competent authority that it has implemented appropriate technological protection measures, and that those measures were applied to the data concerned by the security breach”. This is arises when the “technological protection measure” renders “the data unintelligible to any person who is not authorised to access it”.

There again – the above is current UK practice – if there is a personal data loss, contact the Commissioner who will issue advice as to whether to contact data subjects; encryption on laptops and memory sticks is now standard advice.

Other provisions also repeat UK practice. For example, the telco if it “has not already notified the subscriber or individual of the personal data breach” can be required by the Information Commissioner to notify the data subjects concerned (e.g. this can happen in the UK under the current enforcement regime).

Rather quirky is the requirement that any notification to the data subject shall “recommend measures to mitigate the possible adverse effects of the personal data breach”. Now tell me what data controller will send a notice to each data subject which effectively says “Hey guys, I have lost your personal data. You are now on your own”.

A provision states that the Commissioner can “adopt guidelines” or “where necessary, issue instructions” concerning the circumstances in which telcos are required to notify personal data breaches. Ok – so let’s have a look at the Commissioner’s “Guidance on data security breach management” issued in late spring of this year

In fact, the only new provision I have found is the power of the Commissioner to audit telcos to see whether “they have complied with their notification obligations”. Note that this audit is limited to the context of a data loss; it is an advance merely because the Government has repeatedly refused to provide the Commissioner with powers of audit with respect to the private sector data controllers.

Do you get the message? There is nothing new to get excited about. So if any Minister or MP trumpets these provisions as part of the forthcoming General Election campaign as a great advance in data protection in the UK, then please reach for that salt bowl. (I was going to say sick bucket but decided at the last minute that this would be inappropriate),

References: see page 74 of: http://register.consilium.europa.eu/pdf/en/09/st03/st03674.en09.pdf and my piece for out-law “Why we don't need a security breach notification law in the UK” (http://www.out-law.com/page-9128).