Hawktalk

What is wrong with the Data Protection Act? FOI Infraction saga hits the buffers

Bad news guys! I have just received my Tribunal Decision which throws out my attempt to find out what is wrong with the UK’s Data Protection Act. The Decision means that sixty million data subjects and one third of a million data controllers will not fully understand why the European Commission thinks that the UK’s implementation of Data Protection Act has been deficient since 2004. I think this is a shocking state of affairs.

The result of this Decision is important for another reason. The jungle drums are increasingly beating out the message that the European Commission is thinking of enacting a new data protection regime by regulations. Will such regulations address the identified problems with the UK Act? Well, if the public doesn’t know what these problems are, then it won’t be able to judge.

I asked the Ministry of Justice (MoJ) for a summary of the information held about the infraction proceedings, because an earlier FOI request for the full detail had failed. I was hoping that (a) the summary might exist or (b) the summary information might be scattered around in emails and documents already held, and that finally, this summary would not be exempt. And thirdly, because of the House of Lords decision in CSA v SIC, I also argued a new point: even if the summary information did not exist, CSA v SIC implied that this step did not need the creation of new information (see references).

By contrast, the Commissioner, in his Decision Notice which has been upheld by the Tribunal, said that the summary information is only relevant to the form in which existing information is presented to the requestor. It followed that this meant that any exemption had to be applied to the full existing information as the summary was only relevant when information is to be given to the applicant. And because in my case (i.e. my previous failed FOI request), the full information was still exempt, the question of providing a summary was irrelevant.

It is this view which has prevailed. However, I am disappointed that the Tribunal Decision did not document any rebuttal of any of the arguments I had presented. To redress this omission why I have attached the relevant arguments so that blog readers can take a look if interested (download at end).  I am still of the opinion that asking for "summary information" is a valid FOI request!

FOI practitioners should read the following

What is interesting for FOI specialists is the Tribunal Decision in relation to the “time of the request”. My request was made on 1st October 2009. The MoJ did not respond till 3rd Feb 2010 – hardly 20 working days! I immediately asked for a review which was completed on 25th August 2010 - hardly 20 working days as recommended by the ICO for the internal review period. (These are delays which the Tribunal Decision categorises as “some delay” and “less serious delay” - hardly a problem then!).

At the end of June 2010, the MoJ received a substantive response from the European Commission about the deficiencies in the Data Protection Act 1988 (and responded to them).

My question to readers with a FOI interest is as follows: if my request was made in October 2009, can the information received by the MoJ in June 2010 form part of the request, because clearly this information was not held at the time of the request?

The answer is “yes” because the internal review process had not been completed.

The Tribunal Decision relies on the Commissioner’s argument for this, but this in turn relies on just one Tribunal Decision. However, I have placed in the public domain (see downloads), a fully referenced justification of why the Tribunal came to this position which mentions several such Decisions. The Tribunal decided not to refer to this document.

The message for FOI practitioners is this: if the FOI Internal Review process gets stretched out, subsequent information relating to the request received after the time of the request might need to be included in the review and possibly disclosed to the applicant.

Concluding comment

It is interesting to note that the Tribunal, at the end of its Decision, records the fact that I am entitled to a heavily redacted summary of information held by the MoJ in June 2009.

This is, of course, was one of the arguments that I was running: namely, non-exempt, summary information exists, and can be extracted from the full, existing exempt information.

It’s a funny old inconsistent world!

References

The arguments in relation to my request is here. Download BLOG_Tribunal arguments
The Tribunal Decisions relating to the “time of the request” is here. Download BLOG_Time of request
The Tribunal Decision Notice can be downloaded here. Download BLOG_Tribunal Decision EA20110116
CSA v SIC reference is: Common Services Agency v Scottish Information Commissioner ([2008] UKHL 47 [2008] 1 WLR 1550.

Note: Some details of the deficiencies in the UK Act have been published under FOI. See “Privacy: new Government revelations amplify concerns surrounding deficiencies in UK’s Data Protection” Act. http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html  and attachments at the end

 Data Protection/FOI courses

We have an audit and PIA course coming up in London. There is a full set of data protection courses in Leeds, London and Edinburgh Our FOI courses are in London (currently underway) and Leeds (in 2012). Details on the Amberhawk site

 

If IP addresses ARE “personal data” for a copyright purpose, aren’t they personal data for ALL purposes?

Let’s revisit that old chestnut: “is an IP address you use in an internet session personal data about you?”. The reason: I have just come across two legal references which relate to copyright infringement, where the argument that an IP address is personal data was accepted. (An IP address is the number linked to your connection to the internet so that communications can occur; for instance 68.74.255.92).

The first reference I found was the Monetary Penalty Notice that ACS Law obtained (and the £200K fine that wasn’t;  see references). The company, used to send ISPs on a regular basis, a list of IP addresses suspected of being involved in breaches of copyright. (The company went out of business because of its poor security; that is why the eventual penalty was reduced to £1K).

In the ACS Law Monetary Penalty Notice the ICO clearly states:

“The Commissioner understands that the data requests sent to each ISP by the data controller (in this case) were for information populating a spreadsheet containing hundreds and sometimes thousands of IP addresses. …. ISPs responded to the data controller by returning the spreadsheet with all the existing data, together with the name and address of the registered account holder that they had input alongside each entry”.

So the ISPs mentioned above, presumably because they have blocks of IP addresses specifically allocated to them, were able to provide a link between a requested IP address and a specific individual account holder. In this way, the IP address formed part of the personal data each ISP had in its possession.

This point was reinforced with a judicial review concerning the Digital Economy Act 2010 (see references) where it was claimed by many organizations that some regulations enacted by Government were incompatible with a number of provisions of EU law. One part of this argument related to the Data Protection Directive (DPD) 95/46/EC.

The judgment states that, as common ground between the parties, an IP address is personal data. In detail, it states that:

“It is common ground that... (various provisions in the Digital Economy Act)..., are likely to require ISPs to process “personal data” within the meaning of Articles 2(a) and (b) of the DPD.  The ISP must link the IP address provided by the copyright owner with an individual subscriber’s name and address, and write to them and compile lists”... (that can be supplied to Third Parties; paragraph 152).

So suppose an ISP allows other organisations to capture or monitor a user’s IP address say for behavioral marketing. As the ISP is processing personal data (see above), isn’t it allowing part of the personal data under its control (e.g. the IP address it has been allocated, and possibly owns, which also relates to the browsing habits of a known individual) to be used for Third Party marketing?

As all Tribunal determinations on Third Party marketing have stated that this needs the prior consent of each data subject (i.e. each and every account holder),  shouldn’t the ISP be doing something to alert or protect its customers from the use of their IP addresses for third party marketing? Like getting their consent, perhaps?

Now look at the issue from the standpoint of those behavioral marketers that arrange for a pop-up box to appear after monitoring IP addresses; for convenience, I show examples of these boxes posted on Wiki. What is the purpose of the pop-up box?View this photo  Answer of course: “marketing”.

Note that many pop-up boxes shown provide links to enable direct contact with the customer. So where organisations are using/monitoring the IP address to identify potential leads, they know that identifying information about an individual is likely to come into their possession.

If this is the case, then this too falls within the UK Act’s definition of personal data. It follows that personal data are being processed for a marketing purpose, without the data subject having been given the advance choice to opt-out of the marketing purpose (e.g. in a fair processing notice).

Is the release of IP addresses like the release of anonymous statistics?

There are those who would argue that an IP address, by itself, does not identify the individual. In support, they might quote recent judgments about “anonymous statistics”, which appear to suggest that the disclosure of anonymised information, extracted from personal data, is not a release of personal data.

I argue that the position the release of these "anonymous statistics" and IP addresses is not the same and can be distinguished very easily as follows.

Consider the ProLife Alliance FOI request to the DoH for the release of abortion statistics concerning the number of late-term abortions. The DoH refused the request and claimed that the requested information was personal data, the Information Commissioner said the statistics were not personal data, the Tribunal said they were personal data, and Cranston J, in his judgment published in June agreed with the Commissioner (but on different grounds; see references).

Cranston J argued that to consider the requested data as personal data would establish a principle which would prevent any publication of medical statistics, however broad. To justify his position, he then went on to examine whether identifiability was likely (a) in the hands of the data controller and (b) in the hands of recipients who get the statistics. He was satisfied that if identification in the hands of the recipient was “extremely remote”, then the information was not personal data.

Now we come to the difference that distinguishes the disclosure of statistics and the disclosure of IP addresses. With the former, the data controller might be able to identify an individual from the statistics in conjunction with other information in its possession. By contrast, the recipient of the statistical data, following the logic of Cranston J, is remote from making such an identification.

This starkly contrasts with the disclosure or capture of IP addresses. Although an individual cannot be identified from just the IP address, the user or recipient of that IP address has every intent to identify a potential customer as part of his marketing purpose.

Additionally, the holder of the IP address knows that in the hands of the ISP, the IP address defintely forms part of a collection of personal data. With statistics, this point might not be so clear cut; for instance the public authority might create a set of statistics for release under FOI where it cannot perform the back identification.

That is why I am increasingly drawn to the conclusion that IP addresses have to be treated as personal data by behavioral marketers as there is a prior intent to identify the individual behind the IP address.

I am also coming to the conclusion that ISPs can do more to protect its customers from unwanted marketing, especially if they own a block of IP addresses.

References

DP extracts from R (BT & Anor) v The Secretary of State for Business, Innovation and Skills [2011] EWHC 1021 (Admin) can be downloaded. I was put onto this case by the excellent Panopticon Blog http://www.panopticonblog.com/2011/06/14/personal-data-crucial-points-from-the-abortion-statistics-case/)

The Abortion stats case: R (DEPARTMENT OF HEALTH)-v-IC [2011] EWHC April 2011 was discussed in the reference above

ACS Law Ltd Monetary Penalty Notice (10th May 2011) is on the ICO website (http://www.ico.gov.uk/what_we_cover/taking_action/dp_pecr.aspx#monetarypenalties)

Data Protection/FOI courses

We have an audit and PIA course coming up and a full set of data protection courses in Leeds, London and Edinburgh  Our FOI courses are in London (currently underway) and Leeds (in 2012). Details on the Amberhawk site

CCTV images are accessible on subject access (or is it Durant misses the Dublin Bus?)

A woman is injured falling down on a bus in Dublin; CCTV images record the event. If the woman applies for subject access, does she get the images? That was the question before the Irish Court, as the bus company refused access because the woman might be seeking compensation.

Why should this interest UK readers; well because Counsel for the Dublin Bus Company trotted out the Court of Appeal decision in Durant (which of course is the equivalent of waiving a red flag at any passing data protection bull).

In Durant, the Court of Appeal introduced a new subject access exemption. Auld LJ stated that the right of access in the 1998 Act is not available to the data subject "to assist him, for example, to obtain discovery of documents that may assist him in litigation or complaints against third parties".

In Durant, the third party in questions was Barclays Bank, and clearly Auld LJ was concerned that Mr. Durant was trying to re-open a litigious dispute with the Bank which had been determined in favour of the Barclays some eight years earlier.

However, Auld LJ then added for good measure that Durant’s claim “is a misguided attempt to use the machinery of the Act as a proxy for third party discovery with a view to litigation or further investigation, an exercise, moreover, seemingly unrestricted by consideration of relevance”.

And it is this paragraph that gave rise to the legal argument that Dublin Bus was running. The woman, who was known to be considering a compensation claim, was usurping the right of access as a substitute for the Irish Civil Procedure Rules, which would allow for an orderly exchange of evidence if there were a claim. It followed that she should not gain access to the personal data.

All I can say is that there is nothing in either the 1995 Directive or in the 1998 Act which would justify any comment that the right of access has to be considered in terms of the data subject's reasons for exercising it. Additionally, Subject Access is a right only tempered by an exemption; there is no subject access exemption in the Act for “contemplated legal proceedings” and hence this argument has to fail (even though it clearly appears in Durant).

The Irish Judge agreed and that particular argument was lost.

The next argument proffered by Counsel for the bus company was that the personal data was subject to “legal professional privilege”. However, the bus company had shown the CCTV footage to the data subject prior to the access request and any threatened litigation. This meant that the claim for legal professional privilege had to fail. For the life of me I cannot understand why this argument ever saw the light of day; it’s a “we are clutching at straws” position, so I think it best to move quickly on.

However, the Irish Court made some obiter remarks that agreed with Durant over judicial discretion with respect of Subject Access. The judge agreed that section 7(9) of the UK’s Data Protection Act allowed the Court discretion as whether to require a data controller to provide a data subject with personal data. Discretion, I should add, that allows the UK Courts to make up subject access exemptions as they go along.

This “discretion” argument was first proffered by Auld LJ in Durant; it is one of the major reasons why I think the Data Protection Act 1998 does not implement the Directive 95/46/EC. So it is important to explain why.

Why judicial discretion is a defective implementation

Section 7(9), at first reading, allows the Court wide discretion. However, that reading omits reference to the “guaranteed” right of access required to be implemented by the 1995 Directive. So, in summary, we have identified the divergence: the UK have implemented “discretion” whilst the Directive wants a “guarantee” implemented.

Article 22 of the 1995 Directive requires that "…Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question" (my emphasis). This means that the data subject can have access to the courts to enforce the guarantee where the data controller has withheld access. By contrast, the discretion in section 7(9) allows for the non-enforcement of subject access!

Article 12 obliges Member States to "guarantee every data subject the right to obtain from the controller….- communication to him in an intelligible form of the data undergoing processing and of any available information as to their source". Recital 55 states that "if a controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy" (my emphasis).

There is no room for equivocation here: "must" and "guarantees" are strong unconditional words; there are no qualifying words such as “may” or "to guarantee as far is as is reasonably practicable".

However, this “guarantee” is moderated by Article 13 which permits Member States to adopt legislative measures "to restrict the scope of the obligations and rights" in narrow circumstances. This is the basis for the exemptions from the right of access and apply if "such a restriction constitutes a necessary measures" to safeguard a list of items (e.g. national security; the prevention, investigation, detection and prosecution of criminal offences, and possibly relevant here, in "the protection of the data subject or of the rights and freedoms of others".

In other words, exemptions from the right of access must be couched in terms of the exemptions in this Article 13 list; any discretion in section 7(9) is limited to adding exemptions in the circumstances described by Article 13.

Instead of a limited discretion, the UK Government has legislated for a Court to have "general and untrammelled powers" (to use Auld LJ’s expression) to negate the guaranteed right of access.

And that is one of the reasons why I think the UK Data Protection Act 1998 is a deficient implementation of the Data Protection Directive. It does not implement the right of access properly.

References

You can download the Dublin Bus case here: Download Dublin Bus Judgment
The case reference is Durant v Financial Services Authority [2003] EWCA Civ 1746. However, if you want a 100 page analysis of the Durant decision, email us with your request.

Update and courses

This October/November, we have data protection courses in Leeds, London and Edinburgh and an FOI course in London: full details on the Amberhawk website. Update is next week in London – places still available

“Let’s get rid of the Human Rights Act”

The Conservative Party have a bee in their bonnet about the European Convention on Human Rights; possibly this is because it has the word “European” in the title.

No doubt to gain plaudits, Theresa May, Home Secretary, at the Conservative Party conference said the following:

“We all know the stories about the Human Rights Act. ....The illegal immigrant who cannot be deported because – and I am not making this up – he had a pet cat”.

“This is why I remain of the view that the Human Rights Act needs to go. The Government’s Commission is looking at a British Bill of Rights. And I can today announce that we will change the immigration rules to ensure that the misinterpretation of Article Eight of the ECHR – the right to a family life – no longer prevents the deportation of people who shouldn’t be here".

"I expect not many people have actually read Article Eight, so let me tell you what it says:

Article 8.1. Everyone has the right to respect for his private and family life, his home and his correspondence.” You can imagine, in post-war Europe, what the draftsmen intended. But now our courts – and the problem lies mainly in British courts – interpret the right to a family life as an almost absolute right.”

All I would say in answer to this tirade is the following: if there is no right to a family life, what then protects family life? Get rid of this provision, what protects the family from press intrusion, from intrusion from the state, or from intrusion by any future Home Secretary (one perhaps who is has an authoritarian streak)?.

The statement also raises a very serious question as the Home Secretary’s current responsibilities. For example, Mrs May signs warrants that allow the Security Services to intrude into private life. As required by laws that take Article 8 into account, there is a balance between the needs of the authorities to intrude into private and family life with the need to protect family life. The Article starts from the position that family life has to be protected unless there is an overriding interest specified in Article 8(2).

However, if the person signing these warrants starts from the position that this balance is a load of rubbish, then where is the guarantee that these national security agencies restrict themselves to their allotted functions?

Of course Mrs May would most likely reposte “It’s only about immigration”. But I would also argue that the second part of Article Eight allows for Mrs May to deport in certain circumstances:

 “Article 8.2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”

So the right to a family life is not an absolute right; it can be set aside (i.e. there can be deportation) if there is a valid national security, public safety, crime prevention, health or other protection reason. It follows that Mrs May wants is the ability to deport immigrant who claims a family life when there is NO national security reason, NO public safety reason, NO crime prevention reason, NO health reason or NO other protection reason for that deportation. Mrs May has not stated what this reason is – and I can’t think of it!

Note that if the criminal immigrant has no family life to protect then the Article 8 protection is void. The Home Secretary can deport if she has the powers.

On a subsequent TV interview, Mrs May said that she would introduce new immigration rules by Statutory Instrument that would make the deportation justified, in Human Rights terms, “for the protection of the rights and freedoms of others” (tucked at the end of Article 8(2)).

This reminded me of a high powered conference held to discuss the Data Protection Bill in 1983 (this Bill fell in when Mrs Thatcher called the 1984 General Election and a reintroduced Bill became the Data Protection Act 1984). There was one major difference between the 1983 Bill and the 1984 Act; the 1983 Bill had a special provision to do with immigration.

Since readers are familiar with the 1998 Act, the difference can be explained as follows: just imagine that “the control of immigration” appeared as another category in section 29(1) of the Act. This means that there would be a subject access exemption if a subject access request would prejudice “the control of immigration” and the exemption from the non-disclosure provisions would also apply to disclosures that would prejudice the “control of immigration”. In other words, “control of immigration” is equated with “prevention of detection of crime”.

At that conference, Paul Seighart, Member of the Lindop Committee on Data Protection, said the following. If the interference with private and family life is justified on the grounds of “the protection of the rights and freedoms of others”, then by inference there was a right not to have an immigrant as your neighbour or the freedom not to have an immigrant as a neighbour.

In 1964, the Conservative Candidate Peter Griffiths, won the Smethwick seat by running  an anti-immigration campaign and benefiting from the infamous slogan "If you want a nigger for a neighbour, vote Labour". Seighart reminded the audience of that traumatic event – and that is why, I suspect, the “control of immigration” exemptions did not appear in the Data Protection Act 1984 (I would assume that if the exemptions had appeared in the 194 Act, they would have appeared in the 1998 Act, as the Data Protection Act 1998 was a “Home Office Bill” when it was enacted).

So Mrs May, when she talks about scrapping the Human Rights Act, she gains some huge plaudits and headlines. She is also opening a can of worms that historically has the potential to cause great damage to her Party and to family life.

At the end of the day what Mrs May wants is the ability to take away the family life of those who commit crimes in the UK, are punished in the UK. The other partner (or children) can chose to stay in the UK or leave. Can this really be the thought through policy of the party of “family values”?

Update and courses

This October/November, we have data protection courses in Leeds, London and Edinburgh and an FOI course in London: full details on the Amberhawk website. Update is next week in London – places still available

Biographical note: Paul Seighart is one of the early data protection and human rights “greats” who died sadly too young: see  http://archiveshub.ac.uk/features/0410sieghart.html