If ever you wanted an example of why there should be an express linkage between the Human Rights Act (HRA) and the Data Protection Act (DPA), then consider the front page lead of last weekend’s Sunday Times (followed by other newspapers such as the Daily Mail).
It reported that the police were using automatic number plate recognition (ANPR) cameras to collect millions of car number plates, dates and times when cars passed the cameras and keeping the resultant personal data for two years. Sometimes images of the driver of passing cars are captured and retained.
The police find ANPR invaluable. It is usually linked to other details held by the police in real time (e.g. to check whether the registered vehicle owner of a car is insured, or of interest to the police for an intelligence purpose). Retention for two years allows the police to trace cars that have been reported to them as possibly being involved in an incident or crime.
As a news story, this story is five years old. In his 2005-2006 Annual Report, the Chief Surveillance Commissioner warned that automatic number plate recognition (ANPR) cameras could qualify as covert surveillance, and be illegal. The report noted that "The unanimous view of the Commissioners is that the existing legislation is not apt to deal with the fundamental problems to which the deployment of ANPR cameras gives rise" and that "The Commissioners are of the view that legislation is likely to be required to establish a satisfactory framework to allow for the latest technological advances".
The Commissioners then warned of human rights and privacy issues with the use of the cameras, which record number plates and images of people inside cars for police purposes. The Annual Report stated that the use of the cameras, could be categorized as covert surveillance under the controversial Regulation of Investigatory Powers Act (RIPA) and that the questionable legal status of the covert cameras could impact on prosecutions.
In response to this Report, a Home Office spokesperson said: "We are examining whether primary legislation is required in this area". Of course, no such legislation appeared although there was an attempt to sneak it in under an early version of the Government’s DNA legislation (see references).
The Sunday Times also reported Liberty, the Civil Rights Group, as being ready to take a human rights case to court. If Liberty did so, I am sure they would have a good chance of winning as, like the DNA retention by the police of individuals who were arrested but not guilty of a crime, the ANPR system indiscriminately collects and retains personal data on those who are of no interest to the police, in the absence of specific legislation that authorises an interference into private and family life.
However, if there was an explicit link between the HRA and the DPA (as I have often promoted), then the Information Commissioner could investigate the lawfulness of the ANPR data collections to see whether such processing was “necessary” in terms of Article 8 of the HRA and in terms of Schedule 2 of the DPA. If enforcement action by the ICO arose, the case could be heard by the new Tribunal system without the initial and costly involvement of the Courts.
It is for this reason that I think that this linkage can bolster the protection afforded to the individual against a “database state” or the “surveillance state” by allowing the ICO (following a request for an assessment from a data subject) to assess whether the processing is lawful in terms of Article 8 of the HRA and the DPA.
Of course, in hotly contested cases, there will be appeals to the higher Courts. However, the higher level appeals would involve the ICO and not the individual, and the detail and substance of the case would have been tested first at a lower and more accessible level.
In other words, any legal contest would no longer be a question of David versus Goliath (e.g. as in the case of S & Marper v the UK), it would be "Regulator charged with protecting the individual v the State" - an outcome which is far more balanced.
References: http://www.amberhawk.com/policydoc.asp links to “Nine principles for assessing whether privacy is protected in a surveillance society (Part 2) – 2008” (about the need to link DPA and HRA regimes) and “Evidence to JCHR re powers in Police and Crime Bill – 2009” (about clauses re regulation of ANPR images)”. If you want chapter and verse on why the ANPR story is an old one see http://www.out-law.com/page-7529. “Government want powers over use and disclosure of DNA, CCTV and ANPR data”, 24th June 2009 is on amberhawk.typepad.com/amberhawk/2009/06/dna.html
Comments