Hawktalk

Could Mr Gove’s emails breach the Data Protection Act as well as Freedom of Information?

Does the use of Gmail or Hotmail by a Minister's Private Office (in order to evade Freedom of Information (FOI) obligations) also lead to breaches in the Data Protection Act? Well, I can see how this could be the case.

The press has raised this issue only in the context of FOI. Yesterday's Sunday Times, for example, noted that the allegations facing Michael Gove and his special adviser, Dominic Cummings, were that by using personal email accounts, they were assuming that any requested information could not be held by a public authority and therefore not subject to a FOI regime.

A spokesman for the Department for Education (DfE) has told the press that "The Cabinet Office is clear that private email accounts do not fall within the FOI Act and are not searchable by civil servants. Neither the Secretary of State nor special advisers have been asked to disclose emails sent from private accounts".

The DfE spokesman then added: "the Permanent Secretary is satisfied that ministers and special advisers act within the law". Despite this, the Information Commissioner has entered the fray and has said that private account emails discussing Government business could be subject to FOI requests.

Whether these emails are, or are not, subject to FOIA will no doubt be resolved in the near future. However, what I am certain about is that all these emails contain some personal data (even if the personal data is limited to email addresses) and these emails are regulated by the Data Protection Act.

Mr Gove, the Sunday Times reports, uses the username of “Mrs Blurt” in his emails. However, suppose the advisor (Dominic Cummings perhaps using the name of “Mr Blurt”) sends an email to “Mrs Blurt” or vice-versa. Now further suppose that email says the following: “Can we talk to the Whips to make sure that Joe Bloggs MP does not get on the Standing Committee that is scrutinising the Education Bill?”. (This kind of exclusion happens as MPs are usually selected for Committees by the Whips on the basis the less troublesome they are, the easier it is for Government business to get through).

Perhaps another email might go: “I have just had a meeting from Head Teacher X who publicly asked some very awkward questions about our education reforms. Just in case there are ‘future complications’ , I recommend that this head teacher’s school should not be in the first wave of schools that get compulsory Academy status?”.

Could these be the sort of emails that a special advisor could send to a Minister – especially if they think the FOI regime does not apply? Well I think this is distinctly possible.

First data protection question: are these emails personal data? I think we can say:  “obviously yes”. There are four data subjects: Mr Gove, Dominic Cummings (i.e. “Mr and Mrs Blurt”) and the MP or Head Teacher X. Who is the data controller? Well if it is not the Department for Education (remember, the claim is that the emails are exempt from FOIA) then it has to be Mr Gove and possibly Mr Cummings as well.

Does the personal data fall into the domestic purpose exemption in Section 36 of the DPA? Well, if there are emails that have the content described above, I suggest that this exemption is inapplicable. Do the emails impact on the MP and Head Teacher mentioned in them, so much so that they should be informed about the processing purpose via the fair processing rules? Well, I can’t see an exemption from this obligation.

Michael Gove, as an MP, has a register entry that describes his constituency casework for the purpose of “the carrying out of casework on behalf of individual constituents”. Any “personal emails” about an MP or head teacher as postulated above have nothing to do with this purpose as the data subjects are not constituents. Dominic Cummings, as of today, is not registered at all.

So we have one, possibly two data controllers, likely to be processing personal data in breach of the data protection principles:- one for an unregistered purpose and the other just, plain simple unregistered. Not only could we have FOI evasion but we are also likely to have DP evasion in addition. This means that Mr Gove has gone one better than Tony Blair: Mr Blair only disapproves of FOI.

So if the Information Commissioner finds resistance to his FOI enforcement powers, perhaps he should put his data protection hat on. After all, I think the data protection arguments are sound and failure to comply with the Commissioner's data protection powers can be a criminal offence (unlike with FOIA).!

Update and courses

This October/November, we have data protection courses in Leeds, London and Edinburgh and an FOI course in London: full details on the Amberhawk website.

Next Update is October 17th 2011 in London. The guest speaker is Kuan Ho: "Every Cloud has a Data Protection Lining"; Rosemary Jay, from Hunton and Williams will be analysing the data protection fallout of the hacking affair. Sue Cullen and myself will be delivering updates on the usual "what's new" matters (e.g. enforcement, undertakings, FOI/DP interface and news roundup). £195+VAT per place: full details on the Amberhawk website (www.amberhawk.com).

Information Commissioner criticises the Data Protection and Freedom of Information regimes

I have just read the uncorrected transcript of the Information Commissioner’s (IC) evidence to MPs last week. There are several other important points which have been largely unreported; hence this blog.

As well as the custodial section 55 offence (see last week’s blog), the IC wants a strengthened offence in the Freedom of Information Act (FOIA). He also has serious doubts as to whether the changes in the Freedoms Bill (e.g. to CCTV, DNA, criminal record disclosure) will actually deliver enhanced privacy benefits. Finally, the ICO wants more independence and a more flexible approach to the funding his office.

The IC would like to see attention given to section 77 offence in FOIA. This section creates an offence if anyone tampers with information that is subject to a request under the Act (or obstructs that request). The section also extends the offence to include tampering with personal data that has been requested via subject access procedures. (Note: this offence only applies to data controllers that are also public authorities).

The problem is that the s.77 offence is triable only in the Magistrate's Court. However, under section 127(1) of the Magistrates Court Act 1980, proceedings for all such offences must be brought within 6 months of the offence occurring. Given that before the Commissioner considers the offence, there has to be a request to a public authority, a refusal and an internal review, then by the time the ICO looks at the matter in detail, the six-month deadline is often well passed.

In practice therefore, this offence is not an offence. That is why the IC told MPs: “instead of being an offence that is prosecuted in the Magistrate’s Court, it ought to be an offence that is prosecutable either way in the Magistrate’s Court or the Crown Court”.

Criminalising those who deliberately set out to evade FOI responsibilities and ignore FOI requests will get nowhere; especially if the idea is mooted with emailing Ministers such as Mr. Gove, Secretary of State for Education.

In relation to the Protection of Freedoms Bill, the IC points out that the initial enthusiasm of Government to curb the intrusion into privacy has faltered somewhat. He says:

• “We have concerns over the DNA regime where it relates to innocent people or people who are no longer of interest to the police, where it is proving very difficult to get a solution that ensures that the record on the police national computer also gets deleted.”

• “I have concerns around CCTV and automatic number plate recognition, where the consistency and comprehensiveness of the approach are concerns. I don’t see how it runs alongside the Information Commissioner’s code for CCTV. It is a regime that will apply not to every sector in England and Wales and so on”.

• “I am concerned that the proposals on criminal records disclosure don’t really seem to be taking into account the recommendations of the expert adviser who produced the report “A Balanced Approach”. The approach seems to be anything but balanced.”

The IC added that he was “still hoping that we will get a better solution for filtering out old and minor convictions from employer vetting checks” and that “it was absolutely vital that we get progress on what we call enforced subject access”. This latter offence in the Police Act 1997 has been available to be commenced by Home Secretaries for over a decade.

The IC is also concerned about “spamming texts” when they say something like “Our records show that you are in line for a compensation payment of £4,750 for that accident you had. Text CLAIM or STOP".  The problem is, the IC said, was that “if you text either, you are confirming that you are there and providing a marketing lead, because these are randomly generated texts”. 

The IC added that “We are working very hard with OFCOM and the telecom companies to try to get to the source of these spam texts, but it is a bit like looking for the launch sites of V2 bombers in the Second World War”. I don’t buy this explanation at all: telecom companies that do not know who is using their network. Come off it – they charge for texts don't they?

The IC stated that the illegal trade in personal data was a practice “that could apply to insurance companies, garages, car hire companies and towing companies” because “all appear to be sources of information, usually paid for by the claims management companies who collect the information”.

Then the IC ironically added that “We are trying to find out from the Association of British Insurers what they have to say about that, and frankly they are not being very helpful at the moment”. In addition “We have invited a number of insurance companies to undergo voluntary auditing and, surprise, surprise, they are not interested”.  My take on this is as follows: if the IC cannot “invite” data controllers in the insurance sector to discuss this issue, the only option open will be to enforce the Act as soon as there are any reasonable grounds of suspicion. So don't be surprised if that happens.

The IC wants more independence from Government.  He said that “my problem, if it is a problem, is, if I am not seen as an officer of Parliament, reporting directly to Parliament, I have to negotiate my way through with many other Departments of State. ... I have to get a tick on anything I propose to do”. The Government is expected to publish a document about the independence of the IC in the very near future.

The IC also highlighted “the unsatisfactory nature of the hybrid funding that funds the IC with three quarters of the money coming from notification fees for data protection and a quarter coming from grant in aid for freedom of information”.  He complained that his office “spending far too much of my time trying to work out apportionment of costs between FOI and DPA in order to keep the National Audit Office happy” and he “cannot treat information rights as the seamless project that it is”.

Another way of seeing this is that he wants private sector data controllers fund his role as a public sector FOI regulator. I can’t see this happening. However, having a separate and larger registration fee for public authorities (i.e. above the current £500 maximum) could work.

Finally, the IC was asked:”what was at the top of his wish list”. The IC responded that it was “implementation of sections 77 and 78 of the 2008 Criminal Justice and Immigration Act” and the custodial section 55 offences. That was discussed in spades in the last week’s blog.

References

Read the ICO’s evidence (uncorrected): http://www.publications.parliament.uk/pa/cm201012/cmselect/cmjust/uc1473-i/uc147301.htm

Update and courses

This autumn, we have data protection courses in Leeds, London and Edinburgh. full details on the Amberhawk website

Next Update is October 17th 2011 in London. The guest speaker is Kuan Ho: "Every Cloud has a Data Protection Lining"; Rosemary Jay, from Hunton and Williams will be analysing the data protection fallout of the hacking affair. Sue Cullen and myself will be delivering updates on the usual "what's new" matters (e.g. enforcement, undertakings, FOI/DP interface and news roundup). £195+VAT per place: full details on the Amberhawk website (www.amberhawk.com).

ICO criticises data protection compliance by local authorities and cannot understand attitude of banks towards audit of data protection compliance

The Information Commissioner has called for the commencement of the custodial element of the section 55 offences and expressly criticised data protection compliance by local authorities as being “very bad”. He also criticised data controllers, especially in banks and financial services, as being uncooperative in relation to consensual data protection audits. He also anticipates that agreement over the text of a forthcoming data protection directive will be protracted and will take “years”.

These points were made in a wide ranging questioning by the House of Commons, Justice Select Committee at a hearing yesterday.

The Commissioner made an impassioned plea for Parliament and Government to commence the custodial element of the section 55 offence in order to make sure the panoply of the legal penalties would be available to the Courts. Currently, the Commissioner complained that because a fine was the only penalty that could be imposed, this meant that other non-custodial penalties were unavailable to the Courts (e.g. community service orders).

This emphasis on non-custodial sentences is politically adroit. First, it does not involve custodial sentences, as the Government wants to reduce the prison population. Secondly, the Commissioner is reminding Parliament that they can separate the issue of generally strengthening the section 55 offence, from the specific Special Purpose problems which can be properly left to the Leveson Inquiry (into phone hacking by journalists).

The Commissioner also revealed that the Government is thinking of making the section 55 offence a “recordable offence”. This would mean that anyone prosecuted under the Act would have an entry on the DNA database for their lifetime. The Commissioner also noted that even under the current arrangements, the fine is a maximum £5,000, the going rate is about £100 to £150 per offence. This level of fine, he stated, was no deterrent at all.

The Commissioner stated that he has no powers of audit except in limited circumstances and made a plea for a general power of inspection in circumstances where there was reasonable cause to believe that data protection compliance was deficient. Currently only one in five data controllers agree to a consensual audit; the Commissioner strongly suggested that the financial services sector would be a focus if such powers were granted.

The Commissioner expressly pointed to the offence involving a Barclays Bank employee (see references: this deals with the S.55 prosecution of a bank employee, married to a person prosecuted for a sexual offence, who accessed the financial records of the victim to check on her spending habits). In this context, he expressly regretted that private sector data controllers are “backwards in coming forward” to volunteer for a data protection audit. The Commissioner cannot understand why the offer of a “free audit” is rejected by 80% of data controllers; in the context of the high street banks, the Commissioner called this stance “short sighted”.

The Commissioner recommended that “mystery shoppers” should be employed, especially in the area of disclosure. So if your organisation is employing penetration testing in relation to its security compliance, it might be useful to check whether disclosure procedures form part of those tests.

In relation to the forthcoming new text of the Directive, the Commissioner:

• expected it to be published in November or December
• used the term “Framework Directive” – this implies that there will not be a Regulation to implement any new data protection rules
• wanted a “principle based” approach – this would mean that in any new legislation,  the Commissioner would have more flexibility in relation to interpretation and enforcement of those principles in the light of technological developments
• focused on the Accountability Principle as being especially important;  this Principle would firmly embed data protection into information governance structures
• expected that it would contain a power of inspection and audit
• expected that the negotiations over the text would take “years”
• is holding a conference in the Spring to engage with data protection stakeholders.

References
Barclays bank employee: http://www.ico.gov.uk/news/latest_news/2011/cashier-spied-on-sex-attack-victims-bank-records-13092011.aspx

To see the ICO’s evidence session: http://www.parliamentlive.tv/Main/Player.aspx?meetingId=9020 (first 30 mins deal with DP)

Leveson Inquiry into hacking: http://www.levesoninquiry.org.uk/

Update and courses
Next Update is October 17th 2011 in London. The guest speaker is Kuan Ho:  "Every Cloud has a Data Protection Lining"; Rosemary Jay, from Hunton and Williams will be analysing the data protection fallout of the hacking affair. Sue Cullen and myself will be delivering updates on the usual "what's new" matters (e.g. enforcement, undertakings, FOI/DP interface and news roundup). £195+VAT per place: full details on the Amberhawk website (www.amberhawk.com).

Finally, this autumn, we have data protection courses in Leeds, London and Edinburgh. full details on theAmberhawk website

Personal data sharing: when it goes wrong, it’s a nightmare?

I hate the phrase “data sharing” because “sharing” usually carries a consensual connotation. One shares sensitive detail with close friends and family; one does not “share” such details with tax officials, VAT inspectors or police in the same way.

When public authorities say they are “data sharing” what they often mean is that they are making disclosures of personal data often without the consent or knowledge of the data subject.  I  also sometimes think that the use of “share” masks what actually is happening: “share" and "care” rhyme and often go together. However, this blog raises an example where “share” and “nightmare” is the more appropriate coupling!

In January this year, the Parliamentary Ombudsman, Ann Abraham criticised three government agencies for collectively failing to put things right when a data sharing mistake led to a woman’s personal and financial information being wrongfully disclosed to her former partner and her child support payments being reduced without her knowledge. I have to be honest, I missed this report – but better late than never.

The report, “A Breach of Confidence”, is the outcome of the Ombudsman’s investigation of   Ms M’s complaint about HM Revenue & Customs, the Child Support Agency and the Department for Work and Pensions, and their handling of her personal information. The  chain of events leading up to Ms M’s complaint to the Ombudsman dates back to 2006 when  one of the government agencies involved incorrectly updated her records to show her living  at her former partner’s address, although she had in fact never lived there. 

After discovering her details had been changed, Ms M tried to find out why and sought an assurance they had been corrected. She was passed from one government agency to the next, each denying responsibility.  She then took the matter to her MP who subsequently referred it to the Ombudsman. 

The Ombudsman upheld Ms M’s complaint.  In her report, the Ombudsman expresses her concern that:

• The network of computer systems used by HM Revenue & Customs, the Child Support  Agency and the Department for Work and Pensions could make changes to Ms M’s  personal data without her knowledge or consent yet an interrogation of that network  cannot now locate the source of any errors.
• The agencies were unable to give Ms M the reassurance she sought about her personal  information.
• Each of the agencies blamed another for the mistake and took the view that as the  mistake had been made by ‘the system’, there was nothing they could do.  None of  press releasethe agencies involved accepted responsibility for what had happened to Ms M until  the Ombudsman became involved.

The Ombudsman wryly commented that “While these government agencies have computer systems that are networked and communicated with one another, the agencies themselves clearly do not”.

When readers of the blog are talking to staff about the ICO’s Code of Practice on Data Sharing, it is sometimes an abstract affair. This report is an example of what can go wrong – big-time, and for that reason, it is an important document to read. Invaluable input if you are doing training courses.

References: The Ombudsman’s Report can be downloaded here Download Ombudsman data sharing. The ICO’s Code of Practice on data sharing can be downloaded here. Download Amber_d5_data_sharing_code_of_practice

Update

Next Update is October 17th 2011 in London. The guest speaker is Kuan Hon, from Queen Mary’s Cloud Computing Project; she will be speaking on "Every Cloud has a Data Protection Lining"; Rosemary Jay, from Hunton and Williams will be analysing the data protection fallout of the hacking affair. £195+VAT per place: full details on the Amberhawk main site (www.amberhawk.com). Sue Cullen and myself will be delivering updates on the usual "what's new" matters (e.g. enforcement, undertakings, FOI/DP interface and news roundup).

Riotous behaviour: which law legitimises the blocking of communications?

One of the unanswered questions arising from the August riots is whether the Government need new powers to block the use of Twitter, Facebook and other social media which were used to organise the disturbances. Prime Minister David Cameron suggested, in the immediate aftermath of the rioting, that blocking the use of social networking communications was a policy option that was to be orgently discussed with telecommunications operators (and then implemented as a priority).

So when the Home Office says (as they have done) that no new powers are needed, then it follows that either no new powers are needed (i.e. the Government already has the power to block social networking communications) or the politicians have quietly gone off the idea (and have decided not to say so).

Assuming it’s not the latter, one’s first instinct is to look at the Regulation of Investigatory Powers Act (RIPA) as the source of any power to block communications. This Act states (in section 8 of RIPA) that to lawfully authorise interception, a signed warrant from the Home Secretary is required and this warrant has to “name or describe either—.

(a) one person as the interception subject; or.
(b) a single set of premises as the premises in relation to which the interception to which the warrant relates is to take place”.

Clearly “the one person” description in paragraph(a) can’t work if there are hundreds of unknown individuals engaged in a riot, whilst the limitation to “a single set of premises” of paragraph(b) was not really intended to be stretched to lawfully describe something like “all premises in N17” (the post-code of the Tottenham area).

Also, RIPA uses the word “interception”. So do provisions to allow the authorities to intercept and study the content of communications between the “bad guys” (the intent behind RIPA) extend to the “blocking” all communications to thousands of individuals (i.e. including the "good guys") where the content of the communications is not studied at all? I am not sure it does.

For these reasons, I do not think that RIPA as currently constructed can be reliably used in riot situations as a lawful basis that blocks communications in the area of a riot. So where are the powers to block?

If I was having a bet, I think Ministers might be considering the powers in the Civil Contingencies Act 2004. This is because the definition of an “emergency” which is required to trigger use of the Act’s draconian powers, clearly includes a riot, as a riot could cause “serious damage” to human welfare, to property and threaten lives.

Additionally, where the issue is “urgent, then the Civil Contingencies Act’s powers can be exercised by Ministers without resort to Parliament. Although “urgency” is understandable in times of a crisis, these urgency provisions also minimise Parliamentary scrutiny of their use at the critical time that the powers are exercised.

One issue that is unresolved is whether “rioting” can be given a “national security” label. For example, section 94 of the Telecommunications Act 1984 allows the Secretary of State to “give to that person” (e.g. a telecommunications operator) “such directions of a general character as appear to the Secretary of State to be necessary in the interests of national security”.

However as public utterances of Ministers have always addressed the August riots in terms of “criminality”, then I suggest that “national security” powers really cannot be used to justify blocking of networking sites. If national security powers were to be used, then this would be wholly at odds with all the current political discourse.

Other powers are in Part III of the Police Act 1997; this allows the police to interfere with “wireless telegraphy” if interference is authorised by a Chief Constable. However, if Chief Constables have the power, then this would exclude the politicians, who in the August riots, clearly wanted to manage the police’s response to the riots. The Civil Contingencies Act, by contrast, avoids this problem; it gives the authorising powers to Ministers and not the police – another reason why I think that the powers in this Act are preferred.

All sorts of complicated, practical issues would still remain. For instance, if you block communications in an area, you will be blocking communications for everybody.  So if you block messages saying “let’s have a riot” you also block messages asking “Are you safe?”. Also, there are also difficulties about defining when rioting is taking place and when the powers are used. For instance, what is the difference between “a riot” and “Friday-night pub-chucking out time in some of our city centres?”  Not much, I would argue.

In summary, the “riots” have thrown up all the age-old questions in the context of mass interference to communications systems used by every citizen. Do such powers exist already?  When are they used? Who should exercise these powers? What are the checks and balances in relation to the exercise of these powers?

These important questions need an answer from our political masters. One can’t have the “riots” being used to justify the building a system of extensive blocking of ALL communications without equal thought being given to the building of a reliable counter-balance that protects from the misuse of those powers.

This is especially the case if the powers of the Civil Contingencies Act 2004 are being contemplated as the vehicle to make such blocking lawful. After all, history tells us that it is in a time when emergency powers are used, that individual rights are often in their greatest peril of disappearing.

References: To understand the issues associated with the Civil Contingencies Act, see Liberty’s briefing on the second reading of the Bill, first published in 2004 Download Liberty comments_civil-contingencies-bill

Update
Next Update is October 17th 2011 in London. The guest speaker is Kuan Hon, from Queen Mary’s Cloud Computing Project; she will be speaking on "Every Cloud has a Data Protection Lining"; Rosemary Jay, from Hunton and Williams will be analysing the data protection fallout of the hacking affair. £195+VAT per place: full details on the Amberhawk main site (www.amberhawk.com).