Hawktalk

North America’s “Generally Accepted Privacy Principles” establish an inadequate data protection regime.

There is a trend to equate “privacy” with “data protection” probably because many USA organisations like Google like to use the “p-word” quite a lot and there is a common desire to be “privacy friendly”. However, when you make this equation, it can be at the expense of ignoring many important data protection safeguards.

The divergence between the concepts of “privacy” and “data protection” emerges by an analysis of some of the Generally Accepted Privacy Principles (GAPP), which fall a long way short of anything recognisable as a European Data Protection standard. In fact I will go as far to say that the divergence is such that some GAPP Privacy Principles would struggle to meet the standards established by the UK’s old Data Protection Act 1984.

The GAPP Principles (and related criteria) have been produced by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA) as part of its best practice audit role. The Principles  “were developed and updated by volunteers who considered both current international privacy regulatory requirements and best practices”, and an informal study shows that 89% of organisations in the USA who have a privacy officer who is a member of the IAPP mailing list, have used these GAPP Principles.

So one can conclude that, in the USA, the GAPP Principles are not without significance. In relation to Canada, the OECD website confirms that “The GAPP are popular among Canadian privacy practitioners” and the OECD lists these Principles on the same page as its own Guidelines and the APEC Privacy Framework (for the Asia-Pacific region).

There are two main areas of deficiency or gaps, if we are allowed a pun. The first is around the area of data subject “consent” and fair collection notices, and the second is with the use of personal data in the public domain (i.e. posted on the Internet).

In the context of consent, the GAPP Choice and Consent Principle clearly allows “implied consent”; this contrasts with the European definition of “consent” which requires the data subject to signify agreement with the processing of his personal data. Thus in relation to consent, GAPP is describing procedures such as an organisation providing a notice to the data subject and equating the absence of a response as implied consent.

This can be seen in GAPP’s definition of “explicit consent” which stresses that “explicit consent requires the individual to affirmatively agree”; one can thus infer that “implied consent” does not need any such affirmation. In relation to the obtaining consent, GAPP states that such consent is obtained “at or before the time personal information is collected or soon after” (my emphasis: clearly inconsistent with European standards when collecting personal data from the data subject). GAPP even provides an example which fails to pass muster: “an individual subscribing to a newsletter gives implied consent to receive communications from that entity” (where the choice of the word “communications” clearly means communications other than the newsletter).

Of course the GAPP Choice and Consent Principle can include what one would recognise as European standards, but the “flexibility of the text” clearly allows procedures that many European Data Protection Officers would have difficulty in accepting as being valid.

In relation to Notice, there are some unusual recommendations. For instance it is consistent with the GAPP Principles to use or disclose personal data “without and individual’s knowledge or consent if the use (or disclosure) is for statistical or scholarly study or research”. Similarly, use and disclosure for debt recovery can occur without the knowledge of the data subject even though this “debt tracing purpose” appears in many fair processing notices in the UK – without one should add, little detriment to the debt recovery purpose.

With respect to “publicly available information”, GAPP recommends that these personal data can be collected, used, retained and disclosed without any knowledge or consent of the individual concerned. This position arises because if there is personal data in the public domain, then there cannot be any privacy – and because there can’t be privacy, the personal data can be used, retained, disclosed without any restriction.

This position highlights one fundamental difference which helps explain why the USA’s view of “privacy” is not the same as the European understanding of “data protection”. For instance, it is true that if personal data are in the public domain, there can be no privacy in those data. However, data protection is more than privacy and asks other questions when these data are used.

So, for instance, if an employer were to use personal data from the internet, European data protection legislation would ask three questions that the GAPP Principles fail to consider. These questions are:

1) Are the personal data “necessary” for the employer’s purpose (i.e. what is the basis for the processing in terms of Article 7 of the Directive 95/46/EC or Schedule 2 of the UK Data Protection Act)

2) Are the personal data “accurate” and “relevant” to that purpose (i.e. is there compliance with the Principles found in Article 6 of the Directive or Schedule 1 of the UK Data Protection Act)

3) Does the data subject know of the use of his personal data from the Internet (i.e. is there proper notice of the use of the personal data as required by Article 11 of the Directive of the fair processing notice of the UK Data Protection Act).

As respect to the latter point, the Information Commissioner emphasises the need for a fair processing notice  in his Employment Code. He states that employers should "Explain the nature of and sources from which information might be obtained about the applicant in addition to the information supplied directly by the applicant". In other words, employers should state whether or not they browse the Internet to find out details about their prospective employees – even if the personal data is in the public domain.

One should add that the fundamental difference in approach between the USA’s view of “privacy” and Europe’s view of “data protection” will widen if the European Commission moves ahead with it’s idea of a  “right to forget” (that allows data subjects to have personal data removed from the Internet).  The right to forget infers deletion of personal data – something that does not trouble GAPP for personal data in the public domain.

The deficiencies in the GAPP Principles mirror the failings I found in the APEC Privacy Framework (see references). The USA were leading lights in the development of this Framework, and have produced an International Agreement which is strong on “privacy” but is somewhat at odds with current European expectations for “data protection”. As with the GAPP Principles, the APEC text is cleverly drafted to include procedures that could be compliant with European standards of data protection but also permits procedures that fall a long way short.

A final conclusion is perhaps more personal and one that I urge you to follow. Whenever you talk to American Privacy Officers do not use the term “privacy legislation” as a shorthand to explain the workings of Europe’s data protection legislation. There are far too many differences between the two concepts.

References: Access to the GAPP Principles and related criteria is on http://www.aicpa.org/InterestAreas/InformationTechnology/Resources/Privacy/GenerallyAcceptedPrivacyPrinciples/Pages/default.aspx.

The APEC Privacy Framework and data protection – 2008 which explains why the APEC Framework is deficient in European Data Protection terms (e.g. Directive 95/46/EC); available on http://www.amberhawk.com/policydoc.asp

Advert: We are running several sets of data protection courses next year. We are starting a set of the 7-day DP course in London (beginning 18th January) and running the 5-day intensive course in Edinburgh (beginning 24th February) and in Leeds (beginning 3rd March). These courses cover the DP ISEB syllabus and prepares delegates for the examination in April 2011. Our courses are structured so they are also suitable for those who do not seek the ISEB qualification. See the “brochure” section of the Amberhawk website (www.amberhawk.com)

 

Government weakens Parliamentary and ICO supervision of the Data Protection Act

I have concluded that proposals published by the Government in relation to “the bonfire of the quangos” (the Public Bodies Bill) and in relation to reform of Parliament (the Parliamentary Voting System and Constituencies Bill) can both serve to weaken the effectiveness of the supervision of the Data Protection Act. There is a significant risk that a future Government could use powers in both Bills to reduce Parliamentary scrutiny of its own processing of personal data or threaten the Information Commissioner into not taking regulatory action.

Before the Public Bodies Bill was published, I thought the Office of the Information Commissioner (ICO) was “safe” from abolition. The text of the Bill shows that this is not the case, as the Bill specifies all quangos as falling within one of seven Schedules of the Bill.

For example, there is a Schedule for quangos to be abolished, a Schedule for those quangos that are to be merged with others, a Schedule of those quangos whose powers and functions are to be changed, a Schedule of those whose powers and functions are to be transferred and finally a Schedule of other public bodies which can be transferred into other Schedules.

The ICO can be found listed in the last Schedule. Technically, it is “safe” for the moment but the powers in the Bill mean that the ICO can be moved from the “safe” Schedule to any other Schedule (e.g. the “abolish” Schedule or the “merge functions” Schedule) at the stroke of a Ministerial pen. All the Minister needs do is lay an Order before Parliament changing the Commissioner’s place in the Schedules followed by another Order removing powers, transferring functions or whatever the Minister wants.

So suppose in future, an Information Commissioner is concerned about how Government processes personal data. If the Information Commissioner is viewed by the Minister to be “too pushy” or “unhelpful”, the Bill allows the Minister to change the powers and functions of the Commissioner or transfer those functions to a more compliant body.

In other words, the Commissioner cannot now be guaranteed to possess total independence from Government. In my view, the risks associated with the Public Bodies Bill makes the overwhelming case for the Commissioner to be taken away from the responsibility of the Ministry of Justice, and to report to, and to be funded by, Parliament.

Mind you, the change proposed above is not a panacea as the effectiveness of Parliamentary supervision is likely to be eroded by the second proposal from Government: the Parliamentary Voting System and Constituencies Bill. At the heart of the Bill there is a proposal to reduce the number of MPs by 50 so that 600 MPs are in Parliament. There is no proposal in the Bill to reduce the number of MPs who serve in Government.

As the Government is formed from MPs in Parliament, there exists is a “block vote” called the “payroll vote” that is worth about 150 votes. MPs in Government are expected to vote for the Government (or resign), so by reducing the number of MPs but not the MPs in Government, the payroll block vote increases its power from 23% to 25%.

In general, this block of guaranteed support for the Government on any given Parliamentary vote accounts for the fact that it is very rare for Government to be defeated. Additionally, as most MPs want to become Ministers, the Whips ensure that frequent “rocking the boat” usually ends that prospect. Sometimes, MPs who continually cause trouble could face threats of reselection if their party loyalty is continually called into question.

This explains why Parliament is a generally compliant body. There is no separation of powers as in the USA where Parliament can scrutinise the executive, because the executive has a significant block vote in the scrutinising chambers of Parliament, and the Whips (also part of the executive) dictate how MPs from the governing party vote.

So if there were to be a dispute about the Government’s processing of personal data, the only MPs likely to pick up the issue are the opposition ones who have no power. As seen regularly with the last Government, Ministers plough on regardless of what is said in Parliamentary Committee reports (like the ones from the Joint Committee of Human Rights or the Home Affairs Select Committee on surveillance). The record shows that these reports are often ignored.

In other words, reducing the number of MPs also reduces the scrutiny of Government by Parliament. So if Government wants its way with respect to the processing of personal data, then do not expect Parliament to protect the individual from the overbearing state. If the Information Commissioner steps out of line, then there again there is a risk that his powers to intervene could be reduced or removed by Ministerial order. Again, do not expect the Government to lose that vote.

These Bills can change the relationship between the individual and the state. Not only are we are “sleepwalking into a surveillance society” (to use the ICO’s popular phrase), we are also watching the Government taking powers to remove the independence of the Information Commissioner and reduce the ability of Parliament to protect that independence if the Information Commissioner were to act against Government in order to protect privacy.

Whether the above effects are deliberate or inadvertent can be argued. What can’t be argued is that the Coalition Government is creating a very dangerous structure that cannot guarantee individual privacy.

Advert: Can I really recommend the following conference (Privacy in the Modern Age) which has two Commissioners and several leading lawyers speaking (http://www.sweetandmaxwell.co.uk/privacy-law-2010/).

The conference will cover: the relationship between privacy and freedom of information, privacy and the internet, the current agenda for privacy, and the challenges of globalisation and new technology. Speakers include Michael Beloff QC (Blackstone Chambers), Tim Pitt-Payne QC (11KBW), Christopher Graham (ICO), Rosemary Jay (Pinsent Masons), Casper Bowden (Microsoft), Dr Ian Brown (Oxford University), Hazel Grant (Bristows), Emma Martins (Jersey Commissioner), Gerry Facenna (Monkton Chambers).

Commissioner plays poker with Google

The Information Commissioner has been widely condemned by privacy activists for his perceived inaction with respect to Google. Although he concluded that it was likely that there was a significant breach of the Data Protection Act when Google Street View cars collected wi-fi data as part of their street mapping exercises, he has rejected calls for his office to impose a monetary penalty. Instead, he has “invited” Google UK to sign an undertaking – something that has yet to happen.

From the privacy lobby’s perspective, the Commissioner has failed miserably. Instead of taking the opportunity to stamp on Google’s feet, he has chosen instead to tickle their toes. These activists claim that Google has been invading privacy for years, it was at the mercy of the Commissioner, a public flogging could be administered by virtue of the Commissioner’s new powers to levy fines, and the Commissioner has bottled out.

Well, I disagree with the above. I think the Commissioner has serious problems with an issuing of a Monetary Penalty Notice as there would be a need for hard evidence of a “substantial and serious” breach of the data protection principles. This would be pretty hard to establish if most of the relevant wi-fi data turns out not to be personal data!

Also to establish the “substantial breach” threshold, you need a lot more than the capture of some incidental email personal data by accident. There are no sensitive personal data involved and what confidential personal data has been captured would also be incidental.  Google have not lost anything and the company is going to get rid of the all the data in question; remember, there is no obligation to do this if the data are not personal data.

In addition, a Monetary Penalty Notice would automatically put the ICO in conflict with Google. Google’s well financed big legal battalions would then be employed to show that the Commissioner was wrong (mainly I suspect because most of the data wasn’t personal data and the breach was not substantial enough) and the legal wrangling would take ages to resolve. The legal fees on this case would eat up all of the £3 million or so legal budget of the ICO and a long stream of appeals to would inevitably follow.

From the ICO’s perspective, imposing a fine on Google over this wi-fi issue is an outcome where there is a great deal of uncertainty. It might obtain plaudits from the privacy lobby, but in practice it gets nowhere fast and could easily turn out to be a futile gesture that would kiss goodbye to much of his legal resources.

Instead, the Commissioner has decided to play poker with Google. He has given the company 21 days to accept the public undertaking which commits it to a voluntary audit of Google’s procedures, to instigate training programmes in security and UK data protection requirements, and to commence privacy by design initiatives. Do you think that the CEO of Google will be keen to put his name to that (so it can be referenced in future, in perpetuity) with the implication that the Company (for all its own pro-privacy propaganda) have not taken some basic steps to protect privacy?

Finally, if Google fail to sign-up, the Commissioner says he will serve an Enforcement Notice. This gives the Commissioner the high moral ground in any further legal action, for if he does take such action – he is only taking action because Google have not signed a voluntary undertaking to do the decent things that most data controllers would do if they claimed to protect privacy.

So, put 24th November in your diary. It is the time when Google has to decide publicly whether to accept the undertaking or force the Commissioner to fight over an Enforcement Notice.

References: Google’s choices – letter from the ICO: Download Google_letter.

Advert: Can I really recommend the following conference which has two Commissioners and several leading lawyers speaking: Download Privacy and the Law Conference 2010. The conference will cover: the relationship between privacy and freedom of information, privacy and the internet, the current agenda for privacy, and the challenges of globalisation and new technology. Speakers include Michael Beloff QC (Blackstone Chambers), Tim Pitt-Payne QC (11KBW), Christopher Graham (ICO), Rosemary Jay (Pinsent Masons), Casper Bowden (Microsoft), Dr Ian Brown (Oxford University), Hazel Grant (Bristows), Emma Martins (Jersey Commissioner), Gerry Facenna (Monkton Chambers).

Shortfalls in the Data Protection Act 1998, identified.

We have just published on the website our response to the Government’s consultation on the Directive. However in our response, we have identified the issues in the context of the Data Protection Act 1998 so readers can see what the main problems are.

1. There should be an extension of the Accessible Records definition to include employment records so that manual information on employees gain full protection from the Act. This would close an obvious loophole at a time when public and private sector organisations are facing difficult economic times and are likely to shed staff.
2. The definition should include the situation where the data subject can provide the identification details that the data controller lacks. This change is relevant to the question of whether or not an IP addresses, URLs etc etc should be treated as personal data and places the data subject in control over his own privacy when using the internet.
3. The definition should be changed to remove all the confusion caused by Durant. This can be done by removing the reference to the text that relates to “opinions” and “intentions”.
4. Re sensitive personal data/biometrics: two Courts have concluded that photographs of data subject are likely to be sensitive personal data as they display racial features (e.g. skin colour). The proposed change ensures that to be sensitive personal data, there has to be a processing objective to reveal something about an individual’s health, race etc. The change is also useful in the determination of whether or not an individual’s biometric is sensitive personal data of not.
5. Re Notification/Accountability Principle: The bureaucracy can be simplified, used far more constructively to promote Codes of Practice, provide more meaningful description of purposes and disclosures to Recipients, and can also be used to regulate an Accountability Principle
6. Re the 1st and 6th Data Protection Principles: the Sixth Principle should be used to explicitly link the Data Protection Act with Article 8 of the Human Rights Act. In this way, the Information Commissioner should be able to use his powers in cases such assessing whether the retention of personal data on a national DNA database is lawful
7. New Powers of the Commissioner. There needs to be a mechanism where the Commissioner can serve an administrative notice (a “Data Protection Practice Notice”) requiring a data controller to take certain steps by a certain time to ensure that any processing of personal data is in accordance with the Act. The data controller has the right of appeal to the Tribunal against the Notice and the data subject has a limited right of appeal to the Tribunal against the ICO’s decision not to serve a Notice. This mechanism is modelled on the FOI Decision Notice regime.
8. New Powers of the Commissioner: The Information Commissioner should have the discretion, subject to appeal to the Tribunal, to be able to recover the costs associated with any Audit or Notice he issues. If we expect the Commissioner to protect individuals, then he should not be financially penalised when he does. In a time of austerity, this is especially important.
9. Re the National Security exemption (Section 28 of the Act). The exemption should be changed to allow a Tribunal to hear the Commissioner’s case if he raises a matter of substantial public interest concerning the application of the national security exemption.
10. Re the merging of Regulators: The Government should explore whether there are savings to be made, and privacy benefits to be gained, in merging the office of the Information Commissioner, Interception of Communications Commissioner, Surveillance Commissioner and the privacy interests of the Human Rights Commission and Financial Services Authority.

References: Changes to the Data Protection Directive 95/46/EC – 2010. The document contains comments on how to improve the Data Protection Act 1998, and provides several references as to how the legislation can be improved without waiting for agreement on a revised form of Directive 95/46/EC  http://www.amberhawk.com/policydoc.asp

 

Shortfalls in the Data Protection Act 1998, identified.

We have just published on the website our response to the Government’s consultation on the Directive. However in our response, we have identified the issues in the context of the Data Protection Act 1998 so readers can see what the main problems are.

1. There should be an extension of the Accessible Records definition to include employment records so that manual information on employees gain full protection from the Act. This would close an obvious loophole at a time when public and private sector organisations are facing difficult economic times and are likely to shed staff.
2. The definition should include the situation where the data subject can provide the identification details that the data controller lacks. This change is relevant to the question of whether or not an IP addresses, URLs etc etc should be treated as personal data and places the data subject in control over his own privacy when using the internet.
3. The definition should be changed to remove all the confusion caused by Durant. This can be done by removing the reference to the text that relates to “opinions” and “intentions”.
4. Re sensitive personal data/biometrics: two Courts have concluded that photographs of data subject are likely to be sensitive personal data as they display racial features (e.g. skin colour). The proposed change ensures that to be sensitive personal data, there has to be a processing objective to reveal something about an individual’s health, race etc. The change is also useful in the determination of whether or not an individual’s biometric is sensitive personal data of not.
5. Re Notification/Accountability Principle: The bureaucracy can be simplified, used far more constructively to promote Codes of Practice, provide more meaningful description of purposes and disclosures to Recipients, and can also be used to regulate an Accountability Principle
6. Re the 1st and 6th Data Protection Principles: the Sixth Principle should be used to explicitly link the Data Protection Act with Article 8 of the Human Rights Act. In this way, the Information Commissioner should be able to use his powers in cases such assessing whether the retention of personal data on a national DNA database is lawful
7. New Powers of the Commissioner. There needs to be a mechanism where the Commissioner can serve an administrative notice (a “Data Protection Practice Notice”) requiring a data controller to take certain steps by a certain time to ensure that any processing of personal data is in accordance with the Act. The data controller has the right of appeal to the Tribunal against the Notice and the data subject has a limited right of appeal to the Tribunal against the ICO’s decision not to serve a Notice. This mechanism is modelled on the FOI Decision Notice regime.
8. New Powers of the Commissioner: The Information Commissioner should have the discretion, subject to appeal to the Tribunal, to be able to recover the costs associated with any Audit or Notice he issues. If we expect the Commissioner to protect individuals, then he should not be financially penalised when he does. In a time of austerity, this is especially important.
9. Re the National Security exemption (Section 28 of the Act). The exemption should be changed to allow a Tribunal to hear the Commissioner’s case if he raises a matter of substantial public interest concerning the application of the national security exemption.
10. Re the merging of Regulators: The Government should explore whether there are savings to be made, and privacy benefits to be gained, in merging the office of the Information Commissioner, Interception of Communications Commissioner, Surveillance Commissioner and the privacy interests of the Human Rights Commission and Financial Services Authority.

References: Changes to the Data Protection Directive 95/46/EC – 2010. The document contains comments on how to improve the Data Protection Act 1998, and provides several references as to how the legislation can be improved without waiting for agreement on a revised form of Directive 95/46/EC  http://www.amberhawk.com/policydoc.asp