Hawktalk

Government approach to any new Data Protection Directive revealed by Minister's speech

As a Friday bonus, I make available the speech by Kenneth Clarke, UK's Cabinet Minister responsible for data protection about the forthcoming data protection changes in the Directive (see references).

In summary, if the EU does not change its tack, the UK will either disagree with the proposed changes or delay matters as it did with Directive 95/46/EC. The UK does not like the inclusion of law enforcement agencies, nor the right to forget, nor most suggested major changes if one is to be honest. The speech does not mention the fact that the European Commission has argued that 40% of the UK’s Data Protection Act is non compliant with the provisions of that Directive.

The following are extracts from the speech:

Keep the broad principles of the existing Directive and better understand the 27 laws we all in our nation states have, rather than setting out to create in detail an additional 28th radically different, and artificial new set of laws.

Let’s “not rewrite our respective statutes and codes from scratch”. 

“The ‘right to be forgotten’ sounds a simple idea. But you don’t need to think about it for long to see it poses all kind of difficulties.”

There is a risk that a new provision will “ impinge on free speech, and to censor information which has been legitimately circulated in the public domain”. 

A whole range of vital services that consumers rely upon critically depend, in turn, on the availability of data. “Without reasonably portable health records for example, it’s hard to see how medical services can operate sensibly. Without appropriately regulated data on credit histories, then loans and mortgages might in future be very limitedly available – and might even only be available to the very wealthy”.

"The Commission has also spoken of plans to revise radically the data protection rules in the area of law enforcement".  The Minister would not have said this if he agreed!

I also think the Government is still in favour of mass data retention and collection (e.g.  Passenger Name Records and the retention of communications data). Kenneth Clarke says: “That’s why the UK also views with caution the Commission’s apparent intention to revise the whole Data Retention Directive. 
 
"A final area of concern raised by the Commission is the question of ‘extra-territoriality’ – which appears to be putting forward the idea that European standards should apply to any firm processing EU citizens’ data anywhere in the world. “ But I do think, as a lawyer, it’s wrong to view the extension of the application of European Union law on a global scale as some simple and unquestioned process.”

"But my fear is that on many of these issues good intentions need to be thought through and, taken too simplistically forward, good intentions could prove counter-productive".

Have a good weekend and bank holiday

References:
Down load Kenneth Clarke’s speech here: Download Kenneth clarke final speech as delivered

Commission’s view of what is wrong with the UK’s implementation of the Data Protection Act; detailed reasons available from references at end of http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html

Advert:

The next DP courses start on July 13 in London. Next Update is October 17th 2011 in London. We have timetabled our Audit, Privacy Impact Assessment, and RIPA courses for September 12th, 13th and 14th in London. Full details on the Amberhawk main site (www.amberhawk.com).

Privacy, the Press and Twitter: some uncomfortable truths

I wrote last Friday’s blog before the weekend’s Twittering events and it is quite clear that the injunction protecting the footballer’s privacy is unsustainable. Clearly barring all of the press from mentioning a name simply is a non-starter (especially as the footballer’s name was chanted by fans at yesterday’s Premier League games).

However, several facts are being missed in the current reporting furore. First is that the Court granted the footballer an injunction because the newspaper concerned was the beneficiary of an unsuccessful blackmail attempt. Then the newspaper concerned arranged photographers to be present at meetings between the woman and footballer as pretence so that it could claim that it stumbled on their relationship by accident.

Additionally, the newspaper concerned provided no evidence of the public interest angle to its story, unlike the footballer who provided medical evidence of the impact on his family and children. And the most likely explanation for the exposure of the footballer's name via Twitter is someone linked (directly or indirectly) to the newspaper caused the detail to be placed in the public domain so other newspapers could report it

That newspaper was “the Sun”. It has the same owner as the “News of the World”, the newspaper at the heart of the phone hacking scandal.  

All the current debate is being reported in a context that assumes newspapers have engaged in honest, decent and lawful behaviour:- ferreting out details, on principle, so to expose some great malfeasance. Such a claim is absolute rubbish. As I said in a previous blog: the more celebrities bonk, the more these newspapers bank.

These are the ignored, uncomfortable truths that should lie at the heart of the current "freedom of the press" debate.

References: my previous blogs (below) will lead to all the legal references you need in relation to this case.

http://amberhawk.typepad.com/amberhawk/2011/05/privacy-press-the-super-injunctions-review-and-anonymous-use-of-twitter.html

http://amberhawk.typepad.com/amberhawk/2011/04/privacy-the-press-press-regulation-and-super-injunctions-more-heat-than-light.html

 

 

Privacy, Press, the super injunctions Review and anonymous use of Twitter

As far as I can see, the Review of the use of super injunctions by a Committee headed by the two senior judges in the UK is: “no change except at the procedural fringe”. The Review more or less throws down the gauntlet to Parliament and states that it has either to change the law, otherwise the Courts will continue onwards as before.

The suggested procedural changes act at the superficial level, shorter periods for super injunctions, more review of their necessity, more openness in judicial procedures, and more involvement in the media in general. But the main message is business as usual.

Twittering on about the first Twitter

The Review did not consider the impact of the social media and the undermining of the secrecy associated with super injunctions. However at the press conference, the Master of the Rolls stated that this was an issue that had yet to be addressed. I gained the impression that he did not like the social media undermining an injunction – the implication being that the Courts might be sympathetic to attempts to find out how secret details first got onto the social media.

So how would I try to identify the “the first Twitterer" in the light of the current super injunction. But before I start, I have no evidence for what follows and the text is pure speculation.

I start from the fact that identifying details of the parties to a secret injunction somehow got onto Twitter. As these were secret, this means that the original Twitterer has to be someone close to the parties to the injunction or someone in the Court or handling Court papers.

That person could be the target of any investigation. Despite what the owners of Twitter have publicly stated, subpoenas that require the release of the identifying details of account owners have been issued and granted by the Courts in the USA. This is one factor that could lead to the identification of Twitterer No. 1. So I would try my luck in the States.

The prime reason that the first Twitterer had for the release of identifying detail was to allow other elements of the media to report the “existence of details” on Twitter. This means there had to be a mechanism for the existence of the first Twitter to be reported to other elements of the media (e.g. contact by phone or some other means to point the other media to look at a certain location). So identification of "Twitterers numbers 2 to 10" is the second lead that could lead to the identification of "Twitterer No. 1".

So where to find that mystery first Twitterer? Well the answer to that question, I suspect, can be found in the speeches of Marcus Tullius Cicero who, in 80B.C. asked a simple question: “Cui bono?”.  In this case, the fact that some details are in the public domain, could allow the actual party to the injunction to present arguments for full detail in the public domain. This is the third lead to the identification of Twitterer No. 1.

I conclude that if social media were to be regularly used by the press in order to get around injunctions, then a reaction from the Court can be expected (e.g. by Court ordering the release of details: this has already occured, see references re Out-law).

(Note added 12hrs after the blog was posted: the BBC News are reporting that the footballer in question has now asked a Court for an order to obtain such details from Twitter).

More about “t.hat footballer super-injunction”

If there is to be no change to the law, then the recent publication of further super injunction details by the judge of the case, becomes very instructive as to the current state of the law. It clarifies in different words (see blog of 27th April) how the main balances are applied. In granting an injunction, Eady J explained in his judgement that:

“I have to consider whether there would be a legitimate public interest in the revelation of this particular information, in so far as it is not already in the public domain, and whether publication would contribute to "a debate of general interest", in the sense conveyed by the European Court of Human Rights in such cases as Von Hannover v Germany (2005) 40 EHRR 1.

This means that Eady J considered:

“Would it (i.e. disclosure to the public) help to achieve some legitimate social purpose, such as the prevention or detection of crime? Or again, echoing the terminology of the Press Complaints Commission Code, would publication in some way prevent the public from being seriously misled?

In general, Eady J says that the Court apply the following balancing tests:

 i) “No one Convention article has as such precedence over another”.

ii) Where conflict arises between rights under Article 8 and Article 10, an "intense focus" is required in the particular circumstances of the case upon the comparative importance of the specific rights being claimed.

iii) The court must take into account the justification put forward for interfering with or restricting each right.

iv) The proportionality test must be applied to each” (Article 8 or Article 10)

In relation to injunctions in general, Eady J makes two important comments:

As in so many “kiss and tell” cases, it seems to me that the answer, at stage two, is not far to seek”. (i.e. it is usually obvious whether there is a public interest in publication or not)

“The courts will have to apply this methodology unless and until Parliament decides to legislate to different effect”.  (This says to Parliament: if you want changes, then make changes – the main message from the just published report).

In the particular case of granting an injunction,  Eady J states that

The newspaper did “not even argued that publication would serve the public interest”

“The evidence before the court at that point, therefore, appeared strongly to suggest that the Claimant was being blackmailed (although that is not how he put it himself”).

The evidence also pointed to entrapment, where meetings between the footballer and the woman were engineered to support the story of a continuing sexual relationship.

The judgment states “It seems, nevertheless, that The Sun was ready to take advantage of these prearranged meetings in order to be able to put forward the claim that it was The Sun which had found him “romping with a busty Big Brother babe”.

Hence Eady J concluded that “On the evidence before me, as at 14 and 20 April, I formed the view that:.

• “the Claimant would be "likely" to obtain a permanent injunction at trial, if the matter goes that far. As I have said, it remains uncontradicted (by the press)”

• “The information is such that he is still entitled to a "reasonable expectation of privacy"

• There was “no countervailing argument has been advanced to suggest that the Article 10 rights of the Defendants, or indeed of anyone else, should prevail”.

• “There is certainly no suggestion of any legitimate public interest in publishing such material”.

My conclusion

This super-injunction's review won’t change the above balancing act. Indeed, any new law enacted by Parliament cannot fundamentally change this balance, unless the UK Government pull out of the European Human Rights Convention. So prepare for a lot of talk and “tut-tutting” from many observers, heads sagely shaken and claims of “we must look at this”. However, I think at the end of the day there will be no change in the law. As I said at the beginning: “business as usual”.

The real risk is that if the press deliberately set out to undermine injunctions by using social media, then the social media could well be on the receiving end of demands for disclosure of identifying details. In other words, undermining the secrecy of an injunction could well undermine the anoniminity of the Internet.

References: 

Further injunction details from J. Eady’s: http://www.bailii.org/ew/cases/EWHC/QB/2011/1232.html;

The important Human Rights case that underpins the UK Court's approach to injunctions:  Von Hannover v Germany http://www.bailii.org/eu/cases/ECHR/2004/294.html

Report into super injunctions (URL at bottom of Press Release) http://www.judiciary.gov.uk/media/media-releases/2011/committee-reports-findings-super-injunctions-20052011

Also relevant is the previous detail I published about the footballer super injunction on 27th April 2011: http://amberhawk.typepad.com/amberhawk/2011/04/privacy-the-press-press-regulation-and-super-injunctions-more-heat-than-light.html

Outlaw's article: "Injunction footballer wants to search journalists' email and text records (from http://www.out-law.com/page-11929)

 

Advert:

FOI courses start in London on 13 June; next DP courses start on July 13 in London. Next Update is October 17th 2011 in London. We have timetabled our Audit, Privacy Impact Assessment, and RIPA courses for September 12th, 13th and 14th in London. Full details on the Amberhawk main site (www.amberhawk.com).  

Privacy: new Government revelations amplify concerns surrounding deficiencies in UK’s Data Protection Act

The Government has been required under Freedom of Information rules to release further details of those protracted infraction proceedings concerning the deficiencies in UK’s Data Protection Act. For the first time, UK citizens can see why the European Commission believes that eighteen of the thirty four Articles in the Data Protection Directive 95/46/EC have not been properly implemented by the UK Government.

The detail that the Government has been forced to release is far more extensive than the Commission’s own truncated explanation (“liberated” after a seven year struggle and published in connection with an earlier blog – see references).  The additional detail revealed by the UK Government raises serious questions as to whether or not the European Commission can be trusted to be transparent (and indeed to follow instructions from the European Ombudsman to become more transparent).

The new revelations show that the Commission has concerns over the definition of “personal data” (which is not limited to Relevant Filing system as was reported in my earlier blog). The Commission point to the absence of a definition of “consent” (used in relation to Schedules 2 to 4) and an important element in the First and Eighth Data Protection Principles. The Act’s “protection” of sensitive personal data (health and criminal) is explicitly mentioned by the Commission as being deficient.

The Commission also think that the use of “vital interests” in Schedules 2 to 4 of the Act is far wider that envisaged by the Directive, and that, in general, there are too many subject access exemptions. The absence of the enforced subject access offence in connection with health personal data and employment is mentioned explicitly.

The Commission also criticise the security obligations outlined in the Seventh Principle; clearly the Commission thinks that the UK’s implementation needs strengthening. The Commission also thinks the UK’s  “fair processing notice” provisions are deficient in general – something that I had not appreciated.

Finally, the Commission state that the transfer of personal data outside the EEA is not supervised sufficiently and that the Commissioner has insufficient powers.

Why 18 Articles are deficient

In further detail, the areas of contention over the Directive are provided below as a quote from the “liberated” material are listed below. Unfortunately the Government refused to explain whether it disagrees with the Commission.

The contentious Articles are:

“Articles 2 and 3 – the definitions of “personal data” and “filing system” and the interpretation in the Durant judgment, which the Commission considered were narrower than required by the Directive.

Articles 2 and 7 – the absence of a definition of “consent” in the Data Protection Act, which the Commission considered was required by the Directive.

Article 3 – the inclusion of “recreational purposes” in the Data Protection Act which, in the Commission’s view appeared to be broader than household activities.

Articles 6 and 28 – the Commission claimed that the ICO failed to take proper regulatory action against employers who sought health information from job applicants.

Article 8 – the Commission raised the issue of whether the Data Protection Act treated data relating to criminal offences differently to other categories of sensitive personal data.
 
Article 8 - the Commission considered that the Data Protection Act appeared to broaden the circumstances in which sensitive personal data could be processed when necessary to protect the vital interests of the data subject

Articles 10 and 11 – concerns the provisions in the Data Protection Act in relation to information to be given to the data subject in cases of both data collection from the data subject and from third parties which appeared to the Commission to fall short of that required by the Directive.  The Commission also considered that the Data Protection Act appeared to exempt from this requirement data which the data controller is obliged to make public.

Article 12 - the Commission considered that the DPA appeared to confer upon the courts a discretion to grant or refuse applications made by data subjects to rectify, or erase inaccurate personal data.

Article 13 – the issue the Commission raised concerns the exemption in the DPA from the right of subject access of the data subject to confidential references.

Article 16 – the Commission considered that the range of exemptions in the Data Protection Act was broader than those permitted under Article 16. (Note: the reference to Article 16 may be wrong as this Article does not relate to exemptions)

Article 17 – in the view of the Commission the obligation on data controllers to implement appropriate technical and organisational measures to protect personal data as set out in the Data Protection Act appeared to be weaker than in the Directive.

Article 22 and 23 – the Commission considered that the Data Protection Act appeared to narrow the scope of non-material damage.

Article 25 and 26 – the Commission raised the issue of the extent to which UK data controllers are monitored by the ICO as to their assessment of adequacy of the level of protection in third countries to which they transferred data and the extent to which the ICO grants authorisations for the transfer of personal data to third countries not providing an adequate level of data protection when the data controller can adduce the existence of data protection safeguards.

Article 28 – the Commission raised the issue of the sufficiency of the investigative powers of the data protection supervisory authority”.

Commentary

For over half a decade (since Durant in December 2004, if we are precise), the UK Government has hidden from Parliament and the UK population, an explanation as to why the Home Office’s implementation of the Data Protection Act 1998 has been accused of being defective implementation of Directive 95/46/EC.

All the statements made to Parliament by a cohort of Home Office Ministers that their mass surveillance proposals (e.g. ID Card database) were compliant with the Data Protection Act (and the Human Rights Act) are now shown to be somewhere between “wholly suspect” and “demonstrably untrue”. It is unimaginable to think that these Ministers did not know that what they told Parliament was at variance with the true position.

For its part, the coalition Government has continued the unabashed policy of secrecy that it inherited from New Labour, so much so, that the “liberation” of details from the UK Government has been accompanied by a flagrant disregard for the timescales normally associated with a Freedom of Information Act request (see references).

The Government has also refused to provide summary details in the same form as the above, to explain why the Government think the Commission is wrong. This decision is misguided as it transforms the public debate about the changes to the Directive to one that is uninformed by the facts.

Why is it uninformed? How can you consider what should be changed when the starting position is not even identified? It’s rather like building a house on foundations which have been secretly moved before the first brick is laid.

References:
To link is a download of the new revelations from the UK Government Download UK deficiency details_may 2011

The Decision Notice showing unacceptable time delays in dealing with the request Download FOI_DN_5029054

The previous Blog (and the less informative European Commission findings) can be accessed on “European Commission explains why UK’s Data Protection Act is deficient”: http://amberhawk.typepad.com/amberhawk/2011/02/european-commission-explains-why-uks-data-protection-act-is-deficient.html

Advert: FOI courses start in London on 13 June. Next Update is October 17th 2011 in London. We have timetabled our Audit, Privacy Impact Assessment, and RIPA courses for September 12th, 13th and 14th in London. Full details on the Amberhawk main site (www.amberhawk.com). Next DP courses in London starts on June 13

Cartoon: with recent data losses in mind

 
                                                         ©Chris Slane

Advert. Forthcoming courses: Data Protection: London from May 10th; Manchester starts on 12th May.    FOI starts in London on 13 June.  Includes ISEB syllabus. Next Update is October 17th 2011 in London. We have timetabled our Audit, Privacy Impact Assessment, and RIPA courses for September 12th, 13th and 14th in London. Full details on the Amberhawk main site (www.amberhawk.com)