Hawktalk

Commemorate Data Protection Day by thinking about ID Cards

I missed “Data Protection Day” (like the rest of the population) so I thought I would take the opportunity to express belated support by reiterating my great admiration for the Government’s Identity Card scheme, especially as the Card has been promoted to young adults in London this week. As readers know, I am a keen supporter of the ID Card. They are such a wonderful idea that I aim to get as many as I can.

My comments relate to why the Government are promoting the Card. In this week’s press statement, Home Office Ministers say that the “The National Identity Card will prove an extremely useful tool for young people in London, whether they are opening a bank account, buying age-restricted goods such as computer games or DVDs, entering a nightclub or travelling to Europe”. When “tough new legislation being put in place clamping down on underage drinking, it will be more important than ever for young people to have access to a universally accepted proof of age”.

Hang on a second. Suppose you are selling “age-restricted products” or are employed as a bouncer at a night-club. Do you need to know “who am I?” or do you just need proof that I am over any age-limit. In other words, the kinds of activities promoted by Ministers do not need proof of identity and the use of an ID Card for these purposes appears to be excessive.

Now consider the purposes of the ID Card as promoted by politicians when legislation was being enacted. New Labour’s Home Secretaries took great care to say that the ID Card was needed to counter fraud and identity theft, prevent terrorism or employment of illegal immigrants, and numerous other purposes of that ilk. Now the Government are promoting them for purposes that include  “going to the pub” or “renting a video”. Am I the only one who thinks that this appears to be a change of use?

As it is the week of “data protection” week, I should end with a data protection issue or two. The database that is backing the ID Card, the National Identity Register, will contain an audit trail of where the Card is checked to ensure that it is authentic. As today’s youngsters grow up, this audit trail will now supposedly keep records, indefinitely, of where they drank as a student (as well as all their previous addresses and every time their Card was checked). For some reason, Ministers also omitted to say that young adults that the law enforcement authorities would have access to all ten fingerprints provided by them, and will now have knowledge of where they drink, sleep and bank.

Should applicants for an ID Card know this? Does it comprise unfair processing?  Questions I am content to let readers answer for themselves.

 

Personal records found in a skip: a fine of $35,000 will do nicely

I assume data protection officers are telling their employers about the Monetary Penalty Notice when it arrives on April 6th. Indeed, the first hapless data controller who loses unencrypted confidential or sensitive personal data can be expected to gain a special place in UK data protection history. So it might be worth mentioning that being first in this category will be remembered; "numero uno" is a PR disaster in the making.

If you look at the Commissioner’s web-site you find several examples of data controllers who are lucky that their “incident” happened before April. For example, in mid January this year Lancashire County Council left social work records containing sensitive personal data relating to several individuals in a filing cabinet purchased second-hand by a member of the public, whilst Bellgrange Mortgages and Insurance Services Ltd placed clients’ details in two large waste bins intended for the use of local residents.

One of my favourites is the disposal of old computers belonging to Camden Primary Care Trust (PCT)  containing 2,500 individuals’ names, addresses and medical diagnoses; last seen they were left standing (lovingly and invitingly) beside a skip inside the grounds of St. Pancras Hospital. Also lucky was Dr Paul Thomas of the Gipping Valley Practice; this followed the discovery of a Practice server in the car park of the Practice by someone who had the common sense to know that things should not happen this way.

However, readers might want to use an example where there was actually a fine – hence this Blog. It comes from the USA, but the security story is depressingly familiar. A mortgage broker discarded consumers’ personal financial records in a skip and paid a $35,000 civil penalty for the pleasure of settling Federal Trade Commission (FTC) charges.

According to an FTC, the defendant improperly disposed of about 40 boxes of sensitive consumer records collected by companies he had owned, including tax returns, mortgage applications, bank statements, photocopies of credit cards and drivers’ licenses, and at least 230 credit reports. In addition, two mortgage brokerage companies he previously owned failed to provide reasonable and appropriate security for sensitive consumer information, despite promising they would do so.

This engaged the unfair processing angle much beloved of the FTC. Ask yourself a question: “is it unfair for a data controller to sign an undertaking and then renege on its commitments?”. I only mention this to say that “the unfairness approach” has yet to be aired by the Commissioner on this side of the pond. But I think it works!

In addition to imposing a $35,000 penalty, the FTC barred the defendant from misrepresenting measures taken to protect sensitive consumer information and failing to take reasonable measures to protect credit report information during its disposal. The order also requires him to employ a comprehensive information security program for sensitive consumer information, and to hire an independent, third-party security professional to review the program every year for 10 years to ensure that it meets or exceeds the order’s requirements.

Nothing really to add – except, get the message around; "don’t be first!".

Reference: we will be reviewing recent Undertakings in the next Data Protection Update sessions, held with our ex-colleagues at Pinsent Masons. The events are held at Pinsent Masons offices at:12 April (London); 26 April (Manchester) and 10 May 2010 (Edinburgh). The cost will be a recession busting £95+VAT (and you get Sue and I for the day). We hope to publish an agenda at by mid February; details on www.amberhawk.com.

Could the spooks have a separate copy of the national DNA database?

I think the provisions in the Crime and Security Bill that relate to DNA retention are not intended to be scrutinised properly. It is probably the most difficult Bill I have read. In fact, if I am honest, I have given up; I have decided to “get out more” and read my backlog of Decision Notices.

First, the DNA provisions in the Bill are all expressed as amendments to the Police and Criminal Evidence Act 1984 (PACE), itself heavily amended by several other Acts of Parliament. Second, the Statute Law database organised by the Ministry of Justice in relation to PACE is more than a year out of date. It carries an “Update Status Warning” that amendments to PACE have not yet updated by legislation enacted in 2009; so there is no consolidated PACE legislation, in the public domain, that can be used to assess the effect of the Bill’s proposals.

Finally in this list of gripes, the so called “Explanatory Memoranda” that accompanies the Bill does not “explain” much (e.g. the definition of “recordable offence”; see blog of 30th November 2009). It does not explain the interaction of these DNA provisions with other legislation relating to law enforcement and, most notably, with respect to use and disclosure (rather than just retention) for national security purposes.

So I am not sure whether what follows is correct – however I think the national security agencies may be able to keep copies of personal data that have been removed from the DNA database or indeed maintain a complete copy of the deleted items from the DNA database. If these personal data exist, such a copy the DNA database appears not to be regulated by the Bill, yet DNA personal data from such a database could be accessed by the police in relation to serious crime. In other words, there appears to be a “back-door” that undermines the retention proposals in the Bill.

My reasoning begins with the Security Service Act 1996. This added a “not-a-national-security” function to the role of our spooks; it states that “it shall also be the function of the Service to act in support of the activities of police forces and other law enforcement agencies in the prevention and detection of serious crime”. So it is reasonable to assume the Security Service and other national security agencies process and share personal data in relation to this objective. This can include DNA data from the national DNA database (I have been unable to find something in the Bill that prevents this).

So if DNA personal data can be disclosed and retained by the Security Service before they are deleted from the national database, the Security Service Act allows the personal data to be used on behalf of, or disclosed back to, the police in relation to serious crime whenever needed.

Consequently, for the avoidance of doubt, I have recommended to Parliament that the Crime and Security Bill should specify that the DNA database mentioned in the Bill should the only database that can be established by the law enforcement and national security agencies. I hope you agree.

Reference: I have marshalled my blogs into evidence to the Parliamentary Joint Committee of Human Rights. Although I have had to remove all the jokes and the fine, appreciative comments about Barnsley Football Club, the text describes some serious privacy problems with the provisions in the Crime and Security Bill that relate to retention of personal data on the DNA database. The evidence can be obtained from the Amberhawk website: http://www.amberhawk.com/policydoc.asp  (as well as details of our courses, of course!)

 

Hawktalk: Privacy by Design: A view from the Commissioner’s office

I am taking the opportunity to post on the blog a response from Ken Anderson, Assistant Commissioner, Privacy, Office of the Information & Privacy Commissioner of Ontario, Canada following my comments on Privacy by Design (PbD).

There is in fact two letters – the earlier of which I will post as a comment to this blog.

Just to set the scene my concerns re PbD which I think resemble the discussions on nuclear disarmament in the 1970s. In the Nixon-Brezhnev/Kosygin era, the USSR wanted to install an Anti-Ballistic Missile system around Moscow as a defence against the USA’s  Inter-Continental Missiles (ICM). The USA said that such an installation would be an act of nuclear proliferation. The USSR argued that it wasn’t: if the system was purely defensive, how could it be an act of proliferation?

The USA then said that if the USSR installed its defensive system, the USA’s response would be to build so many more ICM missiles to guarantee that, in the event of nuclear war, Moscow’s defensive system would be swamped. This explains why the USA argued that a defensive system was an act of proliferation.

I think there is an element of the idea underpinning Brezhnev’s thinking in PbD. If, for example, CCTV system only records privacy protective images you can install many of them. The problem of privacy is transferred from the privacy protecting CCTV images to who can have access to the unprotected image. This gets you back to political and legal issues (e.g. is a warrant needed? Can images be released voluntarily to help the police with respect to any crime?).

I suspect that in many instances, the main effect of PbD is to shift the privacy problem from data collection to data access or elsewhere in the system of checks and balances. I also think that PbD privacy guarantees are vulnerable to a legislative changes that requires access to unencrypted personal data. In other words, you get back to basic issues such as regulator, Parliamentary scrutiny etc etc. An insightful speech of Dr Ian Kerr (iankerr.ca/content/view/526/1/) has raised a similar concern.

The target of the blog was not PbD, but the assertion that you can have privacy and security.  I need a lot of convincing with respect to that statement because I think it wrong.

RESPONSE FROM THE COMMISSIONER

Dear Chris,

I appreciated your note of the 13th.  You present an interesting perspective on this question. Yes please, I accept your offer to post my response, and I guess this one too. Thank you for that.

There is one point that you make with which I must take issue – your statement that “the target of the blog was not PbD, but the assertion that you can have privacy and security.”  The notion that you can do precisely that represents Dr. Cavoukian’s “Positive-Sum” principle, which forms a central tenet in the concept of Privacy by Design.  Given that, I believe you can appreciate my interest in responding to your note. I'll follow your sequence of ideas.

You made reference to a speech of Dr. Ian Kerr which is posted on his website. You should also note that Dr. Kerr has written a prologue to the posting where he describes his remarks as "a kind of off-the-cuff 'moment'". He goes on to describe his later conversations with Commissioner Ann Cavoukian (to whom he refers) which provides an extra context (and maybe some counterpoint) for his remarks.

It is possible that our failure to reach a meeting of the minds on this issue stems from the fact that, as Dr. Kerr notes, we defend our positions from different philosophical orientations.  As a regulator, we are, essentially, pragmatists.  In your role, I suspect you are afforded greater opportunity to indulge in wider reflection.

Your reference to the proliferation of nuclear missiles is intriguing, but I don't think the facts are the same. On so many issues – patron and employee safety; deterrence and detection of crime – to name a few, society demands that the state offer appropriate protections.  Increasingly, the timeframe to accomplish this is not “some time next year” or “soon;” but rather, it is now. At the same time, we are confronted with an explosion of digital activity and the growing deployment of information and communications technologies into every sphere of human activity, both online and off. Tens of millions of individuals are already carrying biometric-enabled identity and travel documents; hundreds of millions are participating in online social networks, and billions of people around the world are using portable devices in new and transformative ways.

The technologies are not going away. If anything, their use will grow.  They will operate in both the public and private spheres, and all of this activity generates digital footprints. It is important to also note that, as a regulator, it is not within our mandate to prevent the implementation of technology which answers valid safety and security requirements. In our view, complete withdrawal of regulators is not a viable option in today’s information society. We believe in the need for engagement, not confrontation. We also believe that privacy is fully protected when measures are drawn from an umbrella of protections that the Commissioner calls “SmartPrivacy.”

SmartPrivacy is a model which incorporates an arsenal of protections – everything necessary to ensure that an organization’s complete holdings of personal information are appropriately managed.  Each element is important, but PbD represents its sine qua non.  Failing to envision privacy requirements from the outset will, despite the presence of the other elements, either fail to protect PI or do so in a sub-optimal manner.
 
I am attaching our report entitled, Privacy and Video Surveillance in Mass Transit Systems because I believe that it addresses the concerns you note with respect to CCTV systems.  The Toronto Transit Commission, the subject of the report, has employed cameras within their system for many years.  In addition to the comparatively recent justifications related to crime prevention and detection, they have long been an important dimension of the system’s patrons and employee safety system, as well as an important tool to manage platform crowding, especially at choke-points during congested rush hours.  It represents an excellent example of proliferation occurring prior to privacy issues and assurances. Recognizing the perception of invasiveness, the TTC has embraced PbD and implemented a full suite of controls:

•  There is no routine monitoring on surface vehicles because the technology does not provide a live feed — so no one is actually watching.

•  Special Constable Services do not monitor live video surveillance feed. All access is strictly logged and incident-driven; it's erased/re-written every 15 hours

•  Recorded video surveillance images are only accessed by the TTC when an incident has taken place, where an investigator must isolate and copy the image before it is automatically overwritten.

•  Images collected from surface vehicles are erased and automatically overwritten every 15 hours.

•  The TTC reduced its retention periods for subway images from seven days to a maximum of 72 hours.

•  Unauthorized access to images obtained through the video surveillance system is prevented. Hard drives containing recorded video images are only accessible through the use of a strong password, which is only available to a small number of TTC supervisors. The operators of TTC vehicles do not themselves have any access to the recorded images.

•  The TTC must ensure that its video surveillance program is subjected to an effective and thorough yearly audit conducted by an independent third party, using the GAPP Privacy Framework.

•  And most important, a “two-key” sign-off process (one of which must be the Chief of Police) must be invoked before police officers are permitted to retrieve any stored images.

As Dr. Kerr says, there is a role, in our society, to be played by both privacy idealists and pragmatists.  I believe that it is important that the two groups maintain an open dialogue and that the critical threshold questions which exist, are both asked and answered.  Once answered, if an authorized decision is made to invoke technology for use in a program, Privacy by Design is the only tool of which I’m aware which, when properly deployed, ensures the selected technology is privacy protective. We are not alone in the view that PbD is a powerful tool for privacy. For example, recently, in December 2009, the Centre for Democracy and Technology made a submission to the Federal Trade Commission in Washington D.C. on The Role of Privacy by Design in Protecting Consumer Privacy (copy attached for convenience) which concludes, "But if legislators, regulators, and innovators work together to buttress this framework with best practices that reflect Privacy by Design, then consumers and companies alike will discovery that privacy and innovation are not mutually exclusive, but that privacy is instead an essential element of the innovative Internet."

Chris, thank you for taking the time to consider these views.

Best, Ken

Ken Anderson
Assistant Commissioner, Privacy
Office of the Information & Privacy Commissioner of Ontario
Canada

Privacy by Design: A view from the Commissioner’s office

I am taking the opportunity to post on the blog a response from Ken Anderson, Assistant Commissioner, Privacy, Office of the Information & Privacy Commissioner of Ontario, Canada following my comments on Privacy by Design (PbD).

There is in fact two letters – the earlier of which I will post as a comment to this blog.

Just to set the scene re my concerns re PbD (which I think resemble the discussions on nuclear disarmament in the 1970s). In the Nixon-Brezhnev/Kosygin era, the USSR wanted to install an Anti-Ballistic Missile system around Moscow as a defence against the USA’s  Inter-Continental Missiles (ICM). The USA said that such an installation would be an act of nuclear proliferation. The USSR argued that it wasn’t: if the system was purely defensive, how could it be an act of proliferation?

The USA then said that if the USSR installed its defensive system, the USA’s response would be to build so many more ICM missiles to guarantee that, in the event of nuclear war, Moscow’s defensive system would be swamped. This explains why the USA argued that a defensive system was an act of proliferation.

I think there is an element of the idea underpinning Brezhnev’s thinking in PbD. If, for example, CCTV system only records privacy protective images you can install many CCTV systems. The problem of privacy is then transferred from the privacy protecting CCTV images to who can have access to the unprotected image. This gets you back to political and legal issues (e.g. is a warrant needed? Can images be released voluntarily to help the police with respect to any crime?).

I suspect that in many instances, the main effect of PbD is to shift the privacy problem from data collection to data access or elsewhere in the system of checks and balances. I also think that PbD privacy guarantees are vulnerable to a legislative changes that requires access to unencrypted personal data. In other words, you get back to basic issues such as regulator, Parliamentary scrutiny etc etc. An insightful speech of Dr Ian Kerr (iankerr.ca/content/view/526/1/) has raised a similar concern (recommended).

The target of the blog was not PbD, but the assertion that you can have privacy and security.  I need a lot of convincing with respect to that statement because I think it wrong.

RESPONSE FROM THE COMMISSIONER

Dear Chris,

I appreciated your note of the 13th.  You present an interesting perspective on this question. Yes please, I accept your offer to post my response, and I guess this one too. Thank you for that.

There is one point that you make with which I must take issue – your statement that “the target of the blog was not PbD, but the assertion that you can have privacy and security.”  The notion that you can do precisely that represents Dr. Cavoukian’s “Positive-Sum” principle, which forms a central tenet in the concept of Privacy by Design.  Given that, I believe you can appreciate my interest in responding to your note. I'll follow your sequence of ideas.

You made reference to a speech of Dr. Ian Kerr which is posted on his website. You should also note that Dr. Kerr has written a prologue to the posting where he describes his remarks as "a kind of off-the-cuff 'moment'". He goes on to describe his later conversations with Commissioner Ann Cavoukian (to whom he refers) which provides an extra context (and maybe some counterpoint) for his remarks.

It is possible that our failure to reach a meeting of the minds on this issue stems from the fact that, as Dr. Kerr notes, we defend our positions from different philosophical orientations.  As a regulator, we are, essentially, pragmatists.  In your role, I suspect you are afforded greater opportunity to indulge in wider reflection.

Your reference to the proliferation of nuclear missiles is intriguing, but I don't think the facts are the same. On so many issues – patron and employee safety; deterrence and detection of crime – to name a few, society demands that the state offer appropriate protections.  Increasingly, the timeframe to accomplish this is not “some time next year” or “soon;” but rather, it is now. At the same time, we are confronted with an explosion of digital activity and the growing deployment of information and communications technologies into every sphere of human activity, both online and off. Tens of millions of individuals are already carrying biometric-enabled identity and travel documents; hundreds of millions are participating in online social networks, and billions of people around the world are using portable devices in new and transformative ways.

The technologies are not going away. If anything, their use will grow.  They will operate in both the public and private spheres, and all of this activity generates digital footprints. It is important to also note that, as a regulator, it is not within our mandate to prevent the implementation of technology which answers valid safety and security requirements. In our view, complete withdrawal of regulators is not a viable option in today’s information society. We believe in the need for engagement, not confrontation. We also believe that privacy is fully protected when measures are drawn from an umbrella of protections that the Commissioner calls “SmartPrivacy.”

SmartPrivacy is a model which incorporates an arsenal of protections – everything necessary to ensure that an organization’s complete holdings of personal information are appropriately managed.  Each element is important, but PbD represents its sine qua non.  Failing to envision privacy requirements from the outset will, despite the presence of the other elements, either fail to protect PI or do so in a sub-optimal manner.
 
I am attaching our report entitled, Privacy and Video Surveillance in Mass Transit Systems because I believe that it addresses the concerns you note with respect to CCTV systems.  The Toronto Transit Commission, the subject of the report, has employed cameras within their system for many years.  In addition to the comparatively recent justifications related to crime prevention and detection, they have long been an important dimension of the system’s patrons and employee safety system, as well as an important tool to manage platform crowding, especially at choke-points during congested rush hours.  It represents an excellent example of proliferation occurring prior to privacy issues and assurances. Recognizing the perception of invasiveness, the TTC has embraced PbD and implemented a full suite of controls:

•  There is no routine monitoring on surface vehicles because the technology does not provide a live feed — so no one is actually watching.

•  Special Constable Services do not monitor live video surveillance feed. All access is strictly logged and incident-driven; it's erased/re-written every 15 hours

•  Recorded video surveillance images are only accessed by the TTC when an incident has taken place, where an investigator must isolate and copy the image before it is automatically overwritten.

•  Images collected from surface vehicles are erased and automatically overwritten every 15 hours.

•  The TTC reduced its retention periods for subway images from seven days to a maximum of 72 hours.

•  Unauthorized access to images obtained through the video surveillance system is prevented. Hard drives containing recorded video images are only accessible through the use of a strong password, which is only available to a small number of TTC supervisors. The operators of TTC vehicles do not themselves have any access to the recorded images.

•  The TTC must ensure that its video surveillance program is subjected to an effective and thorough yearly audit conducted by an independent third party, using the GAPP Privacy Framework.

•  And most important, a “two-key” sign-off process (one of which must be the Chief of Police) must be invoked before police officers are permitted to retrieve any stored images.

As Dr. Kerr says, there is a role, in our society, to be played by both privacy idealists and pragmatists.  I believe that it is important that the two groups maintain an open dialogue and that the critical threshold questions which exist, are both asked and answered.  Once answered, if an authorized decision is made to invoke technology for use in a program, Privacy by Design is the only tool of which I’m aware which, when properly deployed, ensures the selected technology is privacy protective. We are not alone in the view that PbD is a powerful tool for privacy. For example, recently, in December 2009, the Centre for Democracy and Technology made a submission to the Federal Trade Commission in Washington D.C. on The Role of Privacy by Design in Protecting Consumer Privacy (copy attached for convenience) which concludes, "But if legislators, regulators, and innovators work together to buttress this framework with best practices that reflect Privacy by Design, then consumers and companies alike will discovery that privacy and innovation are not mutually exclusive, but that privacy is instead an essential element of the innovative Internet."

Chris, thank you for taking the time to consider these views.

Best, Ken

Ken Anderson
Assistant Commissioner, Privacy
Office of the Information & Privacy Commissioner of Ontario
Canada

 

UK terror case judgment illustrates a failed system that cannot protect privacy

Fresh from a 17-0 defeat in the European Court of Human Rights (in the case of Marper v the UK and the DNA database), a refreshed Home Office human rights team (under its new coach, Home Secretary, Alan Johnson), has suffered a 7-0 drubbing over its anti-terrorism law (in the case of Gillan and Quinton v the UK on stop and search). If we were really talking about football, what would you think of the Home Office human rights team and its new manager?

In practice the two cases reveal the serious structural malaise in the UK’s human rights regime that undermines Article 8 protection and by implication the Data Protection Act. The malaise has two characteristics: (a) legislation that permits the authorities to invade privacy does not get scrutiny by Parliament and (b) there is no easy method of challenging the law (especially in the field of national security).

First to scrutiny. When Government implements legislation it signs a statement on the face of the Bill saying everything is compliant with the Human Rights Act. However, it provides little evidence to Parliament to justify this. So much so, that the Joint Committee of Human Rights has called for a Human Rights Memorandum Assessment  to accompany each Bill so that Parliament can do its job. This Assessment "at the very minimum" should “cite the evidence” and include details that:

• "identify the Convention rights and any other human rights engaged by the bill, and the specific provisions of the bill which engage those rights and explain the reasons why it is thought that there is no incompatibility with the right engaged”;

• “where the rights engaged are qualified rights, identify clearly the pressing social need which is relied on to justify any interference with those rights; assess the likely impact of the measures on the rights engaged; and explain the reasons why it is considered that any interference with those rights is justified”.

Now pause for a moment and ask a question: ‘How can Parliament scrutinise legislation that impacts on privacy or other aspects of human rights without the above Assessment?’.  Answer: Parliament can’t and it doesn’t.

That is why the Parliamentary Joint Committee of Human Rights sometimes  goes “spare” (in a dignified way). In one report in 2005, it said: “This is the fifth Government Bill within a very short period of time containing information sharing provisions the Convention compatibility of which has been asserted but not explained. In respect of each [Bill] we have commented that this is not satisfactory, but there has been no change in the Government's practice. This presents a very real obstacle to our scrutiny work”

This is still the problem. the Committee's report on Data Protection and Human Rights (JCHR: 14th Report; 2009) published following an inquiry into the HMRC's lost CD disks containing 25 million bank account details stressed that it "fundamentally disagreed" with an approach to setting data sharing policy that depended on "very broad enabling provisions" that grant Ministers far reaching powers.

So how to fix the problem? I think that in the UK, for example, the right to privacy of personal data could be implemented as an amendment to the Sixth Data Protection Principle and expressed in human rights terms. For example:

"Personal data shall be processed in accordance with the rights of data subjects under this Act and, in particular, personal data shall not be processed in a way that does not respect the private and family life or correspondence of data subjects".

By implementing a right to the privacy of personal data under the auspices of the Data Protection Act, the processing of personal data for the Special Purpose (i.e. freedom of expression purposes) will be left undisturbed; investigative journalism, for example, is unaffected by the change. Obviously this Principle has to be qualified in a way that engages the exemptions found in Article 8(2) of the Human Rights Convention (i.e. provide suitable exemptions for national security, law enforcement etc).

The effect of this change would explicitly link the Human Rights and Data Protection regimes and give the UK's Information Commissioner an explicit human rights role but only in the context of personal data. The Commissioner could thus challenge far ranging powers and individuals could ask for an assessment with respect to any legislation via the Sixth Principle. Such a change would empower the Commissioner, and protect the individual from the misuse of legislation by making the Human Rights regime more accessible in relation to privacy issues.

In summary, the Home Office's human rights team is not very good because human rights are not its main function. The Home Office exists to support immigration, policing and national security – all the organisations that need powers to invade privacy  - it needs privacy protection like it needs a hole in the head.

It is therefore  not surprising that Home Office legislation provides for wide ranging powers to help "their agencies" and the bare minimum when drafting provisions that protect individuals from misuse of these powers. Remember also, that the Home Office was responsible for the drafting in the Data Protection and FOI Bills, so the original weak regulatory regime and abundance of exemptions in these Bills can now be seen as almost an inevitable consequence.

The problems identified above are at the heart of the issues that bedevil the UK's privacy regime. These will continue until there are structural changes to that regime.

Finally a comment about this well publicised commentary about an Appeal. This is chaff thrown up to create smoke screen of a heavy defeat for a gullible press. The only appeal at the ECHR is to the 17-member Grand Chamber of the Court. Do you think the Home Office want to risk replacing a 7-0 defeat with one panel of eminent judges with one that is 17-0 as in the case of Marper?

References: For more analysis see "Nine principles for assessing whether privacy is protected in a surveillance society (Parts 1 and 2)" which explains why the current framework of privacy protection in the UK is deficient and how it can be improved. Also available “Human Rights Legislation and Government Policy towards national security – 2006” which explores data protection in the context of Parlimentary scrutiny, data protection, human rights terrorism and national security. Both from http://www.amberhawk.com/policydoc.asp
 

Privacy by Design can accelerate the decline of privacy

“The way to hell is paved with good intentions” is a well known English saying. I am convinced that it applies to the claim that one can have "security and privacy" by adopting Privacy by Design (PbD) techniques.

For example, Dr Cavoukian in her document on the use of whole body scanners at airports (see last week’s blog - 6th Jan) states that a PbD implementation “can satisfy security requirements without sacrificing (and perhaps enhancing) passenger privacy”. At one level this is correct. Obviously anonymous scanning is far less invasive than having someone physically pat you down or give you a strip search.

But the more you think about it, serious worries emerge. I raised some of them at the end of September (see Blog  "Do privacy enhancing technologies have an Achilles Heel?"; Sept 30th), but I have to admit that Dr Cavoukian’s bold assertion really “did it for me”.

I think PbD accelerates a gradual, step-by step, progression that I am calling "The descent of privacy” (or “The ascent of security” depending on your viewpoint). The decline (or ascent) has ten steps which are as follows:

(1) PbD techniques can make airport scanners privacy neutral – assume Dr Cavoukian’s starting premise is correct.

(2) Why are airports special? – What about main bus and rail termini or ports? These locations also need these privacy protecting scanners. Note that assertive and authoritative privacy reassurances can be uttered (e.g. such all-body scanning is more “privacy enhancing” than the alternative).

(3) A market for all-body scanners develops – they become cheaper, quicker, more reliable and more innovative and designed for specific locations or tasks.

(4) Screening gradually becomes an accepted norm (e.g. for travelling on public transport between major cities).

(5) The use of scanners has thus expanded. As there is no risk to privacy, everybody queuing to enter certain places can be screened on an increasingly cost effective basis.

(6) As costs fall, screening can be further extended to reduce the security risks at other locations: especially at gatherings where orderly queues of people form (e.g. sporting events, theatres, entrances to government or iconic buildings).

(7) If there is no screening at a public event where people queue, then people begin to think there is a security risk. The demand for screening increases irrespective of whether the evidence shows that screening is effective.

(8) Authorities install screening because:

(a) as installation becomes relatively inexpensive, the political desire to respond to demands of the electorate in Step 7 above can be satisfied;

(b) there is a genuine desire to be seen to be doing all one can to reduce the risks – the fact that there is privacy protection is a bonus;

(c) it provides the cover of having done “everything possible” if there were to be a terrorist attack and the press/public/politicians want to find “someone to blame”; and

(d) politicians reduce the risk of a serious attack “on their watch”.

(9) People become screened regularly and become conditioned to expect to be screened.

(10)  People are a risk or not trusted unless they are screened

So the end-point of the “privacy enhanced” descent is Step 10.  Even though the process is protective of privacy one has arrived at a position that can be rewritten in a more familiar guise: “If you have nothing to hide, you have nothing to fear”.

Now here comes the important bit. The anonymity associated with PbD cannot be guaranteed “for ever and ever, amen”; the anonymity guaranteed by PbD will always hang by a tenuous thread. Harold Macmillan, UK Prime Minister in the 1950s, was once asked by a journalist: “what was most likely to blow governments off course?”. He responded: “Events dear boy, events”.

So it is with PbD. Once implemented in its full “privacy protected” glory, it is only a matter of waiting for an event that allows the argument about removeing anonymity to prevail. The implementation of the infrastructure had been anonymous – but after the pivotal event and for all future time, it isn’t.

To be clear, I am not saying that full body screening at airports is wrong – nor am I saying that every surveillance activity ends at Step 10 - nor even that PbD should not be considered.

What I am saying that the promotion by privacy and security specialists of the idea that one can have privacy and security is seriously misguided. It will be seized upon by those who need security at the expense of privacy and who also know that a future event is likely to make the case for removing anonymity. In other words, PbD is merely a catalyst that can accelerate the descent down these 10 Steps: or “the way to hell”, if you prefer.

Final comment: Even without employing PbD techniques, the surveillance associated with CCTV is arguably is around Step 8 or 9; vetting against criminal records is at Step 9 or possibly Step 10. In reality, I think PbD cannot address what is the main problem: the serious democratic deficit in the system of data protection and human rights. See “Nine principles for assessing whether privacy is protected in a surveillance society (Parts 1 and 2)” which can be accessed on http://www.amberhawk.com/policydoc.asp.

Privacy Commissioner states that full body scanners can avoid data protection problems

Dr. Anne Cavoukian, the Privacy Commissioner for Ontario, is a leading expert on Privacy by Design and the use of technology to protect privacy. Last year, she published a report into “Whole Body Imaging in Airport Scanners” which has become especially prescient as Gordon Brown rushes to introduce the technology into UK Airports.

In her report (reference at end), Dr Cavoukian states that the “privacy-invasive potential” of these scanners can be addressed if privacy enhancing techniques are designed into the hardware. For instance, the images produced by millimetre wavelength radiation can be processed by software that has “modesty” algorithms to blur facial features and genitalia. In fact, Dr Cavoukian’s clearly favours the use of “Backscatter Privacy Algorithms” that result in the display of an image that resembles a human shape in chalk outline (similar to those depicted as being drawn on the floor following a murder in a TV detective series).

Operating procedures also play a part. In particular, to engender “public confidence and trust” Dr Cavoukian recommends “a complete prohibition against retention or transmission of the images in any format”. In addition, security personnel viewing the images should not see the scanned passengers before or after the scans, and should not have access to passenger details of those they have viewed. Such personnel should also be banned from bringing photographic devices, storage devices or communications equipment into a separate viewing area. Finally Dr. Cavoukian states that travellers have to be fully informed as to the screening process, and preferably have an alternative of a personal body-search if they don’t want to stand in front of the scanner.

Note that all of Dr Cavoukian’s recommendations can be transformed into obligations under the UK’s Data Protection Act. For example, if all passenger images were retained, it could constitute processing that is in breach of the Third and Fifth Principles. Any failure to provide passengers information about the scanning process could breach the Act’s fair processing obligations, and procedures relating to security personnel clearly link to the Seventh Principle.

In other words, if UK airlines want to avoid data protection issues, they should consider Dr. Cavoukian’s recommendations very seriously; they provide a benchmark through which the procedures adopted by UK airports can be assessed.

As an experienced privacy regulator herself, Dr. Cavoukian has immense credibility with most European Data Protection Commissioners. Her recommendations therefore are likely to be the basis for Europe-wide data protection procedures.

Reference: “Whole Body Imaging in Airport Scanners: Building in Privacy by Design”, Dr. Anne Cavoukian, June 2009”. http://www.ipc.on.ca/images/Resources/wholebodyimaging.pdf

A “quickie Decision Notice” is not a substitute for more resources.

As I said in my last blog before Xmas, the Information Commissioner is before the Justice Committee today at 4.45 pm; it might be “interesting viewing” (link from http://www.parliamentlive.tv/Main/Player.aspx?meetingId=5438).

However, I want to make a quick point about the Commissioner’s favoured method of reducing the backlog of FOI decisions; the introduction of what I call a “quickie Decision Notice”. The Commissioner has gone on the record as saying that “too many decision notices are produced to a gold standard with eleven pages of legal argument that would survive a prolonged case in the European Court of Human Rights”. He has concluded a more concise consideration would do.

The Commissioner’s backlog is severe. In July 2009, the FOI Campaign reported that 25% of cases resulting in a Decision Notice from the ICO took between 2 and 3 years. The Tribunal itself has complained; for example in a Decision Notice involving the Student Loans Company Limited (reference at end), the Tribunal said:

“...We are not in a position to say, and it is not for us to decide, to what extent that inordinate delay was due to lack of resources, or to deficiencies in the Commissioner’s systems of internal management, or to a mixture of those or indeed other causes. What is clear is that the volume of complaints to the Commissioner has been much higher than was predicted and, in cases where information ought to have been disclosed by the public authority, long delays in the commencement or conduct of the Commissioner’s investigations tend to frustrate the purpose of the Act and deny to the public the rights which the Act has created”.

At the end of last year, the Commissioner reported that FOI appeals were up by 29 per cent. So, even though the Commissioner is closing cases at a faster rate (34 per cent. faster in quarter 2 of 2009 compared with quarter 2 of 2008) he is effectively running hard to stand still. Hence the idea of a “quickie Decision Notice”.

The problem with this approach is that such a move could result in longer delays. For example, if a public authority or individual were to be on the receiving end of a “quicky Decison Notice”, then the likelihood of appeal to the Tribunal would in my view increase. This appeal would partly on the grounds that the “quickie” analysis underpinning the Decision Notice had not been thorough, and a mistake has been made.

In this way, the queue for a Decision Notice from the Commissioner could become less (three cheers) but the queue of appeals at the Tribunal would lengthen. The result could be more expense and delay as what has effectively happened is that the queue that causes the delay is transferred from the Commissioner to the Tribunal.

What I think is needed is not a quickie Decision Notice but rather a well supported regulator. The Government funding of a paltry £5.5 million per year for the whole of FOI is clearly inadequate for an important law that, by allowing access to information on public policy, engages individuals with the democratic process.

By restricting resources in this way, the Government is also open to the accusation of deliberately undermining the purpose of the Act by starving the regulator of the resources to keep up with demand from FOI applicants.

Reference:  Information Tribunal Appeal Number: EA/2008/0092 and Information Commissioner’s Ref: FS50126264