Hawktalk

Leveson, Press and data protection: the Rubicon has already been crossed.

Prime Minister, David Cameron, has expressed "serious concerns and misgivings" over bringing in laws to underpin any new body to regulate the press. Mr Cameron told MPs that legislation backing a regulatory body underpinned by statute would "cross the Rubicon" by writing elements of press regulation into the law for the "first time". Because of this, Mr Cameron, is “not convinced at this stage that statute is necessary to achieve Lord Justice Leveson’s objectives”.

In my view the Rubicon has been already crossed and the press are already subject to a statutory framework and a statutory regulator. There is no "first time". Mr Cameron has, like President George Bush, “mis-spoke” and the stated reason for not implementing Leveson’s requirement (i.e. that any new Press Regulator should also be underpinned by statute), simply does not wash.

Firstly, the statutory framework. In the Data Protection Act (DPA) there are the Special Purposes (e.g. journalism) and a Special Purpose enforcement mechanism (enforced by a statutory regulator - the ICO) underpinned by a statutory appeals mechanism (the Tribunal). Although the press don’t take much notice of the DPA because (wrongly) they think they are wholly exempt (via Section 32), there is a regulatory structure that applies to the personal data they process.

For instance, the Seventh Principle is not exempt from Section 32 and fully applies to all processing by the press. So, if the press lost personal data relating to “an exclusive exposure of a celebrity’s peccadillos” (say, for example, after a heavy liquid lunch on expenses that are not subject to FOI requests), that security breach would be a reportable data loss under the current data protection arrangements. Such a loss might even attract a Monetary Penalty Notice (a statutory penalty) as Sensitive Personal Data would have been lost.

In addition, the Section 32 exemption applies to those personal data processed “with a view to publication”. So those personal data not subject to a “view to publication” are fully subject to the Act (i.e. the S.32 exemption does not apply). For example, when the press unlawfully obtained ex-directory numbers, they had no intention to publish these numbers, so these personal data were not held "with a view to publication" (and the First Principle would apply fully).

Even with the Section 32 exemption the rest of the exemption was only meant to apply up to the point of publication (see Naomi Campbell; references). There are numerous Court Cases involving judges applying the data protection principles to press activities. The point being made is that processing by the press is already subject to a statutory framework which is legally tested.

Indeed, in the post Leveson era, one can expect that much more processing by the press (i.e. those things that are not going to be published) are identified as fully subject to the statutory-based DPA (and perhaps, we might have a delegate from the press on our courses!).

Even the existing Press Commission’s Code of Practice has already a statutory status under the DPA in exactly the same form as the “Ofcom Broadcasting Code” (originally published by the Broadcasting Standards Commission under section 107 of the Broadcasting Act 1996). Both these Codes, one voluntary the other statutory regulated, are equated by the “Data Protection (Designated Codes of Practice) (No. 2) Order 2000”

The explanatory memorandum for this Order states that both Codes have been designated “for the purposes of section 32(3) of the Data Protection Act 1998” and that “Compliance with any of the designated codes may be taken into account when considering for the purposes of section 32(1)(b) of the Act whether the belief of a data controller that the publication of any journalistic, literary or artistic material would be in the public interest was reasonable”.

In other words, the personal data processed by the press are subject to a detailed statutory regime (see references for suggested changes) and the current Press Commission’s Code of Practice has a statutory underpinning in relation to that processing "in the public interest".

So whatever the reason for not having a statutory provision that requires the independent regulator to be created, it is not "first time?".

That is why my urgent telegram message to Mr Cameron is quite simple: “Rubicon crossed. Not "first time". Valid excuse needed".

References

Could the Information Commissioner have stopped the use of ex-directory numbers by the press? http://amberhawk.typepad.com/amberhawk/2012/02/could-the-information-commissioner-have-stopped-the-use-of-ex-directory-numbers-by-the-press.html

For details of Leveson’s recommendations re data protection: see Panopticon Blog post http://www.panopticonblog.com/2012/11/29/leveson-inquiry-report-spotlight-on-proposed-data-protection-reforms/

Naomi Campbell v MGN Ltd. [2002] EWCA Civ 1373 (14 October 2002)  (from paragraph 108); changed the status of the S.32 exemption from that debated in Parliament.

Advert

We are running a course leading to BCS’s Foundation Certificate in Information Security Management in January in London; ideal for data protection people wanting to understand best practice in information security management. See side panel for links to all details as well as our DP/FOI courses.

 

Competition concerns bolster the need for a Data Protection Regulation

Support for the beleaguered Data Protection Regulation has come from an unlikely source; the Vice President of the European Commission responsible for Competition Policy. In a speech delivered yesterday, he has implied that mergers between organisations which then combine databases of personal information could raise competition concerns and that the failure to adopt  the Regulation’s “right to data portability” will definitely do so.

With respect to the latter point, Vice President Joaquín Almunia, said

• “I believe that a healthy competitive environment in these markets requires that consumers can easily and cheaply transfer the data they uploaded in a service onto another service.”
• “The portability of data is important for those markets where effective competition requires that customers can switch by taking their own data with them.”
• “In those markets that build on users uploading their personal data or their personal content, retention of these data should not serve as barriers to switching. Customers should not be locked in to a particular company just because they once trusted them with their content.” (Full speech – see references)

This stance has also been accepted by the UK Government. In the Government’s Impact Assessment (reported last blog) is the following statement: “Data portability is also expected to lead to economic benefits by lowering prices and increasing competition for services, in line with the Government’s midata initiative” (see references).

In that last blog, I also reported that the costings the UK Government had calculated were “suspect” . Sadly, in the Assessment, the economic benefit of this portability right in relation to improved competition, although expressly identified, has not been “monetised” (a horrible word for “estimated”); this means that a major economic plus for the Regulation has been ignored. This casts further doubt on the reliability of the Government’s costings in the Assessment.

With respect to competition concerns arising from the massing of personal data via a merger, Commissioner Almunia implied that the jury is out. He noted that “So far DG Competition has not had to handle cases where the accumulation or the manipulation of personal data were used to hamper competition” but that it had looked at “the merger between Google and Doubleclick in 2008”.

The Commissioner noted that that “The effect of the increase in the amount of personal information obtained by the merger entity was considered” but “Following an in-depth investigation, the Commission eventually cleared the transaction on competition-law grounds”.

Note that any future merger, where dominance in the processing of personal data arises, could raise competition issues. So neo-monopolies like Google watch out, perhaps.

Last week, the Managing Director of John Lewis, Andy Street, said Amazon would “out-invest” and “out-trade” UK companies if the Government does not take action to force the online retailer to pay tax fairly in Britain.  Clearly, “there is less money to invest if you are giving 27pc of your profits to the Exchequer” Mr. Street told Sky’s Jeff Randall.

Mr Street continued: “if you are domiciled in a tax haven you’ve got much more [money]. They [Amazon] will out invest and ultimately out trade us. And that means there will not be a tax base in the UK” and that both HMRC and the Treasury had to look at ensuring that money “earned in a particular country” was “taxed in that country”.

I think this misses the point. What is likely to happen is that after a hard day’s work, more and more customers will window shop on the Internet for the best deal. This will be picked up by the behavioural surveillance advertising industry which will then send messages to those that pay them (e.g. the likes Amazon). In other words, Amazon and other retailers are far more likely to pick up the customer’s wants and needs well before John Lewis and traditional retailers have a sniff.

That is why Amazon can “out-invest” and “out-trade” the competition in the high street; taxing Amazon will do little to redress that advantage.

References

Download the the Vice President’s speech here: Download BLOG_COMPETITION SPEECH

Details of the “midata” initative: see http://www.bis.gov.uk/policies/consumer-issues/consumer-empowerment/personal-data.

Impact Assessment at end of last blog: http://amberhawk.typepad.com/amberhawk/2012/11/data-protection-regulation-cost-of-compliance-has-the-uk-published-suspect-numbers.html

Advert

We are running a course leading to BCS’s Foundation Certificate in Information Security Management in January in London; ideal for data protection people wanting to understand best practice in information security management. See side panel for links to all details as well as our DP/FOI courses.

Data Protection Regulation cost of compliance. Has the UK published suspect numbers?

In January this year, the European Commission published an Impact Assessment which estimated that the new Data Protection Regulation would bring administrative savings to the EU, totalling €2.3 billion each year. An analysis published by the Government, last Friday, claims that the burdens would far outweigh the net benefit estimated by the Commission. For the UK alone, the UK claims that the annual net cost of the Regulation (in 2012-13 earnings terms) is estimated to be between £100 million and £360 million a year.

So who is correct?

The first thing to do is compare like with like. We can crudely extrapolate the total cost of Data Protection Compliance in the UK to all Member States of the EU if we assume that the burdens identified by the UK Government apply to the rest of Europe. We can do this by multiplying the UK calculated costs in proportion to the Qualified Majority Votes the UK has in the EU.

So for instance the UK has 29 out of 345 votes (the total for all Member States). So if between £100 million and £360 million a year is represented by the number 29; 345 relates to between £1.2 billion (€1.5 billion) and £4.3 billion (€5.3 billion).

Yes, I know it is a crude estimate, but it brings into focus what the UK Government is actually claiming: that the EU’s calculation is rubbish. We can also say that either the UK or the EU have their numbers badly wrong – perhaps, fraudulently so!

The Government’s view is that the Commission both overestimates the benefits achieved through harmonised EU data protection law and fails to address the full costs and unintended consequences of its own proposals, by only considering “administrative costs”.

The UK claims that its analysis addresses some of these failings by considering in full the impact of the proposed regime, including the additional costs for businesses, including small and medium enterprises, the additional costs to supervisory authorities, conducting data protection impact assessments and complying with other new obligations.

In its financial report, the UK Government estimates that:

• Notifying data loss breaches will cost £90 million per year
• Subject Access Requests (SARs) Requests will cost £30 million per year
• Data Protection Impact Assessments (DPIAs) will cost £80 million per year
• Data Protection Officers (DPOs) will cost £160 million per year
• ICO costs will increase to £40 million per year
• Demonstrating Compliance will cost £30 million per year

Commentary on the above cost estimates

The Government state that the costs associated with notifying data losses are £90 million per year for five years, increasing to £100 million within 5 years. I have some difficulty with this figure as the cost of data losses is more or less constant over 2016-2025.

In my view, this constant profile does not take account of the regulatory framework which will increasingly fine such data losses; additionally the requirement to undertake DPIAs should also identify and reduce risks. Given that most data controllers will  want to reduce their exposure to risk I would have expected that the cost profile of data loss would decrease over 2016-2025.

According to the Government’s costings, SARs cost between £50-£100 each and cost £30 million per year over 2016-2025. To arrive at this the £30 million figure, the Government are estimating that there are going to be an additional half a million Subject Access requests per year because access is free. Personally, I can’t see why there should be an extra half million subject access requests just because subject access is free to the data subject.

In my experience, data subjects use a SAR to sort out some personal problem or other with a specific data controller; whether the cost is £10 or £zero, a small fee is not going to dissuade data subjects from seeking access.

In addition, there are 355,000 registered data controllers. Spread those half million SARs around these data controllers, then you have an average increased work-load of 1.5 SARs per year per data controller. This increase in SARs, expressed in this way, does not appear onerous to me. In addition, as more and more data controllers provide on-line access to customers to their own personal data, then I would expect the number of formal SARs to decline and not flatline as in the Government’s Impact Assessment

Data Protection Officers (DPOs) are assumed to cost £160 million per year. Well I think that many large data controllers have allocated someone to do the data protection job (with job title data protection officer). I therefore have serious doubts about this number in the Impact Assessment as it takes no account of the current position where such data protection staff already exist.

With respect to Data Protection Impact Assessments, I simply don’t believe the £80 million price tag. Doing a DPIA is a job for the DPO isn’t it? If “yes”, we have some double accounting here. The Government in fact thinks a small DPIA costs £11,200 (page 21 of the Impact Assessment). Also, as the point of a DPIA is to integrate data protection compliance into a new and existing processing; if done properly, it should reduce year on year DP compliance costs and risk factors.

Likewise with the “keeping documentation requirements”

• Maintaining documentation of all processing activities (Article 28);
• Maintaining documentation of data protection impact assessments that are carried out (Article 33)
• Documentation on the data protection officer (Article 35);
• Obtaining prior authorisation from the supervisory authority for processing (article 34).

The Government see these activities as costing £20 million a year; by contrast, I see it part of the DPO’s role which is already accounted for.

According to the Government, the ICO’s office needs to more than double its current data protection budget to £40 million per year. What do you think the response would be if a public body approached Government and said “Please can I have twice as much?”. Simply not credible.

In its statement to Parliament, the UK Government reverted to the stance it has taken since 1984; the fact that data protection is seen more as a cost on business than protection of the individual.  This is made clear in the Parliamentary statement which concludes:

“The UK Government is seriously concerned about the potential economic impact of the proposed data protection Regulation. At a time when the Eurozone appears to be slipping back into recession, reducing the regulatory burden to secure growth must be the priority for all Member States.”

Finally, can I just put contrary figures? There are 60 million data subjects in the UK and 355,000 registered data controllers. The Government are complaining that £200 million per year is too much; this is £564 per data controller per year or £3 33 pence per data subject per year over all data controllers. This latter figure is less than a penny per day.

So, I will ask you a question: is your privacy worth a penny per day? If so, then the Government's costings can be dismissed.

I have some real issues with how this Data Protection Regulation works for Data Controllers; cost is not one of them.

.

References

Download the Government costings here: Download Blog Nov2012 eu-data-protection-reg-impact-assessment

Parliamentary Statement about the costings is at http://www.parliament.uk/documents/commons-vote-office/November_2012/22-11-12/7-Justice-DataProtection.pdf

Advert

We are running a course leading to BCS’s Foundation Certificate in Information Security Management in January in London; ideal for data protection people wanting to understand best practice in information security management. See side panel for links to all details as well as our DP/FOI courses.

 

A curiosity concerning the Monetary Penalty Notice issued to Scottish Borders Council

The Scottish Borders Council, through its Appeal against its recent Monetary Penalty Notice (MPN), could undermine the “prompt payment” discount offered by the Information Commissioner.

In its Press Release dated October  22nd, the Council said it had launched an appeal over the size of a penalty from the Information Commissioner's Office (ICO) after a self-reported data breach. The ICO issued a £250,000 fine to Scottish Borders last month after files relating to the Council were discovered in a recycling bank. The Council had employed a data processor for a number of years without regard for the contractual obligations in the Seventh Principle.

Scottish Borders Council (SBC)’s press release then continues:

“the fine has been paid in order to achieve a 20% discount on the total amount but this was done so with the caveat that SBC still reserved the right to appeal. The appeal has been lodged in a written submission to the Information Tribunal and the ICO has until 2 November to file a reply to the appeal. The case will then go to a three-judge panel for a decision, which is expected by the end of January”.

A quick visit to the Tribunal web-site shows that, as of yesterday, the Appeal is still listed.

Hang on a second! I had always thought that the 20% payment was for those data controllers who admit their mistake quickly; those data controllers who want to contest the MPN at the Tribunal loose the 20%. What Scottish Borders is doing is pay up and also Appeal.

A quick call to the ICO’s Press Office reveals that the ICO thinks on the same lines as I do. An ICO spokesperson said:

• “The Commissioner operates an early payment scheme for all civil monetary penalties served. Under that scheme, a data controller who has been subject to a penalty may obtain a 20% discount if the Commissioner receives the full payment of the penalty within 28 calendar days of the notice being served.

• The objectives of the early payment scheme are to encourage early payment of the penalties and reduce the costs to the public purse entailed on pursuing enforcement action and responding to challenges to the notices. The scheme operated by the Commissioner is similar to that operated by other regulators, such as the Financial Services Authority.

• There is no provision under the scheme which allows a data controller to make a payment subject to reservations, for example, by reserving his right to appeal against the penalty. The effect of such reservations would be to nullify the advantages which the scheme is intended to achieve”.

So what I assume has happened is that the ICO has asked for the Appeal to be struck off the Tribunal list, but the fact that it hasn’t been struck off might mean that the Appeal will proceed. If Scottish Borders are successful, it appears that data controllers can pay early and also Appeal; the ICO’s statement implies that the ICO has little reason to offer a 20% early payment discount.

Of course, what might happen is that the Tribunal could reinstate the full MPN. In which case, Scottish Borders would have lost 20% of its £250K (i.e. £50K) and would have to shoulder the costs of its Appeal (little change from £80K-£100K, I suspect). In other words, the Council is risking around £130K-£150K on top of the £200K fine it has already paid. This could be a public relations disaster if it goes wrong.

Even if it “wins”, the Council still bears its own costs. This means to cover its costs and show that its Appeal gamble has paid off, the MPN has to be reduced by more than half (i.e. to less than £100K). There appears to be little point winning an £80K-£100K reduction in a MPN if you have to spend £80K-£100K on your own costs getting that reduction!

Advert

JUSTICE evening event at Hunton and Williams: “Defamation, privacy and freedom of expression online”, 30 St Mary Axe, London EC3A 8EP (the London “Gherkin”) 20 November 2012 –http://www.justice.org.uk/events.php/46/life-and-law-online-defamation-freedom-of-expression-and-the-web (£50)

We are running a course leading to BCS’s Foundation Certificate in Information Security Management in January in London; ideal for data protection people wanting to understand best practice in information security management. See side panel for links to all details as well as our DP/FOI courses.

 

UK Government opposed to the Commission’s Data Protection Regulation

At a meeting of the Council of Ministers at the end of last month, the UK Government joined the Governments of Denmark, Slovenia, Belgium, Hungary and Sweden in opposing the Commission’s Data Protection Regulation; instead these countries want a new Data Protection Directive. Only Bulgaria, Germany, Spain, Netherlands, Luxembourg, France, Italy, Greece and Ireland expressed support for the concept of a Data Protection Regulation.

Sensing that the Regulation might be in trouble, the European Commissioner proposing the Regulation (Ms. Reding) stated that she will “help to progress” an agreement by offering to remove 40% of the Commission’s delegated powers; furthermore, she said that she would introduce some new “flexibility” with respect to the administrative burden on SMEs and how the Regulation would impact on the public sector.

At that meeting, Ministers from Finland, Romania, Estonia, and the Czech Republic stated they had not yet formulated a view about whether they preferred a Regulation or a Directive. The silence of Ministers representing Austria, Cyprus, Latvia, Lithuania, Malta, Poland, Portugal, and Slovakia means that they too are undecided. So in summary it is: 9 for a Regulation, 5 for a Directive and 13 floating voters.

The five countries wanting a Directive did not say that they wanted the data protection proposal in the field of law enforcement proposal to be merged with any new Directive that replaces the Regulation. Although it would be reasonable to assume that this merger makes sense, this rational prospect is not at all certain (especially as the Data Protection Principles of the Regulation are different to those of the Directive). Additionally, the fact that none of the five Member States suggested it (when it is so obvious) means that it is possible to end up with two Data Protection Directives – not one!

For the UK, Secretary of State Chris Grayling MP, stated that the Regulation hindered progress to an agreement and that the Directive route offered the prospect of more rapid progress. The UK position is that a Regulation will not provide legal certainty and a Regulation could have the effect to lower national standards (e.g. in Germany, Hungary, Slovenia).

Sources close to the discussions say that the UK has serious concerns with respect to:

• Administrative burdens and the blanket requirements on documentation and data protection officers as the Commission has underestimated the costs of this obligation;
• Exemptions for SME’s (under 250 employees): the UK is against the criteria based on the number of employees, as arbitrary. Instead it wants the nature of the activities or the type of personal data processed to form part of the criteria for the exemption to apply;
• Impact on consumer of the definition of “consent”: the UK position is that it is too cumbersome and will disturb the on line experience of users; and
• Free access to personal data: The UK argue that if subject access is free, the volume of requests will increase and there could be abuses; even personal injury lawyers could try to obtain financial gains out of the provision.

At our Update session in October, our guest speaker from the MoJ stated that the UK has also concerns with:

• The “Right to be Forgotten”; although inspired by social media, the UK is concerned that it is unrealistic.
• The obligatory need for a Data Protection Officer without consideration of the personal data being processed;
• Data loss breaches and the costs and the effect of data subject notification fatigue;
• Adequacy processes in relation to transfers outside the EEA; authorisation processes for transfers, contracts and BCRs;
• Interoperability with other regimes (Convention 108 and wider world); transfers to third countries and how enforcement is to work in practice?

It is noteworthy that three delegations (Germany, Bulgaria, Denmark) expressed concern that the public sector would have to abide by all the data protection rules. This raises the prospect that any “flexibility” shown by the Commission might involve the private and public sectors having to apply different data protection rules whereas law enforcement (via a separate Data Protection Directive) might have different set of data protection rules again.

This is hardly what one calls “harmonisation” and the late Oliver Hardy's catchphrase immediately springs to mind: "Well, here's another nice mess you've gotten me into!".

The reason why the UK wants a Directive is easy to explain.  A "regulation" is a binding legislative act across the EU and must be applied in its entirety across the EU. For example, when the EU wanted to protect the names of agricultural products coming from certain areas such as Parma Ham, the Council adopted a regulation.

By contrast a "directive" is a legislative act that sets out a goal that all EU countries must achieve; however, it is up to the individual countries to decide how. This was the case with the working time directive, which stipulates that too much overtime work is illegal which set out minimum rest periods and a maximum number of working hours; it was for each country to devise its own laws on how to implement it.

So if the UK gets its way and a new Data Protection Directive is fashioned, the UK can implement its provisions in its own way. However, if each Country can go its own way (as with Directive 95/46/EC) then you risk the harmonisation objective of the Regulation. So if there is any divergence in views as to whether the UK has implemented the Data Protection Directive properly, then infringement proceedings can commence (in secret).

Does this have a depressingly familiar ring? Do you recognise this as a case of déjà vu?  Since Durant, the EU has said that the UK’s Data Protection Act is a deficient implementation of Directive 95/46/EC. Full details of the alleged discrepancies (which relate to nearly half the Articles in the Directive) have yet to be revealed (see references). If you want to follow this particular seven year FOI saga which is due for an oral Tribunal hearing on Jan 17th, tickets are available at the Amberhawk box-office.

What is also clear from the recording of October’s Ministerial get together, is that December’s meeting is going to be crucial. The undecided Member States have to get off the fence and it won’t take many additional votes to make the Regulation untenable. (The decision is taken by QMV which currently requires 255 out of 345 votes; the five Member States in opposition have 68 votes already; the Regulation supporters have 160).

In the last blog on this Regulation (30th October), I summarised the position of the Commission as a choice between “give way” or “give in”. It appears that this choice is going to be made to Ms Reding a lot earlier than she or I expected.

Advert

JUSTICE evening event at Hunton and Williams: “Defamation, privacy and freedom of expression online”, 30 St Mary Axe, London EC3A 8EP (the London “Gherkin”) 20 November 2012 –http://www.justice.org.uk/events.php/46/life-and-law-online-defamation-freedom-of-expression-and-the-web (£50)

We are running a course leading to BCS’s Foundation Certificate in Information Security Management in January in London; ideal for data protection people wanting to understand best practice in information security management. See side panel for links to all details as well as  our DP/FOI courses.

References

You can see the various Member State positions at http://video.consilium.europa.eu/webcast.aspx?ticket=775-979-12048.  The data protection agenda item (Friday, October 26th, 2012) starts at 3 hours and 2 minutes in; Chris Grayling (for the UK) speaks at 03:19:46.

To see the level of disharmony over the Regulation: see http://amberhawk.typepad.com/amberhawk/2012/06/expect-1000-objections-by-member-states-to-the-eus-data-protection-regulation.html

Also see “Psssst! Want to know what the UK or any other Member State thinks about the Data Protection Regulation?” at http://amberhawk.typepad.com/amberhawk/2012/08/psssst-want-to-know-what-the-uk-or-any-other-member-state-thinks-about-the-data-protection-regulatio.html

Why the European Commission believes that eighteen of the thirty  four Articles in the Data Protection Directive 95/46/EC have not been properly implemented by the UK Government. See . http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html (and attachments at the end of that blog)

Information Commissioner’s enforcement proceedings links Article 8 to unlawful processing.

Gosh, crumbs and crikey! Talk about the “Road to Damascus”.

The Information Commissioner, in his Enforcement Notice issued to Southampton City Council in July, has made an express link between Article 8 of the Human Rights Convention and lawful processing under the First Data Protection Principle. Furthermore, Southampton has appealed the Notice; this means the Tribunal should hear arguments about Article 8 and adjudicate, in detail, on how Human Rights and Data Protection legislation interact.

I have often moaned (and moaned) about the fact that the Commissioner does not do “lawful” processing (see references). However, a stinging judgment in the “Solicitors from Hell” case (which mainly rebuked the Commissioner for his interpretation of the “domestic purpose” exemption), a key passage stated the following re the issue of lawful processing under the Data Protection Act (DPA):

... "The DPA does envisage that the Information Commissioner should consider what it is acceptable for one individual to say about another, because the First Data Protection Principle requires that data should be processed lawfully. The authoritative statements of the law are to be found not only in the cases cited in this judgment (including para 16 above), but also by the Court of Appeal in Campbell v MGN Ltd  [2002] EWCA Civ 1373 [2003] QB 633 paras [72] to [138], and in other cases. As Patten J made clear in Murray, where the DPA applies, if processing is unlawful by reason of it breaching the general law of confidentiality (and thus any other general law) there will be a contravention of the First Data Protection Principle within the meaning of s.40(1), and a breach of s.4(4) of the DPA”…. (paragraph 25 of the judgment; my emphasis).

In paragraph 3 of the Enforcement Notice, the Commissioner describes the offending processing in the following terms:

“…the data controller’s policy (effective from 26 August 2009) that all licensed taxis and private hire vehicles have to be fitted with a CCTV system that features an audio recording facility that is in permanent operation. The policy results in the recording of all driver and passenger conversations (including mobile telephone calls) that take place in taxis and private hire vehicles licensed by Southampton City Council.

Accordingly in paragraph 9, the Enforcement Notice says:

“The Commissioner has further taken account of the effect of the incorporation in English law of the European Convention on Human Rights (“ECHR”), by virtue of the Human Rights Act 1998, in deciding whether or not to serve an Enforcement Notice. In particular, the Commissioner is mindful of the provisions of Article 8 of the ECHR in that drivers of taxi and private hire vehicles and their passengers have the right to respect for private and family life which has been unlawfully interfered with by the processing referred to in paragraph 3. A breach of Article 8 will also contravene the lawful processing requirement of the First Data Protection Principle.” (Hurray – my emphasis)

Another notable thing about this Enforcement Notice is that the Commissioner is “mindful of the CCTV, Employment and Privacy Notices Codes of Practice”. Although these Codes are not statutory Code of Practice (i.e. voluntary), it will be interesting to see what status the Tribunal gives them. If the Tribunal says, for instance, asserts that they are important documents describing data protection practice, then they should be treated far more seriously.

For instance, I think that if a data controller says on his web-site that he has implemented the CCTV Code of Practice and does no such thing, then this statement is misleading and is likely to result in unfair processing.

Finally, the Enforcement Notice says the data controller has no Schedule 2 grounds for the processing. This follows as if the processing is not "necessary" (as required by Schedule 2 grounds other than data subject consent), it will not be “necessary” in terms of the exemptions in Article 8(2) which Article 8(2) requires that any law that permits interference is “necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others” (My emphasis to the link, through that word "necessary" as both are used in A.8 of ECHR and Schedule 2 of the DPA).

This Tribunal is listed for the end of January; it could then be the start of a legal process that strengthens data subjects’ rights considerably. Because as soon as Article 8 is linked to the lawfulness aspects of three Data Protection Principles (First, Second, Seventh), and if the Information Commissioner takes up more relevant cases, then in my view, the protection of the individual has just increased dramatically.

And that without the need for any Regulation.

Advert

JUSTICE evening event at Hunton and Williams: “Defamation, privacy and freedom of expression online”, 30 St Mary Axe, London EC3A 8EP (the London “Gherkin”) 20 November 2012 –http://www.justice.org.uk/events.php/46/life-and-law-online-defamation-freedom-of-expression-and-the-web (£50)

We are running a course leading to BCS’s Foundation Certificate in Information Security Management in January in London; ideal for data protection people wanting to understand best practice in information security management. See www.amberhawk.com for details.

References

Southampton City Council Enforcement Notice: http://www.ico.gov.uk/news/latest_news/2012/~/media/documents/library/Data_Protection/Notices/southampton_cc_enforcement_notice_20120723.ashx

Solicitors from Hell: Judgement reinforces the link between “lawful processing”, the First Data Protection Principle and human rights/other laws. http://amberhawk.typepad.com/amberhawk/2012/01/judgement-reinforces-the-link-between-lawful-processing-the-first-data-protection-principle-and-human-rightsother-law.html

Information Commissioner should enforce Article 8 privacy rights http://amberhawk.typepad.com/amberhawk/2010/04/information-commissioner-should-enforce-article-8-privacy-rights.html