Hawktalk

Data Protection: forget about a “right to forget”

Last week, I had a speaking slot at the Westminster Media Forum’s event on “Social media, online privacy and the right to be forgotten”. My comment that the proposed “right to forget won’t work” was widely reported, so I think it is incumbent on me to detail the argument. I also think there is a better way of dealing with this issue through the use of the “right to object” to the processing.

The “right to forget” is very laudable. It means all those useful youthful indiscretions (where one shudders with embarrassment when one remembers them) do not form part of a publicly available record being used, for example, by employers to assess whether to give you a job.

For the current generation, the existence of the likes of Facebook, YouTube, and the mobile phone camera means that every forgettable action can easily be recorded for posterity and subsequently distributed by social networking, posted in blogs or hosted on websites. Everybody, I suspect, has some personal detail they don’t want reminding of; the problem is that the Internet hardly ever forgets once this detail is published.

Hence the idea behind the “right to forget”:  why not get rid of that stuff. If it’s not there, it can’t be accessed, and if it can’t be accessed, it can’t be used. Oh, if only life was that simple!

The first problem is to treat the underlying issue as a privacy problem when it has nothing to do with privacy. Suppose somebody has posted something on a website or distributes personal data to hundreds of Facebook Friends. The personal data have been published – end of story – and if they are published, the genie is out of the bottle. Take Max Mosely for instance – he might win his privacy case at the Human Rights Court, but everybody knows what he did. You can’t “unknow” that which has been published.  So, I think the intellectual idea underpinning the “right to forget” (i.e. that there is some kind of “magic cork” that can compress that genie back into the bottle) is based on a fundamental misconception.

Commissioner Reding, the Commissioner who is supporting the idea, states that one of the reasons why she is promoting the “right to forget” is that she is “a firm believer in the necessity of enhancing individuals’ control over their own data”. All I would say in response is that when the personal data are published or widely distributed, the individual has lost that control; like Humpty Dumpty, you can’t put the pieces back together again. However, as we shall see, although the individual has lost control of the personal data, there is an existing right (the right to object) that can come to the rescue.

Of course, if the personal details are in one place, a “right to forget” might succeed; however, in that case, they have not been widely distributed. If, however, there are several jurisdictions where the personal data are located then it becomes more and more impracticable for the right to be exercised. For instance suppose a Facebook Friend in the USA receives some embarrassing detail which is then shared with his Facebook Friends distributed round the planet. How is a right to object going to work across a number of different jurisdictions?

What then happens in this case if a “right to object”, as exercised, is ignored? Do I complain to the UK Information Commissioner to enforce a right in the USA? That is another reason why I think the “right to forget” is unenforceable; it needs all the world’s privacy regulators and legislators to decide on a common enforcement strategy.  This in itself is going to be very difficult task, because the USA and APEC countries have already decided that once the personal data are in the public domain, then the data protection rules that we take for granted in the UK do not apply (see references, as I have a blog on the GAPP Principles in the USA).

Then there is the “kiss and tell” problem. What can be seen as one individual’s freedom of speech (i.e. telling the world about the kiss) is the other person’s invasion of privacy (i.e. the fact of being kissed should be kept private). Which one of these takes precedent? A “right to forget” has to start from the position that privacy is more valuable than freedom of speech? Personally, I don’t think that this is a safe presumption to start from:  both privacy and freedom of expression are of equal value and which one takes precedence over the other has to depend on the facts of each case.

My own solution to this problem is not to attack where the personal data are posted, or which organisation (e.g. Google) facilitates access to the personal data,  but rather when the personal data are used. For instance, an embarrassing fact might be posted on a USA web-site, but their use in the UK has to be by a data controller. That data controller, through the obtaining of personal data from the USA web-site is processing such personal data for a specific purpose; as that controller is situated in the UK, then the Data Protection Act applies.

Then the data controller has to apply three Data Protection Principles (1^st, 3^rd and 4^th). He has to demonstrate that the personal data are relevant to the purpose (e.g. employment purpose), that they are accurate and up to date (e.g. the personal data relate to the actual individual under examination and not someone who happens to have the same name) and ensure that the data subject knows of their use for a specific purpose.

I would also argue that it is not fair to the data subject to use personal data extracted from, for example, Facebook without explaining in detail what personal data were actually used by the data controller (e.g. by providing a copy of the personal data used).  Any failing in this area can already be enforced by the Commissioner without any change to the current data protection law; a position that should also apply across all European Countries that have based their data protection legislation on Directive 95/46/EC.

The only change in the Directive I would make is to strengthen the existing “right to object” to the processing. This right in the UK is currently restricted to that processing where the data controller has to balance his interests against the interests of the data subject (or where the processing is necessary for the functions of a public authority -  paragraphs 5 and 6 of Schedule 2 if you want to be complete). The right also requires the processing to cause “unwarranted substantial distress” or “unwarranted substantial damage” to the data subject; a requirement which heavily tips the scales in favour of the data controller’s processing (in this case, the ability to use the internet to retrieve personal data about an individual).

The change I would make therefore is to drop the “substantial” element of this threshold test; this means the test of the balance of interests between a data subject’s interest and a data controller’s interest is assessed on a level playing field. I would also apply the “right to object” to those circumstances where the processing is “necessary for a contract with the data subject” or with “a view to entering into a contract with the data subject” (e.g. an employment contract with a prospective employee).

In this way, data controllers can argue that they should be able to scour the internet for background details about an individual but that data subject will be able to argue the exact opposite. This provides a structure where the facts of each case can be independently examined to identify whether the data controller’s or the data subject’s position should prevail. Following such an examination and case-law can then be turned into advice on best practice.

That is why I argue that one should forget about the “right to forget”. It is a nice idea but it does not work. There is a far better alternative that attacks the use of personal data not its hosting, and that alternative is by strengthening the “right to object to the processing”.

References:

"North America’s Generally Accepted Privacy Principles establish an inadequate data protection regime"  (blog of 25/11/10); these Privacy Principles do not apply to public domain personal data. See http://amberhawk.typepad.com/amberhawk/2010/11/north-americas-generally-accepted-privacy-principles-establish-an-inadequate-data-protection-regime.html

“The APEC Privacy Framework and data protection – 2008”; the document explains where the APEC Framework is deficient in terms of the European Data Protection Directive 95/46/EC and this includes public domain personal data). Downloadable from http://www.amberhawk.com/policydoc.asp (link towards the middle of the page)

Advert: Our  UPDATE session, April 11th, Central London: a snip at £195+VAT. Still places available. Automated booking available on www.amberhawk.com. The Programme includes:

1. “What might a new data protection regime look like? What might the main changes be?”; Stephen McCartney, Strategic Liaison Group Manager, ICO
2. "Freedom of Information decisions on the personal data exemption"; Sue Cullen, Amberhawk
3. "Legal Update (Article 8, Enforcement and Data Protection Act)"; Rosemary Jay, Partner, Pinsent Masons
4. "Data Protection from the other end of the telescope: a view from the data processor (including the cloud)”; Louise Townsend, Accenture, Data Privacy Officer (UK and Ireland), Legal Counsel
5. "What’s new from the ICO’s website"; Sue Cullen, Amberhawk
6. "What’s new re Undertakings, Audit and Assessment" and "News Roundup"; Dr. Chris Pounder, Amberhawk

 

The confidentiality of personal data in the Census 2011 is not guaranteed

Like you, I have received my 2011 census form from the Office of National Statistics (ONS). The cover page prominently states, in bold, “Your personal information is protected by law. Census information is kept confidential for 100 years”. Like you, perhaps, I have taken this statement at face value.

However, preparing for our Privacy Impact Assessment (PIA) course, I came across the PIA for the Census (see references). Under the heading “Keeping census records confidential”, the Census PIA states that “Other than for the purposes of conducting the census and in the circumstances set out in Section 39 of the Statistics and Registration Service Act 2007, it is unlawful for any member or employee of the UK Statistic Authority (which includes any member or employee of ONS) or any person who has received personal information directly or indirectly from the Authority, to disclosure such information” (paragraph 12.6.1).

The ONS web-site has a “Commitment to confidentiality and data security” which says something similar: it says “All employees of both ONS and any appointed contractors working with Census data are bound by Regulations made under the 1920 Census Act and the confidentiality provisions of the Statistics and Registration Service Act 2007 (SRSA)”.

So, unlike the absolute “confidentiality” statement on the census form itself, the web-site and PIA “confidentiality” reference is qualified by a reference to legislation dated 2007; a year when the then New Labour Government was highly addicted to its unnecessary mass surveillance legislation. To abuse M&S’s well known advertising campaign slogan one has to consider whether “this is not just confidentiality, this is New Labour confidentiality”.

Section 39 of the Statistics and Registration Service Act 2007 is, so the Act says, about “Confidentiality of personal information”; in practice the section achieves the precise opposite. Section 39(1) begins well enough; it states that “Subject to this section, personal information held by the Board in relation to the exercise of any of its functions must not be disclosed by (a) any member or employee of the Board, (b) a member of any committee of the Board, or (c) any other person who has received it directly or indirectly from the Board”.

However, Section 39(4) then states that the disclosure prohibition in section 39(1) “does not apply to a disclosure which” (take a deep breath):

“(a) is required or permitted by any enactment,

(b) is required by a Community obligation,

(c) is necessary for the purpose of enabling or assisting the Board to exercise any of its functions,

(d) has already lawfully been made available to the public,

(e) is made in pursuance of an order of a court,

(f) is made for the purposes of a criminal investigation or criminal proceedings (whether or not in the United Kingdom),

(g) is made, in the interests of national security, to an Intelligence Service,

(h) is made with the consent of the person to whom it relates, or

(i) is made to an approved researcher”.

Section 39(4) therefore possesses all the hallmarks of New Labour’s disdain for personal privacy. It is not a clause to protect confidentiality; it is a clause to remove that confidentiality.

I should add that the national security paragraph (i.e. section 39(4)(g)) was removed a year later by Schedule 1 of the Counter-Terrorism Act 2008. It was replaced by a provision to provided unfettered access to a full copy of the Electoral Register whenever any of the national security agencies wants a full copy.

Can we reflect on this for a second? The idea behind section 39(4)(g) was for Census officials to promise Census confidentiality and at the same time register the UK population with the national security agencies. The replacement idea is for citizens to register for a vote and also register an entry in a Security Service database. There has been no public debate about such mass surveillance, and as far as I can see, this data acquisition has little to do with terrorism. After all, those individuals intent on undermining a Parliamentary democracy are unlikely to want to vote in one.

Note also that in relation to disclosures in connection with crime, the threshold test adopted by Section 39(4)(f) is not the Data Protection test of “failure to disclose” causing “prejudice” to criminal investigation (see Section 29 of the DPA). Instead the New Labour threshold was reduced to any disclosure made for a criminal investigation.

In relation to an “approved” researcher (the last in the Section 39(4) list), the Board has from “time to time to publish criteria by reference to which it will determine whether to grant access” to an approved researcher.  Note that this means that there is no obligation for the Board to publish any criteria relating any other recipient in the Section 39(4) list. This in turn means that details about ONS disclosures subject to section 39(4)(a)-(h) can be kept conveniently out of the public gaze as there is no obligation to publish criteria for access.

It is interesting to note that in 2009, the Department responsible for Education was not keen on Section 39(4) when it wanted to disclose pupil personal data to the ONS. So, in the “Statistics and Registration Service Act 2007 (Disclosure of Pupil Information) (England) Regulations 2009”, the Department changed the law to permit the disclosure of personal data about school pupils to the ONS, but also excluded any further disclosure by the ONS for purposes identified in paragraphs 39(4)(d) and 39(4)(f) to 39(4)(h). In particular, the Regulations made any national security and crime disclosure unlawful.

If one Department of State discovers it cannot stomach the broad reach of section 39(4) disclosures, I cannot see why those who complete the Census forms in a fortnight’s time cannot be similarly protected.

No doubt ONS officials will vociferously state that there will be no such disclosure and that confidentiality is an absolute. This is technically correct as they can argue that the fact that Section 39(4) has disclosure provisions does not mean the Census personal data will actually be disclosed. However, it is also very clear that personal census information can be disclosed, with a considerable degree of secrecy, almost at the whim of ONS senior managers.  And it is the existence of this possibility which is, quite frankly, unacceptable.

Ministers, if they want, can easily clarify the relationship between Section 39(4) disclosures and the personal details collected in the Census. Indeed, the "Protection of Freedoms Bill" (see previous blogs), currently under debate in Parliament, provides a vehicle to table an amendment that absolutely protects the Census personal details from such disclosures.

Any failure to make this necessary legislative change, or to make a statement concerning the application of section 39(4), provides evidence that the Government are not prepared to commit itself to ensuring the confidentiality of the 2011 Census. In which case, the promise that “Your personal information is protected by law. Census information is kept confidential for 100 years” is worthless.

References:

PIA for the 2011 Census is available here:Download Census_pia-final-version

Blogs containing comments about the "Protection of Freedoms Bill"

ICO evidence identifies data protection concerns over Freedoms Bill, 3rd March 2011,  http://amberhawk.typepad.com/amberhawk/2011/03/ico-evidence-identifies-data-protection-concerns-over-freedoms-bill.html : RIPA changes in Freedoms Bill: negligible improvement in privacy protection, 16th March 2011,  http://amberhawk.typepad.com/amberhawk/2011/03/ripa-changes-in-freedoms-bill-negligible-improvement-in-privacy-protection.html : Protection of Freedoms Bill promotes efficient CCTV surveillance not effective privacy, 16 February 2011:  http://amberhawk.typepad.com/amberhawk/2011/02/protection-of-freedoms-bill-promotes-efficient-cctv-surveillance-not-effective-privacy.html

Advert: Our  UPDATE session, April 11th, Central London: a snip at £195+VAT. Automated booking available on www.amberhawk.com. The Programme includes:

1. “What might a new data protection regime look like? What might the main changes be?”; Stephen McCartney, Strategic Liaison Group Manager, ICO
2. "Freedom of Information decisions on the personal data exemption"; Sue Cullen, Amberhawk
3. "Legal Update (Article 8, Enforcement and Data Protection Act)"; Rosemary Jay, Partner, Pinsent Masons
4. "Data Protection from the other end of the telescope: a view from the data processor (including the cloud)”; Louise Townsend, Accenture, Data Privacy Officer (UK and Ireland), Legal Counsel
5. "What’s new from the ICO’s website"; Sue Cullen, Amberhawk
6. "What’s new re Undertakings, Audit and Assessment" and "News Roundup"; Dr. Chris Pounder, Amberhawk

 

Catoon to celebrate the Internet

                                                                                           ©Chris Slane

Advert:  UPDATE session, April 11th, Central London: a snip at £195+VAT. Automated booking available on www.amberhawk.com

Programme

“What might a new data protection regime look like? What might the main changes be?”; Stephen McCartney, Strategic Liaison Group Manager, ICO

"Freedom of Information decisions on the personal data exemption"; Sue Cullen, Amberhawk

"Legal Update (Article 8, Enforcement and Data Protection Act)"; Rosemary Jay, Partner, Pinsent Masons

"Data Protection from the other end of the telescope: a view from the data processor (including the cloud)”; Louise Townsend, Accenture, Data Privacy Officer (UK and Ireland), Legal Counsel

"What’s new from the ICO’s website"; Sue Cullen, Amberhawk

"What’s new re Undertakings, Audit and Assessment" and "News Roundup"; Dr. Chris Pounder, Amberhawk

RIPA changes in Freedoms Bill: negligible improvement in privacy protection

The “Protection of Freedoms Bill” has a wholly misleading title; the legislation simply does not do what it says on the tin.  The CCTV provisions (see blog of 16/2/2011) have more to do with efficient surveillance rather than privacy protection, and in my last blog (3/3/2011), I reviewed the Information Commissioner’s concerns re the use of personal data in DNA profiling or in vetting.

For completeness, this blog addresses the additional privacy protection afforded by the proposed changes to the Regulation of Investigatory Powers (RIPA) Act.  Although welcome, they are really very inconsequential.

This is because, the changes are limited to Local Authorities who hardly use RIPA powers; for other bodies (e.g. those that report to the Home Office), RIPA is left unfettered. In addition, the changes do not stop Local Authorities using RIPA powers; instead of self-authorising their application, Local Authorities have to seek judicial authority to commence using them.

In other words, the changes have little impact on the real privacy issues surrounding RIPA. And the best way to demonstrate this minimal impact is to let the statistics published in the latest Annual Reports of the Surveillance Commissioner and the Interception of Communications Commissioner speak for themselves. (Both these Annual Reports can be downloaded:–  see the links in the references below).

The changes with respect to CHIS

In relation to CHIS (the recruitment of Covert Human Intelligence Sources), the Surveillance Commissioner states that “there were 5,320 CHIS recruited by law enforcement agencies during the year” whilst all “other public authorities recruited 229 CHIS” where “just over half of CHIS usage was by government departments”. In other words, in relation to CHIS, Local Authorities have recruited a maximum of 115 CHIS (half of 229), and this represents just over 2% of the total CHIS recruited (there are 5,549 CHIS recruited per year).

In fact the Commissioner reports “the light use of RIPA/RIP(S)A powers by local authorities is even more pronounced in relation to CHIS recruitment. 97% recruited five or fewer and 86% did not use CHIS”.  As there are about 440 Local Authorities in total, it follows that if 86% do not use CHIS, then there are only 62 Local Authorities that do use CHIS (i.e. 14% of 440).

If there are 115 CHIS recruited by these 62 Local Authorities, then the Freedom Bill’s requirement to seek judicial authority to use CHIS, is going to happen on average less than twice a year per Authority. Compare this 2 per year statistic with the fact that “5,549 CHIS recruited in total per year”.

The Freedom Bill’s CHIS changes have inconsequential impact on privacy protection because from each local authority’s perspective, they focus on 0.036% of the total number of CHIS recruitment per year.

The changes with respect to Directed Surveillance

In relation to directed surveillance, the Surveillance Commissioner reports that “Law enforcement agencies granted 15,285 directed surveillance authorisations during 2009-2010”. In relation to other public authorities 8,477 directed surveillance authorisations were granted during the year” of which “50% were by government departments”. This means there are a total of 23,762 directed surveillance authorisations per year.

The Surveillance Commissioner also reports that “Generally speaking, local authorities use RIPA/RIP(S)A powers sparingly with over 50% granting five or fewer directed surveillance authorisations during the reporting period. Some 16% granted none at all”. So if we use these figures (and go through the same kind of analysis as for CHIS), then 84% of Local Authorities (i.e. about 378 Local Authorities) use directed surveillance and the maximum number of directed surveillance authorisations by all Local Authorities per year is about 4,240 (half of 8,477).

Although you can argue that 18% of the total number of directed surveillance operations are undertaken by Local Authorities as a whole, this figure is an over simplistic statistic and does not provide a complete picture. For instance, it fails to take into account that there are 378 Authorities undertaking such surveillance.

If you work out the average Local Authority use of RIPA directed surveillance powers (4,240 divided by 378), then you see that each Authority commences 11.2 directed surveillance operations per year (1 per month would be above average). This one per month average for each Authority can then be compared with the 1980 authorisations per month (the total number of 23,762 authorisations per year divided by 12).

From the perspective of each Local Authority, therefore, the Government is legislating with respect to an issue that represents 1 in 1980 (or 0.05%) of the total authorisations per month. This 0.05% figure hardly represents a significant change in the level of privacy protection with directed surveillance.

The changes with respect of Communications Data

No local authority has the power to intercept a telephone call or any other form of communication during the course of its transmission, and the only change in the Freedoms Bill relates to Local Authority collection of communications data. (Communications data are those data that relate to who has called whom, when, for how long and from what location but not the content of that communication).

The Interception Commissioner’s Annual Report notes that “During the year ended 31 December, 2009, public authorities as a whole, made 525,130 requests for communications data to Communication Service Providers and Internet Service Providers”(i.e. there are 43, 761 requests per month).

The Commissioner then notes that that “during the period covered by this report 131 local authorities notified me that they had made use of their powers to acquire communications data, and this is slightly more than last year”. The Commissioner records that Local Authorities made “a total of 1,756 requests ... for communications data and the vast majority were for basic subscriber information”. So before we do any analysis, Local Authorities collectively only account for 0.33% of the total number of requests for communications data.

If 131 Local Authorities make 1,756 requests per year, then this works out a Local Authority average of 13.4 per year (i.e. the average Local Authority is making just over 1 request per month – actual figure is 1.1).  This figure of 1.1 per month should be compared with the 43,761 requests per month for all of the public sector.

From which we deduce that from the perspective of each Local Authority, the provisions in the Freedom Bill will impact on 0.0025% of  the total of number of times communications data are used.  In this case, to describe the enhanced privacy protection as “inconsequential” is really a gross overstatement of the improvement in protection.

Concluding comment

In each case, the analysis shows that each Local Authority represents 0.05% or less of the actual RIPA activity; 99.95% of RIPA activity is therefore unaffected. Quite simply, there is no significant change to privacy protection.

One cannot help but conclude that this part of the Freedoms Bill has focused on Local Authorities because it diverts attention from other areas of RIPA. Local Authorities (thanks the Poole Council one suspects – see references) are the new “sitting ducks” for Government rhetoric.

However, two important questions are not being asked – and which should be:

1. Why is it that judicial authority is required by a Local Authority, but not say, the other Government Departments that also infrequently use RIPA powers?

2. Why is it that the use of these powers are to become subject to judicial authority for just Local Authorities, when it would reassure the public that all RIPA powers exercised properly by any public authority, if all authorities were subject to judicial authority? After all, all RIPA powers are very invasive of individual privacy.

When you look at the above (and the conclusions found in my other two blogs on this Bill) there is only one conclusion: the changes represent only a very thin veneer of additional privacy protection. However, be grateful for small mercies but recognise that they are very small indeed.

References

The Annual Report of the Surveillance Commissioner: Download Annual Report_Surveillance Comms.

The Annual Report of the Interception of Communications Commissioner: Download Annual Report_Interception of Comms

Relevant blogs:

1.  "ICO evidence identifies data protection concerns over Freedoms Bill", (3rd March 2011), on http://amberhawk.typepad.com/amberhawk/2011/03/ico-evidence-identifies-data-protection-concerns-over-freedoms-bill.html

2.  “Protection of Freedoms Bill promotes efficient CCTV surveillance not effective privacy”, (16 Feb, 2011), on http://amberhawk.typepad.com/amberhawk/2011/02/protection-of-freedoms-bill-promotes-efficient-cctv-surveillance-not-effective-privacy.html

3.  "Swimming in the surveillance Poole: the real privacy problems with RIPA", (Aug 9, 2010), on http://amberhawk.typepad.com/amberhawk/2010/08/swimming-in-the-surveillance-poole-the-real-privacy-problems-with-ripa.html

Adverts re Data Protection courses

We are also running a Privacy Impact Assessment course and a Data Protection Audit course in London, on 21st and 23rd March (£400 for the day+VAT).  Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip). Details from the Amberhawk website (www.amberhawk.com).

 

ICO evidence identifies data protection concerns over Freedoms Bill

The Information Commissioner (ICO) has just published a critique of the Home Office’s Freedoms Bill, which is being sold to the public as reining-in New Labour’s surveillance state. This blog reports on this critique (for a copy, see references). Although there is general applause for the fact that the Government has recognised that there has been excessive intrusion into privacy, the ICO’s analysis points to a number of serious deficiencies.

I report most of these difficulties mainly in the Commissioner’s own words; they need little in the way of further explanation.

The Information Commissioner notes that the Freedoms Bill creates two further Commissioners in relation to CCTV and DNA with the result that “there is potential for confusion between some the provisions of this Bill and legislation within the Information Commissioner’s regulatory competence”. This is because “there is potential for overlap between the roles and functions of the Information Commissioner and others set out in the in the Bill”.

The ICO adds “On other points, there is a lack of detail and potential for confusion over the substance of the Bill itself” noting wryly that “some of these provisions may have benefited from more detailed consultation with the Information Commissioner during their development to ensure greater clarity from the outset”.

Not consulting with the ICO when planning new legislation (e.g. over ID Cards, data retention) was standard Home Office practice in the New Labour era. Nothing new here then!

The DNA changes

The Commissioner “is concerned that although there is provision to delete fingerprints and DNA profiles there does not appear to be a provision to delete the allied biographical information, as in the arrest record, contained on either Police National Computer (PNC) or Police National Database (PND)”.

This is because “the very existence of a PNC identity record created as a result of a biometric sample being taken on arrest could prejudice the interests of the individual to whom it relates by creating inaccurate assumptions about his or her criminal past when that record is accessed”.

“The Information Commissioner believes that there is no justification for the police to continue to retain a PNC identity record which is linked to other biometric records that the police are required to delete having served their purpose”.

The Commissioner is also concerned “that there is no facility available for individuals to request deletion of their DNA and fingerprints”.

In relation to the National DNA Database Strategy Board that governs the use of DNA, the ICO notes that “there are other interests (to be) reflected in the composition of the Board rather than just comprising of representatives of the law enforcement community”. This is a stark warning that DNA governance could well be dictated by the needs of the law-enforcement community under the supervision of the Home Office.

All I add is a simple comment: “well this is exactly what one would expect the Home Office to do!”.

The CCTV changes

In relation to the regulation of CCTV and other surveillance camera technology, the Information Commissioner “is keen to ensure the provisions of the code are consistent with and complement existing data protection safeguards and do not lead to any confusion over what regulatory requirements apply in practice”.

The Information Commissioner is concerned that “only the police and local government will be obliged to follow the proposed (CCTV statutory) code, at least initially. This could cause problems in practice given the many partnership arrangements between the public and private sectors for town centre monitoring” (i.e. these joint systems could be beyond the reach of the statutory Code).

He notes “There is also widespread use of CCTV and ANPR systems across all sectors including government agencies and increasing deployment of ANPR in the private sector such as with car park operation, where sometimes details of people’s vehicle movements are stored indefinitely and insufficient safeguards are in place regarding security, access and further use”.

He adds for good measure that “There is no mechanism in the Bill for direct enforcement of the code or for dealing with individual complaints about non compliance with the code”.

His general conclusion is “there is a risk that regulation becomes fragmentary, confusing and contradictory, especially if commissioners take different approaches”.

In summary, the ICO’s critique confirms much of what I said in my blog of 16/02/2011 (“Protection of Freedoms Bill promotes efficient CCTV surveillance not effective privacy”).

The criminal record changes

In relation to criminal conviction data used in vetting, the Commissioner is concerned about “the increased flow of personal data that will undoubtedly result from the provisions in this Bill” and that “increased data flows generally mean increased data protection risks”.

In particular the Commissioner states that “there does not appear to be any specific provisions to:

• filter to remove old and minor conviction information from criminal records checks;

• ensure penalties and sanctions for employers knowingly making unlawful criminal records checks are rigorously enforced; or

• to introduce basic level criminal record checks in England and Wales”.

In general, the Commissioner believes that “The onus should not be on the individual to disclose old or minor conviction information to a potential employer where it is irrelevant and excessive in relation to the job role”. He adds that that “the introduction of basic disclosures would provide a more privacy friendly and proportionate way of providing prospective employers with unspent conviction information, or confirmation that there is no such information, with important safeguards in place”.

The “Basic Disclosure” (or more accurately, the disclosure of a “criminal conviction certificate”) forms part of the Police Act 1997 is supposed to be the procedure where organisations can look at an individual’s convictions that are unspent in terms of Rehabilitation of Offenders legislation. It is supposed to work by allowing an individual to obtain his own Certificate which then can be shown to anybody via that individual’s consent.

After 13 years of trying, the Criminal Record Bureau have not been able to deliver the Basic Disclosure of criminal data to individuals. For all of this time, the operation of the Criminal Records Bureau was (and still is) a Home Office responsibility. No explanation has been given as to the difficulties of commencing a Basic Disclosure.

The Commission warns that if the Basic Disclosure is not implemented “the scaling back of the Vetting and Barring Scheme could lead to an increase in ‘enforced subject access’” where “bodies who will have been able to undertake criminal records checks may not be able to now and these bodies could potentially require the individual to make a subject access request to obtain that conviction information”.

I should add that the many Embassies currently use Enforced Subject Access in their emigration or visa application processes. The Home Office is fully aware that the commencement of the offence the Commissioner wants could interfere with the practices now endemically employed by these Embassies. That is a major reason as to why it hasn’t happened.

The Commission concludes that “Without the introduction of sanctions to deal with enforced subject access the criminal record disclosure regime will continue to be undermined”. My own conclusion is not so generous: this undermining is precisely what the Home Office has tolerated since 1997.

Offences related to homosexuality

The Commissioner is also concerned about the “disregarding of certain convictions for buggery” where criminal offences relating to homosexuality are to be “deleted” (don’t cheer – read what follows!).

The reason for the absence of any cheering is that the ICO complains about the Alice in Wonderland use of the word “delete”, where this word is used to mean the precise opposite. In this case a definition of “delete” which actually means “retain”.

The Commission notes that “delete” is defined in the Bill as “recording the fact the conviction or caution is disregarded and the effect of it being such a conviction or caution”. Note that the chief police officer thus does not “delete” these sensitive personal data, but rather he retains the details of all these convictions and cautions but “disregards” them as if they did not exist.

So when the Secretary of State claims that “these personal data should be deleted”, what in practice happens is that these data are retained on police records. This is classic Home Office drafting – worthy of a literary prize in my view.

The Commissioner then adds that despite the bizarre definition of “delete”, “...all of these convictions or cautions should be disregarded automatically rather than relying on the person who was convicted, or cautioned, to make an application to the Secretary of State”.

To do otherwise would mean “Police Forces should not be holding irrelevant or excessive personal data about individuals” and “If information relating to these offences is no longer relevant it should not be retained”. In other words, the current provisions would legitimise what in normal terms would be a breach of two Data Protection Principles (Third and Fifth).

The change to the ICO’s data protection function

Finally the Commissioner is concerned the term of his appointment is reduced to one of five years whilst “all the previous post-holders have had their initial five year terms extended to varying degrees and this has helped ensure continuity in the work of the Information Commissioner’s Office”.

I agree with this position. A five year term for a Commissioner means that by the time a new Commissioner gets into the job properly and begins to develop some long term approach to information rights regulation, his term of office would be half way through and he would be a lame duck.

I am very confident that if certain public authorities (no names but one of them begins with “H”) do not like what one Commissioner was doing, they could easily delay matters so that the issue would become the responsibility of a new Commissioner, possibly one “more understanding”. That is why the Commissioner recommends the Canadian approach where “the federal commissioner is appointed for a seven year term”.

Although New Labour’s surveillance state is being reduced, all is not what it seems. In my view, the Commissioner’s analysis demonstrates the fundamental contradiction that arises when the Government Department responsible for the expansion of that surveillance state is tasked with designing safeguards to produce a restricted version.

In summary, the Home Office prime function is to give the law enforcement agencies what they need; it’s function is not to protect the privacy of individuals. And that is why this Bill shows all the defects the Commissioner has identified.

References

The Freedoms Bill evidence is available here: Download Ico evidence freedoms bill.

An Apology

In the last blog, I said I would reveal details of the FOI elements of the infraction proceedings (which I think is the enduring legacy of the request). It just so happens that I have learnt that the Information Commissioner is close to deciding whether to issue a Decision Notice to the Ministry of Justice requiring them to reveal more information about the Infraction proceedings. To avoid “infraction overload”, I am delaying that blog for a week or so.

Adverts re Data Protection courses

Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip).

We are also running a Privacy Impact Assessment Course, a RIPA course and a Data Protection Audit course on consecutive dates (In London, on 21st to 23rd March). Details from the Amberhawk website (www.amberhawk.com)