Hawktalk

How “see-through” scanners are subject to data protection rules

According to press reports in Canada, controversial airport scanners that “see-through” the clothes of travellers have received the blessing of Canada's Privacy Commissioner. An assistant Federal Privacy Commissioner has told the press that Canada’s National Air Security Agency has successfully answered all questions about individual privacy.

The proposal has stirred controversy in the UK because the scanners produce a three-dimensional outline of an individual’s naked body. However, under the plans approved by Canada’s Federal Privacy Commissioner, the officer viewing the image would be in a separate room and never see the actual traveller. Only people singled out for extra screening would be scanned, and even then, there would be the option of having a physical pat-down instead.

In the UK, therefore, one can expect similar procedures. Note that the Data Protection Act is engaged because each ghostly image will be associated with other identifying information already in the possession of the data controller (e.g. the boarding card identification details of the data subject). This means the data controller has to be fair – so not only has there to be signage (which alerts each data subject to the purpose of the scan and other information to make the processing fair) but also the outcome of the processing has to be fair (in this case, by allowing travellers an alternative to the scan so that personal data are not processed). In relation to Schedule 2, the processing has to be “necessary” in terms of the legal provisions that surround airport security.

In relation to Third and Fifth Principles, if the scan of a particular individual does not show any airport security problem, one would expect that the images would be deleted expeditiously, if not immediately.  Staff would get the necessary training (Seventh Principle) so disclosures of images to staff other that the observing officer in a separate room would have to be limited to those circumstances where there was a security issue. One would expect a Privacy Impact Assessment to be undertaken by the airport in order to identify other issues prior to implementation of the scanner.

In other words, if any ghostly image of a celebrity appeared in the press, the data controller would have a lot of data protection questions to answer; evidence of malfeasance by a particular member of staff should engage the section 55 offence. If a breach were to be the result of a failure on the part of the data controller to demonstrate that the correct procedures were in place, the risk of a Monetary Penalty Notice (when they eventually arrive) would be considerable.

Check your data sharing protocols

Data sharing – simple isn’t it: “data share” rhymes with “data care” and “nightmare”.

Anyway this is an unashamed plug for a book that contains a chapter on data sharing written by yours truly. To assist the general data protection community, I have placed a checklist of what should appear in a protocol on http://www.amberhawk.com/policydoc.asp   under the heading: “Data sharing protocol checklist – 2009”. The checklist applies to public and private sectors.

The book is entitled “Data Protection for Financial Firms: A Practical Guide to Managing Privacy and Information Risk, Edited By  Tim Gough. Details are on http://riskbooks.com/Operational%20Risk/data_protection_for_financial_firms.php

Resignation issue? National Security watchdog wants more surveillance of UK population

Kim Howells MP knows all about surveillance. Back in 1984, he was one of Mrs Thatcher’s unnamed “enemy within” and played a leading role in the National Union of Miners organising the Miners’ Strike in South Wales. Now, he is trusted ex-Minister who chairs the House of Commons Intelligence and Security Committee which has limited scrutiny role over the very organisations that tapped his phone and monitored his movements those 25 years ago. A curious turn of events to say the least.

Kim Howells is in the news today calling for a phased withdrawal of troops from Afghanistan and replacing it with the enhanced surveillance of the UK population. In today’s Guardian he writes that:

“Life inside the UK would have to change. There would be more intrusive surveillance in certain communities, more police officers on the streets, more border officials at harbours and airports, more inspectors of vehicles and vessels entering the country, and a re-examination of arrangements that facilitate the "free movement" of people and products across our frontiers with the rest of the EU”.

What is missing in Mr Howells’ analysis is any recognition that if there is to more surveillance, then there also has to be more focus on what prevents the misuse of surveillance powers. In his Guardian commentary he makes no mention of the need for a privacy counter-balance, although to be fair, this could be because he is writing a newspaper column of limited word length.

However, Mr Howells neither sees the need for additional checks nor balances in his Committee’s Annual Report published last May (heavily redacted by the Government, as his Committee has to submit its manuscript for editing prior to publication). In fact, over the last year, this Parliamentary Committee did not even bother to take oral evidence from any of the Commissioners who are there to scrutinise surveillance polices. And in its 60 page Annual Report, the activities of these Commissioners are dismissed by the Committee in less than half a page. As far as I can see, under Mr Howell, the Committee's role in reassuring the public that national security policies do not stray beyond the necessary has gone AWOL.

This week we have had the dismissal of Professor Nutt whose views on the risks of horse-riding are well known. We were told by Government that if the Professor wants to campaign to re-categorise cannabis as a lesser risk, he cannot be a Government advisor on drugs policy. Similarly, if Mr Howells wants to support a policy of more surveillance by the national security agencies, he should not do this from his position as Chair of a Committee that is expressly tasked by Parliament to supervise the surveillance policies of the national security agencies.

At the end of the day, Professor Nutt had to go – so should Mr. Howells.

(Readers who are interested in the kind of protective supervision we have in the UK are directed to my blog entries on 6th October: “Can national security agencies disclose communications data or ANPR images to anybody?”;  on 8th September: “Home Secretary spends 90 minutes per day with interception warrants?”; and on 10th September: “Is there is no chance of winning a privacy complaint?”. Also the "Written Evidence: Human Rights Legislation and Government Policy towards national security - 2006" on the download section of www.amberhawk.com).
.

Can publishing personal data on the Internet be unfair?

I wonder whether a Tribunal Decision confirming the Commissioner’s views in an obscure FOI Decision Notice indicates how data protection law could impact on the wider Internet? Of course, reliance on such an extrapolation has its dangers – but, the logic the Tribunal applied to this FOI request seems to apply to posting personal details on the Internet.

The FOI case involved access to Court records after a trial. An applicant (who was a relative of an individual prosecuted for a criminal offence) made a FOI request to details of the Court’s own records about the "charges" and "verdict" in order to help that individual anonymously. Note that all the applicant requested was the details that he would have learnt in open court (if the requestor had attended the Court) or in a newspaper (if a journalist had reported the Court proceedings in the local press). The request was denied by the Courts service, a decision that was upheld by the Commissioner and Tribunal.

The Tribunal recognised that there was an anomaly in that if the applicant had attended the Court or if the Court proceedings had been published by the media he would have all the information that was subject to the FOI request. However “to reveal to the whole public whether someone was subject to a court case would be unfair” processing as the release of sensitive personal data (e.g. details of a conviction) into the public domain will only be fair in exceptional circumstances. In addition “even if there was sensitive personal data disclosed in open court at the time of prosecution/sentencing, it would not be in a defendant’s reasonable expectations that there will be a later disclosure to the general public”.

So publishing details, even those that could have been in the public domain, can be unfair.

Now consider publishing on the Internet?  Well many postings report matters involving another individual's personal life (e.g. photos of a drunk friend being sick) and these have the potential to be “Googled for ever and ever, amen”. Often, such reports are published after a fairly public event (e.g. an office party) without any reference to the individual concerned. As the domestic purpose exemption cannot be claimed (see Lindqvist), this means the obligations in the Act are engaged.

In other words, if the act of publishing personal details by FOI is unfair, it seems to me that publishing similar details by the Internet would also be unfair. It follows that posting personal data can constitute unfair processing and this prospect should be actionable wherever the European Data Protection Directive applies.

References: Information Tribunal Decision EA/2009/0037 and ICO Decision Notice FS 50165494. The position according to the Tribunal “is supported by the reasoning of the Information Tribunal’s decision of David Armstrong and the Commissioners for Her Majesty’s Revenue and Customs [EA/2008/0026] paragraph 84. The Lindqvist case is a decision of the European Court of Justice in Case C-101/01, made in 2003; see for example, “Baby battle woman can’t claim data protection exemption for YouTube video, warns expert” on http://www.out-law.com/page-8401 ).

See also; Reclaiming Privacy on the Internet; http://www.amberhawk.com/uploads/IPSTREETVIEW.pdf