Hawktalk

Roll out the bunting: Durant judgment is good as dead and buried.

The spectre of Durant has haunted and stalked data protection officers for more than a decade; however, a case taken under the FOI Act has just exorcised this particular ghost. That is my conclusion from reading of the Court of Appeal decision that was published earlier this week (Edem v The Information Commissioner [2014] EWCA Civ 92).

As Durant is now not the demon it was, it is important to trace the history (from Durant to Edem) to explain what has happened and why?

Durant has always been a problem for data protection practitioners because Appeal Court’s “helpful” notions of “biographical significance” and “focus” were, in practice, far from “helpful”. These Durant notions, hand down by a superior court, have been slavishly followed by the lower Courts, irrespective of the issue before them, raising all sorts of curious decisions – of which Edem was just one.

The problem in a nutshell: Durant’s “notions” applied to the content of personal data and ignored the context that always needs to be considered whenever any personal data are processed.

However, our journey starts with Mr. Edem’s FOI request which became subject to a Decision Notice (dated 26 May 2011) when the Information Commissioner declined to order the disclosure of the names of three members of the staff of the Financial Services Authority. At the Information Tribunal, Mr Edem argued that the names of those who were identified in his FOI request were not personal data.

Following Durant like an automaton, the Tribunal concluded that "In our view the Disputed Information (these are the names of employees) is not biographical in any significant sense" and that in this case "The information does not go beyond the recording of the data subjects' involvement in a matter that has no personal connotations. It simply concerns a transaction or matter in which the individuals in question were involved".

It is important to understand how the Tribunal came to this conclusion by following Durant. I have commented on Auld LJ (at paragraph 28 of Durant) where he said:

" ….It seems to me that there are two notions that may be of assistance. The first is whether the information is biographical in a significant sense, that is, going beyond the recording of the putative data subject's involvement in a matter or an event that has no personal connotations, a life event in respect of which his privacy could not be said to be compromised.”  {CP comment: with respect to the name of an official in a work capacity, the Edem Tribunal accepted that there was little “going beyond… an event that has no personal connotations” nor a “privacy” issue}.

Auld LJ continued (at para 28 also):

“…The second (notion) is one of focus. The information should have the putative data subject as its focus rather than some other person with whom he may have been involved or some transaction or event in which he may have figured or have had an interest, for example, as in this case, an investigation into some other person's or body's conduct that he may have instigated….{CP comment: in the Edem Tribunal, the official in a work capacity was deemed to be the equivalent of “some other person” as mentioned above}.

So there we have it; the Tribunal concluded that a recorded name held by a public authority is not personal data. Completely bonkers in my view - but there you are.

However, a name is hardly ever without a context. For instance, when I was a student (an apprentice quantum mechanic, no less!), there was a lecturer in the University called “John Smith”. Is a record of this name, personal data? However, the name of this “John Smith” (content of the data) cannot be separated from the context (i.e. this particular lecturer worked at a specific university chemistry department (the context)). This context allows this “John Smith” to be distinguished from the John Smith who was (another context follows) the leader of the Labour Party in the 1990s.

The Upper Tribunal Judge recognised that the content of the requested data had to be considered in context. That is why the Judge concluded:- "I've seen the name of officials and their names are not unique. But they can be identified from their names taken together with the contextual information of their grades and dates of employment. No one argued otherwise." (my emphasis).

So, Mr Edem had his victory reversed at the Upper Tribunal (a level below the Appeal Court). Fortunately, Mr Edem had another go; hence we arrive at the hearing in the Court of Appeal which then fettered the almost universal application of Durant.

It is pretty clear, that the Court of Appeal came to conclusion that the Upper Tribunal was correct and that recorded names were personal data. In its judgment, Moses LJ said:

• “It seems to me beyond question that those living individuals could be identified from a combination of their names and the documents emanating from the Financial Services Authority which show that they were working there ….”
• “In Criminal Proceedings against Lindqvist” (C-101/01, [2003] ECR 1-12971) the Court stated” that “the term personal data …. undoubtedly covers the name of a person in conjunction with his telephone co-ordinates or information about his working condition or hobbies."
• In “Commission v Bavarian Lager”(C-28/08 [2010] ECR 1-6055,) the Court “the definition of the concept of single 'personal data', correctly held that surnames and forenames may be regarded as personal data."

The real problem the Court had to address, therefore, was not dismissing Mr Edem’s claim (which “misunderstands the concept of an identifiable natural person”) but rather to avoid following Durant into the abyss.

The Court did this by picking up a comment from Buxton LJ (another Durant Judge) who agreed with everything which "had fallen from my Lord" (i.e. Auld LJ) adding that "The notions suggested by my Lord in his para. 28 will, with respect, provide a clear guide in borderline cases".(My emphasis)

However, the Appeal Court concluded that Edem was not a borderline case. There is no issue of “whether the information is biographical or sufficiently focussed upon a particular named individual” because “A name is personal data unless it is so common that without further information, such as its use in a work context, a person would remain unidentifiable despite its disclosure”.

The Court then went on to unequivocally give its blessing to the Information Commissioner's Technical Guidance to assist in determining "What Is Personal Data". This, according to the Court,“accurately sets out the effects of the statutory scheme” and“You need to consider 'biographical significance' only where information is not 'obviously about' an individual or clearly 'linked to' him". (CP comment: I have put this in bold italics because it is so important).

Following this advice, the Court concluded “the three names referred to in the e-mails were obviously about those three individuals and no further enquiry was needed. Judge Jacobs was right to reject the approach of the First-Tier Tribunal which was wrong as a matter of law”. Put simply, there is no need to apply the Durant tests when it is obvious you have personal data.

So there you have it. I think Durant has been marginalised and its “helpful notions” are only needed (i.e.  resurrected) when it is not clear from the content or context or both whether the data are personal data or not.

The only regrettable aspect is that it has taken an FOI case, taken by a persistent litigant in person, to get there. This is because the data protection regime was designed to have few cases going to the Tribunal, whilst those on the DP/FOI interface (and considered under FOIA) are almost ten a penny.

Also, whereas in data protection circles, Durant has almost become a term of abuse, the name Edem will become revered (perhaps as in “Welcome to the Garden of Edem”).

References

Edem v The Information Commissioner & Anor [2014] EWCA Civ 92 (http://www.bailii.org/ew/cases/EWCA/Civ/2014/92.html)

Hopefully, I will no longer be writing blogs such as:

Durant strikes again! The names of those investigating complaints are not personal data. http://amberhawk.typepad.com/amberhawk/2012/04/durant-strikes-again-the-names-of-those-investigating-complaints-are-not-personal-data.html  (This is my blog on the Edem case at the Tribunal).

CCTV images are accessible on subject access (or is it Durant misses the Dublin Bus?)  http://amberhawk.typepad.com/amberhawk/2011/10/cctv-images-are-accessible-on-subject-access-or-is-it-durant-misses-the-dublin-bus.html (Another Durant classic)

A bizarre tale from the data protection/FOI interface: http://amberhawk.typepad.com/amberhawk/2010/02/a-bizarre-tale-from-the-data-protectionfoi-interface.html (yes - truly bizarre!)

 

Briefing as to the status of the Data Protection Regulation

 

I thought I would write a blog that explains where we are in relation to the Regulation.

Just over two years ago, the European Commission published a proposal for a Data Protection Regulation to replace Directive 95/46/EC. Following publication, the Commission’s text has been scrutinised by the European Parliament and by the Council of Ministers. Each of European Parliament and the Council of Ministers can propose amendments to the Commission’s proposals and each approves a text containing amendments to the original Commission’s proposals.

The process results in two texts which, if approved, then go through a reconciliation procedure, which if successful, results in a compromise text agreed by the Parliament, Commission and the Council of Ministers. This compromise text becomes the Regulation enacted into law; if reconciliation is not possible, then the Commission’s proposal does not become law.

Last December, the LIBE Committee of the European Parliament agreed amendments to the Commission’s text (and this gained approval in the Parliament) but the Council of Ministers have not agreed its amendments; so the reconciliation procedure has not even commenced.

The reason for the failure of the Council of Ministers to agree a set of amendments is complex as there is common agreement that Directive 95/46/EC needs updating; however, there is no agreement as to the “with what”.

There are a number of Member States that want a Directive instead of a Regulation and there are a number of States that want an exclusion in the Regulation for the public sector; in practice there are a diverse number of alliances between Member States that express reservations over specific proposals (e.g. the level of prescription imposed on data controllers, granting extensive powers to the Commission).

In other words, the opposition to the proposals in the Regulation is not simple as, for example, saying that the UK and Irish are opposing whereas the Germans and French agree with most of it. If that were to be the case, a simple qualified vote would have determined the issue.

Because of the number of reservations from diverse Member States, and to avoid making premature, unchangeable decisions, Member States agreed to discuss issues in expert DAPIX committees and delay voting until majority agreement on a final text was in sight. It was assumed by many that this vote could have occurred at a Council of Ministers’ meeting held on December 6th last year.

However, at that meeting the legal counsel for the Council of Ministers (the appropriately named Mr. Legal) dropped a bombshell. He said that if the “one-stop shop” was implemented (this is the idea that when doing business in European Union, the data controller has one data protection regime and regulator to consider), it would be to the great detriment to data subjects and not compliant with the European Convention of Human Rights.

This legal position was publically disputed by legal counsel for the Commission. Council of Ministers agreed to delay a decision until the legal position was resolved. This has given rise to all the serious doubts as to whether this proposal will survive in its current form, especially if the legal counsel for the Council of Ministers does not change his mind, as the “one-stop shop” is a central to the original Commission’s proposal.

Even before this legal intervention, there was talk of carrying over the proposal for a Regulation to the next Parliamentary session and this accounts for the statement in the Communiqué issued after the European Summit Meeting of Heads of State (end of October). This said “It is important to foster the trust of citizens and businesses in the digital economy. The timely adoption of a strong EU General Data Protection framework and the Cyber-security Directive is essential for the completion of the Digital Single Market by 2015”.

Resolving the one-stop shop problem has been a focus of the Greek Presidency which commenced in January 2014. The Greeks have timetabled many DAPIX meetings between civil servants from Member States to discuss the Regulation and to try and fashion an agreement. However, this process has not been particularly transparent and no leaks have occurred; the lack of leaks is surprising as last year DAPIX leaked like a sieve.

Also in January, the European Parliament, Commission and Council agreed on a roadmap on the margins of the informal JHA Council in Athens in late January: Adoption of a (partial) general approach under the Greek presidency, trilogue and final agreement on a text is the objective before the end of 2014. Well that is the theory anyway.

As readers know, I am on the UK Government’s Advisory Committee on the Regulation. It has not met this year,  nor are meetings planned, so clearly the Government is not in need of advice. Some commentators think this is because the UK has been side-lined in the debate and whatever its views are, they carry no weight.

This is only part of the reason. I think that the UK Government is keeping stum because it is waiting to see what happens after the European Elections, perhaps hoping for a more favourable (euro-sceptic) outcome. Also Vivien Reding is moving on; she appears to be “dead-woman walking” as her term ends on October 31st. Indeed there are rumours that the Luxembourg Government is choosing another Commissioner which means that Ms. Reding will have to develop her political career elsewhere.

Finally, the European Parliament is likely to conclude its first reading with a vote (on the un-changed LIBE text) in plenary in March (most likely 11th). This means that the likely outcome will be that  European Parliament will have agreed a text of the Regulation but the Council of Ministers will not and whether the next Parliament (after May’s elections) will agree with the previous Parliament is very uncertain.

In summary, there is no agreement! And progress in the second half of 2014 is also a moot point. In short, I think it’s back to the drawing board – and if I were a betting person, any final agreement in the near future will be an agreement to make some minor tweaks to Directive 95/46/EC.

References

These deal with Member States view on the Regulation text

Ms Reding heralds a “disappointing day for data protection” as leading lawyers have a public cat-fight http://amberhawk.typepad.com/amberhawk/2013/12/ms-reding-heralds-a-disappointing-day-for-data-protection-as-leading-lawyers-have-a-public-cat-fight.html

EU’s Data Protection Regulation: divisions exposed as Member States show disharmony. http://amberhawk.typepad.com/amberhawk/2012/03/eus-data-protection-regulation-divisions-exposed-as-member-states-show-disharmony.html

Expect 1,000 objections by Member States to the EU’s Data Protection Regulation: http://amberhawk.typepad.com/amberhawk/2012/06/expect-1000-objections-by-member-states-to-the-eus-data-protection-regulation.html

 

 

Should national security certificates exclude the Data Protection Principles?

 

An analysis of Section 28 Certificates issued by the previous Labour Government shows that the exemptions for the national security function are excessive. The recent publication of a “memorandum of understanding” and analysis of the TfL Certificate (last week’s blog) shows that the current Government has continued this policy.

It is my view, that if the national security agencies were required to apply the data protection principles, subject to appropriate exemptions and an effective system of regulation (not necessarily by the Information Commissioner), then the extensive, mass surveillance undertaken by these agencies would  have been considered (and regulated) in the context of necessity, relevance and retention. Such obligations could have avoided the current controversies.

I have decided to re-publish these old Section 28 Certificates covering the national security agencies because, in the light of the Snowden allegations, they are pertinent to the current public debate over supervision of these agencies, I have also made them available to the Parliamentary Security Committee which has issued a call for evidence on the supervision of national security.

The blog was also stimulated by legal advice to Tom Watson MP (see references), which includes the issue of whether or not it is lawful for the Government Communications Headquarters (‘GCHQ’) to intercept bulk electronic data. In that advice, Jemima Stratford QC states:

“We have no information as to whether or not the Secretary of State has issued relevant section 28 notices. Nonetheless, what follows is based on the assumption that the Secretary of State may (and possibly has) taken some aspects of the intercept ‘programme’ outside of the scope of the DPA”.

This blog confirms that assumption.

Background to the Certificates

These Certificates were published by the Home Office in 2005 in response to a FOI request and one should assume that they are out of date. Despite this, these Certificates give quite a lot of detail of what these agencies do with personal data and this detail may be pertinent to the current furore over the extent of mass surveillance undertaken by these agencies (see the 2000 Certificates, in particular).

In addition, the TfL Certificates signed by the previous and current Home Secretaries have not changed much; so one can assume that the content of the “old” Certificates might be similar to the content of the current Certificates. You will note that these Certificates are of a very generic nature and like the TfL Certificate, can be published without any prejudice to the national security function. This has not happened.

The "New Labour" Certificates

Looking at these Certificates, there are four common themes; a complete exemption from the First, Second and Eighth Principles, the Section 55 offence, Commissioner’s powers of enforcement and the rights of access and objection. These latter exemptions from rights are understandable in the context of the national security function, and I will make no further comment on them.

In relation to the exemption from First Principle, it can be seen that only part of the exemption can be justified. For instance, the exemption from the need to provide a fair processing notice (giving a notice would be an act of “tipping off”) and from “lawful” processing (e.g. obtaining personal data in breach of an obligation of confidence) can be justified.

However, the exemption from Schedule 2 and 3 requirements are difficult to see as being justified. For instance, any public body can process personal data which is “necessary” for its statutory functions which, in this case, is “necessary for the national security functions”. It follows that an exemption from this obligation sends the message that the national security agencies might want the flexibility to process personal data that are “not necessary” for these functions.

Whether or not these agencies have processed personal data “unnecessarily” is at the heart of the Snowden allegations.

There is a similar “message to the public” with the exemption from the Second Principle. This Principle requires these agencies to obtain the personal data “lawfully” and not further process (i.e. use or disclose) these data for a purpose incompatible with the national security function. It follows that an exemption from this Principle implants the notion the national security agencies might want to process personal data for purposes that are incompatible with their national security function. There again, this is an issue at the centre of the Snowden allegations.

Likewise with the message derived from the exemption to the Eighth Principle. This Principle requires a data controller to perform a risk assessment on the adequacy of protection, prior to the transfer of personal data outside the European Economic Area (EEA), or apply an exemption from the need to assess adequacy (see Schedule 4).

I would argue that if these national security agencies were to make any transfer of personal data outside the EEA for a national security purpose, then such a transfer would be in the “substantial public interest” (and qualify from an exemption to assess adequacy). It follows that message sent to the public is that the national security agencies require an ability to transfer personal data outside the EEA for purposes that possess little in the way of “substantial public interest”.

In this context, the Snowden allegations concerning the personal data exchange between the NSA and GCHQ springs to mind; the USA is not seen as offering “an adequate level of protection” (certainly by many European Data Protection Commissioners),

Although the Certificates do not exempt the Third Principle (relevance) and Fifth Principle (retention), the exemption from Commissioner’s powers means that any breach of national security agencies cannot be enforced.

Quite simply, the Data Protection Act has been deliberately airbushed out so it does not exist for the national security agencies. The exemptions described by these Certificates leaves data subjects (e.g. any member of the public in the case of mass surveillance) with no easy mechanism of raising a problem.

Alternative mechanisms of redress.

There are limited means of redress in relation to national security function and an aggrieved individual could:

• Raise an issue with the Surveillance Commissioner or the Interception of Communications Commissioner. However, these Commissioners look at whether the Secretary of State and the national security agencies are using their powers appropriately and whether they have completed the relevant paperwork correctly; these Commissioners do not take complaints from individuals who are worried that they have been unjustly targeted as a subject of surveillance.

• Take action under the Human Rights Act; however, this exposes the individual to considerable costs if they lose the case. In the case of the national security agencies, the complainant takes on the State (e.g. the Home Office) backed by the tax-payer. This is a very uneven battle and a lengthy one – for instance, the mass retention of DNA (in UK v Marper) look six years to resolve.

• Complain to the Interception of Communications Tribunal: This is the forum where those who are seeking a hearing can get a Tribunal to look at the substantive issues. Because the Tribunal is not a public authority for FOI requests, there are no published statistics as to the number of complaints it receives. However, we do know the Tribunal publishes, on average, a single determination in a case per year. This suggests the evidential hurdles are high in bringing a case that is likely to succeed.

• Raise an issue with the Intelligence and Security Committee (ISC) of Parliament. This Committee was established in 1994 to examine the policy, administration and expenditure of the national security agencies; last year that it was given an increased remit to include oversight of operational activity and the wider intelligence and security activities of Government. In other words, the ISC’s remit is strategic and their website says they do not take individual complaints (however multiple complaints on the same issue could eventually trigger something that falls within the ISC’s remit).

In other words, there is a degree of oversight (which I think has been ineffectual – see references) but I can see no simple way that an individual can use to resolve issues within a reasonable timescale.

Apply the data protection principles to national security

In summary, I cannot see why the national security agencies should not be required to comply with the principles. For example, would it reassure the public if these agencies had, by law, to commit to the following obligations?

• Process personal data lawfully and ensure that any processing is necessary for their statutory functions.

• Ensure that personal data are processed in a way that is not incompatible with the national security purpose.

• Ensure that all personal data are adequate, relevant and not excessive in relation to the national security purpose.

• Ensure that personal data are kept no longer than necessary for the national security purpose.

• Ensure that personal data be kept secure

• Ensure that personal data are not to be transferred outside the EEA to a country that offers an inadequate level of protection unless there is a substantial public interest in any transfer.

Of course, there needs to be exemptions from fair processing notices, rights of access or profiling; data sharing might need to apply the exemption from the non-disclosure provisions and there might be other exemptions that are needed. What these exemptions are and their scope can be the subject of debate.

One should add that these data protection principles have passed the test of time. For instance, if the police and all their sensitive criminal intelligence collections can co-exist with these data protection principles for nearly three decades (since the 1984 Act), I cannot see why metadata held by the national security agencies is any different.

I also cannot see why a regulator cannot investigate to reassure the public that these principles are central to the processing of personal data for national security purposes; of course that regulator need not be the Information Commissioner.

Finally, I have to respond to the comments of  Jack Straw MP (Hansard: 10 Jun 2013, Column 38) where he stated that:

“Does the Secretary of State accept that many of our allies, leaving aside the United States, are astonished by the degree of control and supervision of our system of ministerial oversight, oversight by judicially qualified commissioners and oversight by the ISC, which surpasses that of most other western democracies?”.

To be poetic, this is a case of “a Jack covering his tracks”.

History records that Data Protection Act was enacted as a Home Office Bill, when Jack Straw was Home Secretary. Section 28 of the Act is his handiwork and it is his signature that adorns several Certificates (see below). He is responsible for exempting the national security agencies from applying the only set of enforceable principles which offer reassurance to the public and provide a mechanism for redress.

In my view, it is this misjudgement (to negate the data protection principles by creating an excessive exemption) that is at the root cause of the public relations disaster that now envelops the national security agencies.

The evidence suggests that the current Home/Foreign Secretaries are continuing to make the same mistake. A memorandum of understanding, just published by the Government, ensures the data protection principles are not enforced by the Information Commissioner. By contrast, these principles should be centre stage.

Over the next few months there will be many debates about national security.

Let us not forget that the trusted data protection principles, applied to the national security function, form a consistent basis to deliver the correct balance between the “purpose of national security” and reassurance to the public.

References (long list I am afraid)

Legal advice of Jemima Stratford QC: http://www.tom-watson.co.uk/2014/01/advice-from-jemima-stratford-qc-on-the-legality-of-reported-ongoing-gchq-practice

Download the Certificates here:

• Blog S.28 Straw Certificate Security Service 2000 Download Blog S.28 Straw Certificate Security Service 2000

• Blog S.28 Cook Certificate GCHQ SIS 2000 Download Blog S.28 Cook Certificate GCHQ SIS 2000

• Blog S.28 Blunkett Certificate Security Service 2001 Download Blog S.28 Blunkett Certificate Security Service 2001

• Blog S.28 Straw Certificate GCHQ SIS 2001 Download Blog S.28 Straw Certificate GCHQ SIS 2001

• Blog S.28 Straw Certificate GCHQ SIS No. 2 2001 Download Blog S.28 Straw Certificate GCHQ SIS No. 2 2001

• Blog S.28 Smith TfL Certificate 2007 Download Blog S.28 Smith TfL Certificate 2007

• Blog S.28 May TfL Certificate 2011 Download Blog S.28 May TfL Certificate 2011

Certificate published by the Government: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/100394/7605-Sec28-dpa.pdf

Memorandum of understanding about the application of the national security exemptions to FOI and DP (Jan. 2013): https://www.gov.uk/government/publications/memorandum-of-understanding-between-the-secretary-of-state-of-justice-and-the-information-commissioner.

Why I  think the current supervisory arrangements are weak

• Home Secretary spends 90 minutes per day with interception warrants?: http://amberhawk.typepad.com/amberhawk/2009/09/home-secretary-spends-90-minutes-per-day-with-interception-warrants.html

• Labour’s privacy legacy: 1 in 50 subject to communications surveillance: http://amberhawk.typepad.com/amberhawk/2010/10/labours-privacy-legacy-1-in-50-subject-to-communications-surveillance.html

• Is “one adult in 78” subject to surveillance of their communications?: http://amberhawk.typepad.com/amberhawk/2009/09/is-one-adult-in-78-subject-to-surveillance-of-their-communications.html