Hawktalk

Expect Parliamentary Committee to support concerns about the Data Protection Regulation

On Thursday, the Justice Committee will publish its conclusions about the European Commission’s Data Protection Regulation; yesterday, at our Update session, we had a speaker from the MoJ talking about the Regulation. This blog explains why I think a revised text of the Regulation will have to emerge and why I expect the Committee to support the ICO’s and the Government’s concerns about the text of the Regulation (as explained below).

Our Update speaker told us that the DAPIX committee of Member States discussing the Regulation have arrived at Article 38 – only 53 Articles to go – and this on first reading too; remember the first 10 Articles produced about 1,000 reservations, issues or comments. Just use your 11 plus mathematics: if it takes 10 months to discuss 38 Articles, how long will it take to discuss 91 Articles? (11+ answer is nearly 24 months by the way).

In other words, there is significant disagreement over the text (see references) and our speaker confirmed that concerns expressed by the UK were shared by other countries. So unlike Directive 95/46/EC it is not a case of UK v the Rest of Europe as it was in the Thatcher/Major era.

After first reading, the Commission has to respond to the concerns raised by Member States and produce a new text. In other words, if the June 2014 deadline is to be met there has to be more rapid progress; so if Commissioner Reding wants her Regulation she has to compromise on its content. As the June 2014 election appears on the horizon, Commissioners move on, MEPs are re-elected, and proposals are dropped (i.e. the Regulation effectively goes back to square one).

Ms Reding’s dilemma is made clear by the Minister, Lord McNally, who gave oral evidence before the Justice Committee. He said:

• “We want is a lighter-touch and more flexible system”. Translation: we think parts of the Regulation are heavy handed and inflexible.

• “We are not in the business of signing blank cheques for the Commission”. Translation: we don’t like the Commissioner wielding powers that impact on UK data subjects and UK data controllers without the UK Parliament or Ministers having much of a say.

• “The Commission have a very ambitious time scale”. Translation: the Commission could miss their June 2014 deadline.

• “We are negotiating to get results, not to fit into a timetable”. Translation: our contributions to debate should not be classified as “obstructing progress”.

• “If the Commission want an early result, then it may well be that they have to make substantial concessions to get the kind of outcome that we want”. Translation: Commissioner Reding can chose between “give in” or “give way”.

• We want the “benefits of harmonisation without the downside of over-bureaucratising and over-burdening business”. Translation: The UK believes that parts of the Regulation are over-bureaucratising and will over-burden business

Looking at the above comments it is easy to come to the general conclusion that the UK Government “doesn’t like it” (although the Government will say that they are supportive of the idea of better harmonisation and improved data subject protection; it is just the expression of the idea that causes the problem). And to some extent I agree with the UK Government (see references); I think this Regulation is, and always has been, a lengthy data protection suicide note.

It might surprise that much of the above is shared by the Information Commissioner. In his written evidence to the Committee, he noted:

• The Commission should have developed one comprehensive data protection instrument whether a Regulation or a Directive. Translation: the diverse set of data protection rules will lead to an overtly complex arrangement especially where one set of data protection principles will apply to some personal data (in the Regulation), and another set of data protection principles will apply to another set of personal data (in the Directive for law enforcement).

• Implementation and compliance with the revised framework to be achieved more quickly once it enters into force. Translation: data protection concepts are 20 years old; as they are not new, then they can be implemented quickly.

• The Regulation compared to the current Directive is far too prescriptive. Translation as per Lord McNally above.

• Implementation of rules may be perceived as onerous or disproportionate. Translation as per Lord McNally above.

• The ICO is pleased that there is only one form of consent in the Regulation; the distinction between ‘ordinary’ consent and ‘explicit consent’ in the current law has caused a great deal of confusion. Translation: there are too many data controllers in the UK who fixate on “implied consent” and I want to kill this idea off  for all time.

• Durant: the ICO wants a focus on the accessibility of information relating to a particular individual rather than solely on the structure of system. Translation: The ICO has come round to the view that we proposed in the Durant hearing, but the Court of Appeal (bless them), came to a contrary view.

• There are significant doubts as to how meaningful any attempt by supervisory authorities to closely monitor, control or authorise transfers can be. Translation: The current Directive is existentialist in nature as data controllers are responsible for their actions, especially in the UK when transferring personal data overseas; doesn’t the French CNIL understand their Sartre?

Notice the consequences above: both the UK Regulator and UK Government are of the view that the Regulation is over prescriptive, overtly burdensome, involve two different data protection regimes (Regulation and Directive) and involve a power grab by the Commission. So don’t be surprised if the Committee produces warm words on “we support the idea of enhanced protection”, express significant concerns over “implementation” and agree with the above reservations.

So what is the consequence of all this for blog readers? Don’t worry too much about the text of this Regulation and don’t do too much in the way or preparation; if the Commission does not revise the text significantly, then this Regulation might be in serious difficulty. However, keep a watching brief for “compromises” as these have to emerge over the coming months.

Finally, the Lib/Dem Lord McNally is no longer responsible for data protection; now Conservative Helen Grant (MP for Maidstone) is in charge. Conservatives are more euro-phobic and Ms Grant will have the additional support of an all-Party Committee for her arguments that the Regulation has to change.

Advert

JUSTICE evening event at Hunton and Williams: “Defamation, privacy and freedom of expression online”, 30 St Mary Axe, London EC3A 8EP (the London “Gherkin”) 20 November 2012 –http://www.justice.org.uk/events.php/46/life-and-law-online-defamation-freedom-of-expression-and-the-web  (£50)

Our next Update session is on April 15th 2013 (same place – London), same agenda (focusing what has happened in the last six months plus guest speaker and Rosemary Jay) and same inflation busting price (£195).

References

The Regulation what are the big changes to the Data Protection Act regime; http://amberhawk.typepad.com/amberhawk/2012/01/the-regulation-what-are-the-big-changes-to-the-data-protection-act-regime.html

The Commission’s Data Protection Regulation weaknesses from the Data Subject perspective; http://amberhawk.typepad.com/amberhawk/2012/03/the-commissions-data-protection-regulation-weaknesses-from-the-data-subject-perspective.html

EU’s Data Protection Regulation divisions exposed as Member States show disharmony; http://amberhawk.typepad.com/amberhawk/2012/03/eus-data-protection-regulation-divisions-exposed-as-member-states-show-disharmony.html

MOJ ask for arguments to oppose the European Commission’s data protection regulation; http://amberhawk.typepad.com/amberhawk/2012/02/moj-ask-for-arguments-to-oppose-the-european-commissions-data-protection-regulation.html

EU Data Protection Regulation breaks explicit link with privacy and human rights; http://amberhawk.typepad.com/amberhawk/2012/02/eu-data-protection-regulation-breaks-explicit-link-with-privacy-and-human-rights.html

Mobile CCTV cars used by Councils can breach data protection law and RIPA

I have just won a minor victory against my local authority (Waltham Forest) which used images captured by a mobile CCTV unit to issue a £110 fixed penalty notice for a parking violation; I managed to get the penalty set aside.

This blog presents the case that the Council’s use of CCTV in instances like mine are in breach of the Data Protection Act (DPA) and possibly the Regulation of Investigatory Powers Act (RIPA), even though there are parking restrictions in force at the time of the surveillance.

I think far too many motorists get caught out by unnecessary surveillance whose purpose has nothing to do with traffic management and everything to do with “revenue collection”. I hope this analysis will help others facing the same position; full references and footage of the offence on the links below.

In late July, I unwittingly stopped for six minutes in a parking bay which, unusually, was subject to parking restrictions. The road signs depicting the parking restrictions are clearly dilapidated and they cannot be seen in the CCTV footage (or by the driver when one approaches the parking bay). My “parking violation” was captured in totality by a mobile CCTV unit parked a good distance up the road. As can be seen in the footage, the mobile CCTV camera puts the parking bay under constant surveillance, can zoom in, and even records when my car is neither in the picture nor in the parking bay. The footage shows that the traffic was light at the time of the “offence”.

Under the Freedom of Information (FOIA)/Data Protection Acts, I obtained the complete footage of “the offence” and background material to Council policy in this area. This showed that from May to July, mobile CCTV camera units were sent to the very location shown in the footage, a total of 44 days; this means that for every other working day, this particular parking bay was under surveillance for up to two hours per day.

According to the FOIA material (see references), the reason for sending the mobile CCTV camera to this location includes the deterrent purpose of identifying “motorists who … cause congestion by ignoring traffic markings” and “high instances of fly parking that cause disruption to other road users”. These purposes, in data protection terms, are the relevant purposes of the processing of personal data via the Council’s mobile CCTV units.

Note that these kinds of purpose for the deployment of mobile CCTV camera units would get support from most motorists as they are qualified by the requirement that the offending parking would “cause congestion” or “cause disruption”. However, it also follows that the policy does not apply when there is neither congestion nor disruption. In such circumstances, the cameras should not be recording at all (and that the mobile CCTV units should be deployed elsewhere where congestion or disruption is likely).

If such CCTV camera units do record personal data when there is no “congestion” or “disruption”, I would argue that this processing is not associated with the Council’s policy nor its stated purposes. In my case, the video footage shows CCTV Unit watching an empty parking bay and waiting to hook an unsuspecting motorist. Once hooked, the Council reels in its £110 prize (the standard Fixed Penalty Notice fee).

The Data Protection breaches

The violations of the First and Third Data Protection Principles are as follows:

(a) The purpose of the surveillance is not a purpose set out in Council policy as there is no "congestion" of, or "disruption" to, traffic. The processing therefore is not necessary for the stated Council’s legitimate purposes and as the processing does not have a Schedule 2 criterion, it is in breach of the First Data Protection Principle.

(b) Even if there is a Schedule 2 grounds for the processing, the processing is excessive (e.g. in terms of the Third Principle etc) for the stated purposes of the Council which relate to “congestion” and “disruption” of traffic (and not purposes when traffic is free flowing).

(c) There is no explicit signage in the parking bay under surveillance or nearby; such signage is a requirement of the First Principle. Indeed, I think parking bays that are under constant surveillance (e.g. those that are subject to surveillance once every two days for three months) need specific signage in the particular parking bay. By contrast, the Council argued that the signage throughout the Borough sufficed.

(d) Westminster Council puts its signage (see references) on their mobile CCTV Camera Cars. This is an error as the car is unlikely to be seen by the motorist (i.e. data subject) whose personal data are collected (e.g. in a parking bay under surveillance). I would argue that it is the locations which are under surveillance that need the signage -  not the device delivering the surveillance (i.e. on the CCTV mobile car as per Westminster).

(e) General CCTV signage is normally associated with crime prevention or public safety; it does not include signage for parking violations. Without proper signage displaying the non-obvious purpose of the processing, such processing is likely to be unfair.

(f) The absence of signage makes the surveillance covert; this is arguable I admit but the relevant Home Office Code of Practice suggests that the surveillance is indeed covert. If surveillance is covert, it will be unlawful under RIPA, and it also follows that the processing under the DPA would also be unauthorised, possibly unlawful – another breach of the First Principle.

I should add that I think the ICO’s CCTV Code of Practice is clear on the need for signage in the parking bay. Remembering that the surveillance in my case was undertaken when there was no congestion or disruption to traffic (and once every other day for three months), the Code of Practice states:

“Clear and prominent signs are particularly important where the cameras themselves are very discreet, or in locations where people might not expect to be under surveillance. As a general rule, signs should be more prominent and frequent where it would otherwise be less obvious to people that they are on CCTV” (my emphasis).

Hence my conclusion that the actual parking bay under regular surveillance needs the signage. As an aside, I am wondering how signage could display the “revenue collection” purpose and to be helpful, I have provided a relevant fair processing signage for this purpose (see references).

The rest of the article explains the RIPA context, but before that an anecdote. When I got the Penalty Charge Notice claiming £110, I drove back to the scene of the crime. Whilst looking at the parking bay, I was approached by a well-proportioned gentleman who conversed using an Anglo-Saxon/East-enders dialect of English.

 “Has yus been ****ing well done?”, he asked.

 “Yes”, I responded.

 “Well the ****ers over there (energetically gesticulating to a spot 50 yards up the road where the CCTV unit must have been parked) “did us when I stopped to pick up a ****ing bacon sandwich”. I was only ****ing three minutes and it was a ****ing expensive sarnie”.

The RIPA breach

I begin with a quote from the “Covert Surveillance and Property Interference: Revised Code of Practice” (2010) published by the Home Office. This states that:

“The use of overt CCTV cameras by public authorities does not normally require an authorisation under the 2000 Act. Members of the public will be aware that such systems are in use”. A footnote adds “for example, by virtue of cameras or signage being clearly visible”. See the CCTV Code of Practice 2008 for full guidance on establishing and operating overt CCTV systems”) (my emphasis)

The key question is as follows: if the cameras of the Mobile CCTV Unit are not “clearly visible” (the car is 50 metres away up the road), and because there is no signage in the particular parking bay under surveillance,  then does it follow that the mobile CCTV cameras are covert? If so, does the CCTV surveillance falls within the definition of “directed surveillance” under RIPA (intrusive surveillance can be safely be ignored).

The Home Office Code of Practice states that there are three tests if any planned directed surveillance is subject to RIPA. The surveillance has to be: “covert”; “conducted for the purposes of a specific investigation or operation”; and “is likely to result in the obtaining of private information about a person (whether or not one specifically identified for the purposes of the investigation or operation)”.

I would argue that the mobile CCTV unit surveillance is “covert” (because it is not overt as there is no signage and the cameras are not "clearly visible"). I also argue that the regular and routine surveillance of the parking bay constitutes “an operation” as it occurs every other day over a period of months. The only issue is whether private information is “likely” to be obtained. Given that the surveillance is of a public highway parking bay, at first sight this seems unlikely.

However, note that the test is that “private information is likely to be obtained”, not that “private information is actually obtained”. So even if “private information” in my particular case is not obtained, there is no guarantee that private information will not be obtained during the operation as a whole. After all, some people do unusual things in their cars, the period of the surveillance operation extends into months, and the CCTV footage in my case does show that the operator can zoom in, at will, to record details of what individuals are doing by the car. So I conclude that the Council cannot guarantee that it won’t obtain “private” information during its long surveillance operation.

Hence, I would then argue that the Council should therefore anticipate, because the operation is continuous (extending, I suspect, for every month of the year) that it is likely to obtain “private information” at some time (e.g. by zooming in). It follows therefore that RIPA is likely to be engaged and the directed surveillance is unauthorised/unlawful (as it does not meet RIPA’s requirements).

However, I admit the RIPA position is not as clear cut as the data protection one. But my conclusion is that the surveillance breaches the First and Third Data Protection Principles and is arguably in breach of the directed surveillance provisions of RIPA. Of course, the Council will no doubt dispute these claims.

Finally, I should report that the Council did take action in one area; it has repainted all the road markings so its revenue collection purpose can continue unabated. There is no signage in the parking bay.

References

The footage depicting my traffic offence (6 minutes; uneventful; puts children to sleep as they watch: YouTube link http://www.youtube.com/watch?v=vCBCjNiJDrw. (Note: the Post Office delivery van does not get charged a fine)

Westminster Mobile CCTV fair processing notice on mobile CCTV cars that are away from the point of surveillance (50 seconds in): http://www.youtube.com/watch?v=Lc8TTfVVW2w

Home Office 2010 Code of Practice on surveillance: Download Code-of-practice-covert

Possible fair processing notice depicting a Council's "revenue collection" purpose. Download CCTV POSTER_BLOG

The FOI request showing the purpose of surveillance and the frequency of surveillance Download CCTV Mobile FOI 2012- 0389

Advert

(a) Our Update session on October 29th in London covers all the important aspects of data protection in the last six months. Details on http://www.amberhawk.com/bookevents.asp  (A snip at £195)

(b) JUSTICE Event at Hunton and Williams: “Defamation, privacy and freedom of expression online”, London 20 November 2012

Privacy by Design and Isaac Newton: the need to address Newton’s Third Law

I have just come from a morning session on Privacy by Design (PbD) where the ideas, first presented by Dr Ann Cavoukian in 1995, are set to become tomorrow’s data protection orthodoxy (if the Regulation sees the light of day). The session started with a quotation from Newton, ostensible made when he published his ground breaking Principia in 1687: “if I have seen further, it is by standing on the shoulders of giants”.

In the context of PbD, I immediately thought that Newton’s Third Law of Motion was perhaps far more relevant: “for every action there is an equal and opposite reaction”. This blog explains why I suspect the issue of “reaction” has not been considered.

Let’s be honest. Since 1995, PbD ideas have not taken off and it is easy to see why. Suppose you went to your marketing manager and said “Hey, I have had a brainwave! Why not collect the minimum amount of personal data so we limit our use of the database and seek data subject consent if we want to do something different. Shall we give it a go?”.

I think most managers would give you short shrift because they would start from the position that technology is there to arrange business matters to enhance the data controller’s profit and not the data subject’s privacy.

You find this “data controller focus” elsewhere; for example in most security risk methodologies. These assessments start from the position of protecting the data controller’s assets and considering the business impact on the data controller. One needs to include Privacy Impact Assessment ideas if such risk assessments are to consider the impact on, or risks to, data subjects.

However, change the regulatory framework and PbD begins makes more sense for data controllers. So, for example, if you have £500,000 penalties for a data loss, then data minimisation makes sense as one cannot loose what one does not hold. The more personal data held, the greater the chance that the data controller will have a mishap. Add to this mix, a Regulator that is an “enforcer” (as per Regulation), then the consequences for the data controller of a breach a duty of care towards personal data becomes significant.

In other words, for PbD ideas to advance, they have needed legislative changes to “up the ante” for data controllers.

However, this does not explain why is PbD is an obligation in the Regulation?

Essentially, I think that PbD is an attempt to control the privacy threats arising from the implementation of modern technologies that now collect thousands of fine details about data subjects. For instance, a familiar electricity bill often used to be calculated over three months; now new smart meters record when you have a cup of tea, watch TV or have a shower. A phone company used to send a bill that is paid quarterly; now phone companies log who you called, for how long, and from what location. Is your mobile phone, therefore, a self-inflicted self-surveillance device? I will leave you to answer that one!

If PdB is “the action” (as per Newton) to reduce the privacy risks, “the reaction” will come from the law enforcement agencies. There is very little evidence that these agencies have considered the impact of a wider take up of PbD on their activities, mainly because there has been little take up of PbD ideas by data controllers.

However, make PbD a statutory requirement on all data controllers (as per the Regulation), then this position changes; such agencies will have to consider its impact on them. So, for example, if data minimisation is the norm and if law enforcement agencies see such data as being useful, then they will demand legislative changes for their retention. If the law enforcement agencies see that "useful" personal data could be collected, then as night follows day, they will ask for the law to require their collection.

So as more PbD techniques are adopted, I predict that there will be more data collection and retention demands from the authorities. These demands, if accepted by Government, then undermines the reasons for implementation of PbD in the first place.

As Newton Third Law states: every action has an equal and opposite reaction.

References

I have done previous blogs on Privacy by Design before:

PbD can accelerate the decline of privacy (see discussion as well)(http://amberhawk.typepad.com/amberhawk/2010/01/privacy-by-design-can-accelerate-the-decline-of-privacy.html)

Canadian Commissioner promotes the principles of privacy by design (http://amberhawk.typepad.com/amberhawk/2009/09/canadian-commissioner-promotes-the-principles-of-privacy-by-design.html)

Privacy by Design: A view from the Commissioner’s office (http://amberhawk.typepad.com/amberhawk/2010/01/hawktalk-privacy-by-design-a-view-from-the-commissioners-office.html)