Hawktalk

ELECTION: What the parties promise with respect of privacy and data protection

Update posted 1:30pm, Friday 22nd April

I have added the Plaid Cyrmu statement and the fact that the Conservatives have promised to repeal the Human Rights Act

Please find in the blog coverage of all the privacy aspects from the manifestos of main political parties election; the order is Lib Dems, Conservative, Labour, and Scottish Nationalist and Plaid Cymru. The text is cut and pasted from their manifestos. I have not covered the Greens, UKIP and the rest – so sorry.

The only personal comment I am making relates to the policies of Monster Raving Looney Party. You should put them side-by-side with the Labour Party’s efforts; both are equally incomprehensible but at least you can laugh at the former.

Liberal Dems:  protect and restore your freedoms.

We will:

• Introduce a Freedom Bill. We will regulate CCTV, stop councils from spying on people, stop unfair extradition to the US, defend trial by jury, and stop children being fingerprinted at school without their parents’ permission.

• Restore the right to protest by reforming the Public Order Act to safeguard non-violent protest even if it offends; and restrict the scope of injunctions issued by vested interests.

• Protect free speech, investigative journalism and academic peer reviewed publishing through reform of the English and Welsh libel laws – including by requiring corporations to show damage and prove malice or recklessness, and by providing a robust responsible journalism defence.

Scrap intrusive Identity Cards and have more police instead, and also scrap plans for expensive, unnecessary new passports with additional biometric data. 

• Halt the increase in unnecessary new offences with the creation of a ‘stop unit’ in the Cabinet Offi ce. Every department in Whitehall would have to convince this unit of the need for a new offence.

• End plans to store your email and internet records without good cause.

• Remove innocent people from the police DNA database and stop storing DNA from innocent people and children in the future, too.

• Ensure that everyone has the same protections under the law by protecting the Human Rights Act.

• Scrap the intrusive ContactPoint database which is intended to hold the details of every child in England.

Conservative:  Restore our civil liberties

Labour’s approach to our personal privacy is the worst of all worlds – intrusive, ineffective and enormously expensive. We will scrap ID cards, the National Identity Register and the Contactpoint database. To protect our freedoms from state encroachment and encourage greater social responsibility, we will replace the Human Rights Act with a UK Bill of Rights.

We will scale back Labour’s database state and protect the privacy of the public’s information. We will introduce a balanced approach to the retention of people’s DNA and reform the criminal records system so it protects children without destroying trust.

Wherever possible, we believe that personal data should be controlled by individual citizens themselves. We will strengthen the powers of the Information Commissioner to penalise any public body found guilty of mismanaging data. We will take further steps to protect people from unwarranted intrusion by the state, including:

• cutting back intrusive powers of entry into homes, which have been massively extended under Labour;

• curtailing the surveillance powers that allow some councils to use anti-terrorism laws to spy on people making trivial mistakes or minor breaches of the rules;

• requiring Privacy Impact Assessments of any proposal that involves data collection or sharing; and,

• ensuring proper Parliamentary scrutiny of any new powers of data-sharing.

The indefinite retention of innocent people’s DNA is unacceptable, yet DNA data provides a useful tool for solving crimes. We will legislate to make sure that our DNA database is used primarily to store information about those who are guilty of committing crimes rather than those who are innocent. We will collect the DNA of all existing prisoners, those under state supervision who have been convicted of an offence, and anyone convicted of a serious recordable offence. We pushed the Government to end the permanent retention of innocent people’s DNA , and we will change the guidance to give people on the database who have been wrongly accused of a minor crime an automatic right to have their DNA withdrawn.

We believe that people working in positions of trust with children should go through a proper criminal record check. But Labour’s new system goes too far. So we will review the criminal records and ‘vetting and barring’ regime and scale it back to common sense levels.

Labour: Using technology to cut crime

We will continue to make full use of CCTV and DNA technology: new weapons deployed to strengthen our fight against crime. We are proud of our record on civil liberties and have taken the DNA profiles of children off the database and tightened the rules around the use of surveillance – but we are also determined to keep our streets safe.

CCTV reduces the fear of crime and anti-social behaviour. We have funded cameras in nearly 700 areas, and brought in a new power for people to petition their local authority for more CCTV.

Advances in DNA technology have been critical in solving serious crimes – last year alone there were 832 positive matches to the DNA database in cases of rape, murder and manslaughter. Labour will ensure that the most serious offenders are added to the database no matter where or when they were convicted – and retain for six years the DNA profiles of those arrested but not convicted.

The new biometric ID scheme which already covers foreign nationals will be offered to an increasing number of British citizens, but will not be compulsory for them. It will help fight the growing threat of identity theft and fraud, as well as crime, illegal immigration and terrorism. In the next Parliament ID cards and the ID scheme will be self-financing. The price of the passport and ID cards together with savings from reduced fraud across the public services will fully cover the costs of the scheme.

Statement by the Scottish Nationalist Party

The SNP believe in the importance of protecting people’s identity information and the privacy of individuals.

The SNP Government has announced proposals for public sector organisations to avoid creating large centralised databases of personal information and keep clear audit trails on how identity data is used. The Scottish Government is consulting on Identity Management and Privacy Principles that aim to raise confidence in the management of personal data. Draft principles include:

* Proving identity or entitlement: people should only be asked for identity when necessary and they should be asked for as little information as possible;

* Governance and accountability: private and voluntary sectors which deliver public services should be contractually bound to adhere to the principles;

* Risk management: Privacy Impact Assessments should be carried out to ensure new initiatives identify and address privacy issues;

* Data and data sharing: Organisations should avoid creating large centralised databases of personal information and store personal and transactional data separately;

* Education and engagement: Public bodies must explain why information is needed and where and why it is shared.

The work to develop the principles has been commended by the Irish Data Protection Commissioner and the Dutch Commissioner.

Statement by the Plaid Cymru

Plaid is committed to supporting organisations such as Liberty to ensure an end to detention without trial, and the scrapping of identity cards. We fully support the NO2ID campaign and our Members of Parliament will continue to oppose any attempts to introduce identity cards in the strongest possible manner. Plaid Cymru MPs are obliged to present an annual report on the state of civil liberties in Britain to the autumn party conference. We will also oppose attempts to introduce identity cards by the back door through a requirement for passport applicants to give fingerprints.

Furthermore, we believe that the proposed introduction of Identity cards will significantly erode individual rights, civil liberties and justice; they will prove costly and ineffective in their supposed aim of increasing security; they will cost us billions of pounds in the middle of a public spending crisis, and will have little or no tangible benefit for ordinary working people.

We know that the use of identity cards in other countries has not prevented fraud, illegal immigration or terrorism; we fear that identity cards will lead to an increase in state control and surveillance over the individual and they will create an unacceptable imposition on every citizen.

In fact, we believe that the proposals are unlawful under the principles of the European Convention on Human Rights which amongst other things guarantees every person the fundamental right to privacy, and that the introduction of identity cards will marginalise and disenfranchise already disadvantaged people, and encourage greater institutionalised racism and scapegoating.

Information Commissioner should enforce Article 8 privacy rights

For some time, I have been advocating the creation of an explicit and unequivocal link between the Data Protection Act (DPA) and the Human Rights Act (HRA). I now think that this link already exists and that the Information Commissioner (ICO) should take up cases which involve the unlawful use or retention of personal data, where "lawfulness" is assessed in the context of compliance or non-compliance with the obligation to show respect for private and family life (Article 8(1) of the HRA).

The matter is important because “lawful” processing forms part of the text of three Data Protection Principles (1st, 2nd, 7th) and any backing-off the enforcement of “lawful processing” would degrade the protection afforded to all data subjects. Disclosure and data sharing is not included in my list of processing operations which the ICO could assess on Human Rights grounds; this is because I am not certain of the outcome and I explain this uncertainty in a footnote at the end of this blog.

Historically, the ICO is very reluctant to take on questions of lawful processing and one reason for this derives from Poll Tax and Council Tax days when Local Authorities often asked the ICO whether “it would be lawful to use the Council Tax/Poll Tax database to do XYZ”. The ICO’s answer was more or less on the lines: “The ICO cannot police all legislation that could impact on a Local Authority; the ICO will only look at this problem when there is a lawful processing issue to resolve and not before”.

Note that the very same argument would go for any Data Controller who asked: “Is it lawful to do ABC with personal data collected under the Humpty Dumpty Act 1926”. To some extent therefore I agree with the ICO’s stance: one cannot expect his office to pass judgments on every single statute ever enacted in advance of any processing of personal data.

Similarly with respect to “breach of contract” or “breach of copyright”, the ICO is reluctant to take action with respect to unlawful processing. If this were to happen, a putative civil contractual or copyright breach would be transformed into a data protection issue merely because personal data are involved.

This explains why the ICO says in his Data Protection Guide: “However, although processing personal data in breach of copyright (for example) will involve unlawful processing, this does not mean that the ICO will pursue allegations of breach of copyright (or any other law) as this would go beyond the remit of the Data Protection Act. Many areas of law are complex, and the ICO is not and cannot be expected to be expert in all of them” (from the section on "What is meant by lawful?")

However, I now think this guidance cannot apply to the Human Rights Act because the law intends the ICO to have a role in protecting the Article 8 right. This is made clear in the Directive 95/46/EC which, in Article 1, defines the purpose of the Directive in these words: “In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data”.

Recital 1 adds further clarification in that the Directive is a step towards “...preserving and strengthening peace and liberty and promoting democracy on the basis of the fundamental rights recognized in the constitution and laws of the Member States and in the European Convention for the Protection of Human Rights and Fundamental Freedoms”.

Recital 10 then amplifies what is meant by the “right to privacy”. It states that “... the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognized both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms”. Recital 11 then adds that “the right to privacy” in the Directive is intended to “give substance to and amplify those (provisions) contained in the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data”.

I think that the above comprise pretty conclusive evidence that the legislators have linked the DPA and HRA regimes and that the ICO, as the DPA regulator, thus has a role in assessing the lawfulness or unlawfulness of the processing personal data with respect to Article 8 of the Human Rights Act.

If I am correct, then this implies that some of the excesses of a “surveillance state” could have been challenged, especially in the case of the use or retention of personal data by a public authority. So, for example, with respect to the use of Automated Number Plate Readers (see blog of 4th April), or the retention of DNA personal data - these can or could have been tested by the ICO with respect to "lawful processing".

Note that this does not mean that any action by the ICO will succeed from the data subject’s perspective. All it means that cases involving the Article 8 do not need a wealthy celebrity (e.g. Naomi Campbell), nor do they have to wait until a determined litigant surfaces (e.g. S and Marper re DNA), nor do they involve early and  costly court procedures where the individual is pitted against the resources of the state (see blog of 18th November 2009).

Any data subject should be able to ask for an assessment with respect to lawful processing with respect of Article 8, for the ICO to form a view, and if enforcement follows, for the Tribunal system looking at the facts of the case before it gets into the Court system.

Enforcement of lawful processing allows the ICO can take on the mantle of protecting individual information rights and puts flesh on the bones of his new mission statement that begins with the claim that his office is “Upholding information rights in the public interest...”. If this mission statement is to mean anything, then the ICO should begin to exercise his powers that require a public authority to respect an individual’s right to private life by not excessively using or retaining his personal data.

Footnote re disclosure: any disclosure authorised by law is likely to fall within the “exemption from the Non disclosure provisions” (S.27(3) of the DPA). These provisions explicitly exempt the “lawfulness” of the processing as being a consideration, and this appears to negate the argument posited above. However, the non-disclosure exemption does not exclude the need for a Schedule 2 condition to apply to the disclosure, and that in the absence of data subject consent, such a disclosure has to pass a test of being “necessary”. This “necessity” test reintroduces the concept of “proportionality” in terms of Human Right so it might not affect the argument posited above. That is why I am not sure what the actual position is - does anyone have a view?

It is Friday so here is a Data Protection Quiz

Armed with your data protection knowledge and skill, please identify what might be wrong with the following commentary found in a judgement issued this year. You can take as long as you like.

"It is important to bear in mind the definition of “data” contained in s.1(1) of the Act. The email in question was neither “recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system” nor does it “form part of an accessible record”.

Reference: Peter Hughes (Claimant) and William Risbridger (sued as “Bill Risbridger”), Neutral Citation Number: [2010] EWHC 491 (QB).

Advert: This is one of the legal cases covered in our Update sessions in Manchester (Monday, April 26th) and Edinburgh (Monday, May 10th). Details on the events page of www.amberhawk.com

Should the European Data Protection Supervisor resign?

Can you remember those intelligence test questions of the form: “X is to Y” as “C is to D?”.  Well here’s a new one: “Robespierre’s Committee of Public Safety is to democracy” as the “European Union’s Freedom, Security and Justice Directorate is to privacy”.

Whereas the former willingly silenced dissenting voices by removing heads at Madame Guillotine, the latter is wilfully cutting out any basic data protection requirements when making binding international agreements. Given the considerable democratic deficit in the European Community’s infrastructure and given that Parliaments of Member States of the European Union cannot really challenge these agreements, the situation is absolutely shocking.

Don’t believe me? Well just read what the European Data Protection Supervisor (EDPS) has just said in his March Newsletter.

About the Anti-Counterfeiting Trade Agreement

“The EDPS regrets that he was not consulted by the European Commission on the content of an agreement which raises significant issues as regards individuals' fundamental rights, and in particular their right to privacy and data protection. In this context, he views with concern the fact that little information is publicly made available about current negotiations”.

About the Passenger Name Record (PNR) agreement

“With regard to the US PNR agreement, the EDPS reiterates some concerns, already expressed in his interventions before the Court of Justice and in opinions adopted with the Article 29 Working Party, which are not satisfactorily addressed in the definitive version of the agreement”.  He added “In particular, the EDPS stresses that the agreement does not focus on persons presenting a risk, but rather allows for a bulk collection of personal data and risk assessment applied to all individuals”.

About the Terrorist Financing Tracking Programme

“The EDPS considers that not enough evidence has been provided so far to justify the necessity and the proportionality of such a privacy-intrusive agreement, which in many ways overlaps with pre-existing EU and international instruments in this area”. He added: “Some important data protection elements for the Europeans whose data are transferred to the US are not clearly defined in the agreement” and that “it does not satisfactorily and systematically provide all the safeguards required by the EU data protection legal framework, leaving some dangerous lacunae that should be carefully addressed...”.

About data sharing co-operation and taxation

“In his opinion, the EDPS stated that the Commission proposal is a clear example of a lack of data protection awareness since the issue of data protection has almost completely been ignored”. He concluded “As a consequence, the proposal contains several elements which are incompliant with data protection requirements”.

According to his web-site, the EDPS is an independent supervisory authority devoted to protecting personal data and privacy and promoting good practice in the EU institutions and bodies. It does so by "advising on policies and legislation that affect privacy".

Well given the above, you now have some idea as to how well the European Commission heeds his advice. And this is not the first time: over the past few years, the Commission has a track record of systematically ignoring data protection advice that it doesn’t want to hear.

The current EDPS, Peter Hustinx, is well respected in the data protection community. His views are balanced, well thought out and skilfully delivered. If his advice continues to be ignored by the Commission on the scale that it is, then he can’t simply do the job he was employed to do. And Mr Hustinx knows full well that there are limits when employed to do an increasingly pointless non-job (i.e. advising the Commission on data protection).

What the EDPS has also shown is that the Commission, when dealing with international data protection agreements, instinctively acts like a nomenklatura rather than a democratic institution.

References: Newsletter Nr. 23 of 15 March 2010 from http://www.edps.europa.eu/EDPSWEB/edps/site/mySite/Newsletters

 

Cartoon

    ©Chris Slane

 

Managing the aftermath of a loss or personal data

If readers want to examine an interesting example of how to manage a data loss, have a look at what happened at the London Borough of Barnet (see references). A data loss involving 9,000 children followed a burglary of the home of a member of staff. The loss included the Council’s computer equipment (a laptop), CD Roms and memory sticks along with other items from the house.

Like most organisations, the Council had implemented procedures and policies to ensure that the personal data on the computer equipment and related portable media were encrypted. Unfortunately, in this case, there were unencrypted personal data stored on CDs and memory sticks which were stolen with the laptop. As there had been a clear breach of Council policies, the member of staff concerned was suspended and data subjects (or in this case, the parents of data subjects) were contacted by a letter. So what is new in this?

Well, I think the new item is the public relations handling of data subjects (and parents). I think the Council formed the view that having reported the data loss to the parents (and presumably the ICO), an Undertaking from the ICO would be a likely end-point of the process. Given this, it followed that the ICO’s publicity machine would be very likely to issue its usual press statement concerning details of the Council’s Undertaking (if there were to be one).

So instead of waiting for the inevitable, LB Barnet took the initative. It published full details of the data loss on its web-site, invited data subjects to ask questions or exercise their right of access, gave details of what it was doing to remedy the situation and provided contact details for those who had questions. The letter to the parents of data subjects and the content of the web-site pages were either signed by the Chief Exec or approved by him.

In this way, the Council managed the bad news instead of the ICO managing it through his usual press release that accompanies an Undertaking. This means that if there were to be an Undertaking and if ICO were to issue a press release, then the subject is “old news”. In fact, is there a need for an Undertaking if the Chief Exec has publicly committed himself to do the things that the Undertaking would require of him?

It will be interesting to see how this pans out in practice. However, consideration of seizing the news agenda when there is a data loss is something that data controllers can do. In addition, one can always follow the Government’s example of  identifying “a very good day to bury bad news”. Issuing press releases at 4:00pm on a Friday or the day before a bank holiday is usually a good time for a press release to be missed.

Reference: On the Amberhawk website (http://www.amberhawk.com/policydoc.asp), I have published an analysis of “The Undertaking – 2010” which I think will be the ICO’s enforcement mechanism of choice. For Barnet’s data loss see  http://www.barnet.gov.uk/highlights/highlights-schools-data-loss.htm.

ANPR cameras expose the need for human rights link

If ever you wanted an example of why there should be an express linkage between the Human Rights Act (HRA) and the Data Protection Act (DPA), then consider the front page lead of last weekend’s Sunday Times (followed by other newspapers such as the Daily Mail).

It reported that the police were using automatic number plate recognition (ANPR) cameras to collect millions of car number plates, dates and times when cars passed the cameras and keeping the resultant personal data for two years. Sometimes images of the driver of passing cars are captured and retained.

The police find ANPR invaluable. It is usually linked to other details held by the police in real time (e.g. to check whether the registered vehicle owner of a car is insured, or of interest to the police for an intelligence purpose). Retention for two years allows the police to trace cars that have been reported to them as possibly being involved in an incident or crime.

As a news story, this story is five years old. In his 2005-2006 Annual Report, the Chief Surveillance Commissioner warned that automatic number plate recognition (ANPR) cameras could qualify as covert surveillance, and be illegal. The report noted that "The unanimous view of the Commissioners is that the existing legislation is not apt to deal with the fundamental problems to which the deployment of ANPR cameras gives rise" and that "The Commissioners are of the view that legislation is likely to be required to establish a satisfactory framework to allow for the latest technological advances".

The Commissioners then warned of human rights and privacy issues with the use of the cameras, which record number plates and images of people inside cars for police purposes. The Annual Report stated that the use of the cameras, could be categorized as covert surveillance under the controversial Regulation of Investigatory Powers Act (RIPA) and that the questionable legal status of the covert cameras could impact on prosecutions.

In response to this Report, a Home Office spokesperson said: "We are examining whether primary legislation is required in this area". Of course, no such legislation appeared although there was an attempt to sneak it in under an early version of the Government’s DNA legislation (see references).

The Sunday Times also reported Liberty, the Civil Rights Group, as being ready to take a human rights case to court. If Liberty did so, I am sure they would have a good chance of winning as, like the DNA retention by the police of individuals who were arrested but not guilty of a crime, the ANPR system indiscriminately collects and retains personal data on those who are of no interest to the police, in the absence of specific legislation that authorises an interference into private and family life.

However, if there was an explicit link between the HRA and the DPA (as I have often promoted), then the Information Commissioner could investigate the lawfulness of the ANPR data collections to see whether such processing was “necessary” in terms of Article 8 of the HRA and in terms of Schedule 2 of the DPA. If enforcement action by the ICO arose, the case could be heard by the new Tribunal system without the initial and costly involvement of the Courts.

It is for this reason that I think that this linkage can bolster the protection afforded to the individual against a “database state” or the “surveillance state” by allowing the ICO (following a request for an assessment from a data subject) to assess whether the processing is lawful in terms of Article 8 of the HRA and the DPA.

Of course, in hotly contested cases, there will be appeals to the higher Courts. However, the higher level appeals would involve the ICO and not the individual, and the detail and substance of the case would have been tested first at a lower and more accessible level.

In other words,  any legal contest would no longer be a question of David versus Goliath (e.g. as in the case of S & Marper v the UK), it would be "Regulator charged with protecting the individual v the State" - an outcome which is far more balanced.

References:  http://www.amberhawk.com/policydoc.asp  links to “Nine principles for assessing whether privacy is protected in a surveillance society (Part 2) – 2008” (about the need to link DPA and HRA regimes) and  “Evidence to JCHR re powers in Police and Crime Bill – 2009”  (about clauses re  regulation of ANPR images)”. If you want chapter and verse on why the ANPR story is an old one see http://www.out-law.com/page-7529. “Government want powers over use and disclosure of DNA, CCTV and ANPR data”, 24th June 2009 is on amberhawk.typepad.com/amberhawk/2009/06/dna.html

Biometric toe-prints added to ID Card database

According to a press release issued at midnight, yesterday, regulations have been tabled before Parliament to allow a complete set of toe-prints to be added to the list of ID Card biometrics (see references below).

The Government also claim that the new biometric will allow for shorter queuing time at airport security as anyone who is requested to take their shoes off (e.g. when passing through airport security scanners or a whole body scanner) will be able to have their toe-prints checked and their identity confirmed as they stand. Evidently, biometric toe-print readers have already been successfully trialled using scanners at an International Airport near Doncaster.

Meg Hiller, the Minister responsible for the ID Card said: “This is an exciting development in biometric security and is another of our many final steps towards securing acceptance of identity cards in general.  I think that most individuals will welcome the enhanced biometric security that ten-toe prints will bring, especially as ACPO and the head of MI5 have confirmed that collection of toe-prints will deter future shoe bombers like Richard Reid”.

Meg Hiller continued “The additional cost of this improved security is marginal. People when providing all ten fingerprints at enrolment centres will merely be asked to take their socks off”.

She continued: “we have checked with the Chief Medical Officer and he has confirmed that foot-dipping with disinfectants will only be needed if an ID Card enrolment centre is in an area designated under “The Export and Movement Restrictions (Foot-and-Mouth Disease) Regulations 2010”.

Meg Hillier added: “The collection of toe-prints helps end discrimination. Sadly, those individuals who have no hands cannot enjoy the full benefits of enrolling for an ID Card. Toe prints will allow them to participate fully in society just by putting their feet up on a scanner. To be fully biometrically inclusive with respect to those who have no hands or feet, we intend to hold talks with the Arm & Legless Society of Great Britain to see whether a DNA sample collection would be acceptable to them”.

Meg Hillier concluded by saying that all the benefits of an ID Card can be obtained “by literally playing footsie with your ID Card”.

References: to read the full press release (“Toe prints to enhance ID Card biometric security and ease airport security queues”, just follow the link Download HO_news_310310. The draft “Identity Cards Act 2006 (Toes Biometrics) Regulations 2010” modify “The Identity Cards Act 2006 (Prescribed Information) Regulations 2009”.  The Regulations can be obtained from http://www.opsi.gov.uk/si/si2009/draft/plain/ukdsi_9780111480434_en