Hawktalk

Italian Data Protection Regulation text exposes Member States disharmony; risk of weaker protection for data subjects increases

Xmas has come and to get you in the festive mood, I present a link to 232 pages of gripping holiday reading. Forget all those TV repeats over the holiday period; in the forthcoming break why not snuggle down with the latest DAPIX version of the Data Protection Regulation which identifies the current thinking of Member States.

I have made two preliminary conclusions:

• I think that the Data Protection Regulation will not be agreed until the end of 2015 (if that); this is because Member States cannot agree on the contents of the text. I counted over 500 “reservations” in the footnotes from diverse Member States which are clearly identified in the text (a “reservation” means that the Member State really does not like the provision).

• More worryingly, I am beginning to think that the protection afforded to individuals by the Regulation could easily be less than the Directive 95/46/EC. Quite simply, in its attempt to resolve or accommodate  Member States concerns, Data Subjects are being put at risk. This blog explains why.

When looking at the DAPIX text (see references), please note the warning given on page 1:

“All changes made to the original Commission proposal are underlined text; where text has been deleted, this is indicated by (…). Where existing text has been moved, this text is indicated in italics. Changes that were not yet fully discussed in DAPIX are marked in bold underlining.”

You only need to scan a few pages to see that the changes from the Commission’s original proposals are considerable. In addition, even when Member States do not enter a reservation, they are clearly “unhappy bunnies” as the footnotes record the many disagreements with the Italian's text.

I cannot see these disagreements being resolved unless a political fix is agreed (e.g. if you vote for our version of “consent”, we will support your position with respect to “the right to object”). This method of agreement depends on "understandings" made in "smoke filled back rooms”. It is not way to identify privacy rules that hope to gain respect from data controllers and data subjects; indeed, it risks the emergence of a mish-mash  text that will probably irritate both communities.

So why is the protection for individuals reduced? Well just look at the exemptions. For instance, there are a number of Articles (e.g. Article 21 dealing with exemptions) which begins with, or contains the words “Member State law…” (i.e. the Member State can determine how the Article or provision applies in that State). There then follows a longer list of exemptions than in Article 13 of Directive 95/46/EC. In other words, Member States can determine more exemptions to suit their needs.

"Member State law" flexibility can be applied to other provisions: namely in Articles 4, 9, 14, 17, 24, 26, 30, 35, 44, 48, 49, 53, 55, 56, 74, 79, 80a, 80aa, 83, and 84. This means that the provisions in these Articles could diverge across all Member States. The Regulation, remember,  is supposed to harmonise data protection; these Articles with their reference to “Union or Member State law” comprise a recipe for disharmony.

For instance Member States have flexibility with respect to the definition of “data controller” (Article 4(5)) and Article 9 (Sensitive personal data). How will this flexibility be used? – Well your guess is as good as mine. 

For example, using the terminology of the 1998 Act, what do you think of this new very “accommodating” Schedule 3 criterion:

The processing of sensitive personal data “is necessary for the performance of a task carried out for (…) reasons of public interest, on the basis of ... Member State law which shall provide for suitable and specific measures to safeguard the data subject's legitimate interests”

In addition, there are about 30 COM “reservations” entered by the European Commission which is clearly miffed about the changes to its original text (e.g. the deletion of the “data minimisation principle”; the “deletion of 'explicit' in the definition of ‘consent’” or even the deletion of the “reference to the UN Convention on the Rights of the Child”). Often there is no detail for the deletion except for “COM reservation on deletion” (of the text identified by those ubiquitous “(…)”.

There are new provisions that reinforce harmony, but these are through the European Data Protection Board. These provisions are not agreed by Member States (witnessed by all the bold underline). It appears to me that the new proposal amounts to the European Data Protection Board making recommendations on harmonisation. The making of recommendations is not a credible mechanism that ensures harmonisation.

From January 1st, the DAPIX text is handed to the Latvians to sort out the mess; it does not need Nostradamus to predict the Latvian’s New Year hangover will probably last the following six months.

Merry Xmas - Hawktalk is back in the New Year

References

Download the December 2014 DAPIX text here Download DAPIX TEXT eu-council-dp-reg-December 2014

Those looking for a seasonal Xmas Card are referred to "Leaked GCHQ Xmas Card resonates to Tolkien as Advocate General slams Data Retention Directive as breaching ECHR": http://amberhawk.typepad.com/amberhawk/2013/12/leaked-gchq-xmas-card-resonates-to-tolkien-as-advocate-general-slams-data-retention-directive-as-bre.html

What does the ECJ Ryneš ruling mean for the Domestic Purpose exemption?

As expected the European Court of Justice (ECJ) judgement on the domestic purpose exemption followed the Advocate General’s reasoning (see my previous blog). The Court concluded that personal data collected from a public space by a home CCTV system (e.g. from the road outside the home) does not qualify for the domestic purpose exemption.

This blog explores what I think this judgement means in practice (e.g. for householders, the insurance industry).

In summary, like any other CCTV, “domestic” CCTV surveillance has now to adhere to the usual data protection norms (e.g. signage, notification etc). Note that the recently issued CCTV Code of Practice from the ICO is likely to be amended; the Code admits that “The ICO will review its position on this aspect of domestic use (of CCTV) when the CJEU issues its final judgment. This may lead to the ICO updating this code or issuing supplementary guidance”.

The key conclusions of the ECJ judgment are:

“…the image of a person recorded by a camera constitutes personal data … inasmuch as it makes it possible to identify the person concerned...” and that “…surveillance in the form of a video recording of persons, as in the case before the referring court … constitutes …the automatic processing of personal data” (Paragraphs 22 and 25).

“As is clear from Article 1 … and Recital 10 …(that)  .. Directive 95/46 is intended to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data…. the exception provided for in the second indent of Article 3(2) of that directive must be narrowly construed”. (Paragraphs 27 and 29; my emphasis).

“Consequently… the operation of a camera system, as a result of which a video recording of people is stored on a continuous recording device such as a hard disk drive, installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitors a public space, does not amount to the processing of data in the course of a purely personal or household activity...” (Paragraph 35; my emphasis).

Impact of the judgement

The following are my conclusions as to what this judgment means in practice.

Those selling domestic CCTV systems, drones (one of the nation’s “must have” Xmas present if press reporting is correct) or promoting the use of CCTV (e.g. in relation to insurance; see next bullet point) should provide advice that such systems can be fully subject to the Data Protection Act if they monitor public spaces and capture details of individuals, especially if these images are posted on the Internet or disclosed to third parties.

Drivers of cars who install monitoring devices just in case the images are needed by an insurance company or police (e.g. in the event of a motoring accident), cannot rely on the domestic purpose exemption. The same goes for cyclists with helmet cameras to record road incidents for evidential purposes.

Those who use domestic cameras to undertake surveillance of “nuisance” children from a housing estate or neighbours who allow their dogs to foul the footpath, where the intention is to copy the footage to a Local Authority for enforcing anti-social behaviour legislation, cannot rely on the domestic purpose exemption.

Those taking images of women entering an abortion clinic in order to display images on the Internet in order to “shame” those women similarly cannot rely on the domestic purpose exemption.

Why do I think the above? Well the scenarios above meet all the criteria identified by the ECJ (monitoring of a public space followed by likely disclosure to the public or to the authorities). The disclosure is essential in order to provide evidence that the recording has taken place; in Ryneš the tipping point for the legal action was that CCTV images were disclosed to the police.

If “domestic” CCTV images were also to be posted on the Internet, then a domestic purpose “double whammy” would happen. The domestic purpose exemption would not apply for reasons of Ryneš as well as Lindqvist (see references; Lindqvist is the ECJ ruling that determined the domestic purpose exemption was did not apply to personal data posted on a website).

What about parents taking camcorder images at those nativity plays at a primary school; a common practice at Xmas? Well I think that this is a  likely “no change” so long as the recorded images are not published (e.g. on YouTube). I state this because paragraph 32 of the judgment states:

“Accordingly, so far as natural persons are concerned, correspondence and the keeping of address books constitute, in the light of Recital 12 to Directive 95/46, a ‘purely personal or household activity’ even if they incidentally concern or may concern the private life of other persons”.

I think that so long as the recorded images of the school play are not made public (i.e. they remain “exclusively personal or domestic”; Recital 12 of Directive 95/46), then it can be argued that the recording is incidentally capturing other members of the cast. Note that if the images are kept private, then there is no evidence in the public domain that the recording of personal images ever successfully took place.

What about the use of domestic CCTV to watch neighbours who are sunbathing in their back-garden? Well I think that if the judgment restricts the surveillance of public spaces, then the surveillance of a private place for a purpose which involves invading another individual’s private space, will also fall outside the domestic purpose exemption. This is because the exemption, to use the words of the judgment, “must be narrowly construed” (quoted above).

However, having said this there is a high evidential hurdle to jump. For instance, how do you prove your neighbour is undertaking this kind of surveillance activity without having the evidence (e.g. access to a copy of actual recorded images)?

This is why a disclosure of images to a third party (e.g. to the Police) or posting the material on the Internet are important practical components associated with this judgement, as such disclosure provides the evidence that the images were actually made. Without such evidence, it will be difficult to prove that any processing of personal data has taken place, a necessary precursor if one is to claim that there has been a breach of the Act.

In addition, if someone posts the images anonymously on the web, then it is going to be difficult to find the responsible data controller. The only recourse the data subject would then have would be to that much maligned “right to be forgotten” (Google Spain); but that is another story!

Notification

Finally, there is the problem with notification and the £35 fee. Technically households that have CCTV in similar circumstances to Ryneš are processing personal data without being notified or an applicable exemption from notification;  as readers know, failure to notify is currently an offence. The same problem arises if personal data are posted on the Internet following Lindqvist (and I suspect this notification problem is a major reason for the ICO ignoring Lindqvist).

To resolve this problem, I point out is that the Government has powers to modify notification requirements or create new exemptions to notification. In my view, such an exemption is now needed to decriminalise a large section of the population who are wholly unaware that they are committing a crime (e.g. those who post images on Facebook; households that already have domestic CCTV).

However, such a notification exemption does not negate other aspects of the Act. For instance, the ICO can advise, enforce and issue Monetary Penalty Orders depending on the seriousness of any “domestic processing incident”. And that is how it should be.

References associated with this blog

11th December 2014: Judgment in Case C-212/13; Ryneš. http://curia.europa.eu/juris/liste.jsf?num=C-212/13

6th November 2003: Judgment in Case C-101/01; Lindqvist. http://curia.europa.eu/juris/liste.jsf?language=en&num=C-101/01

13 May 2014: Judgment in Case C-131/12; Google Spain and Google. http://curia.europa.eu/juris/liste.jsf?num=C-131/12

ICO’s Data Protection Code of Practice for Surveillance Cameras and Personal Information: https://ico.org.uk/media/for-organisations/documents/1542/cctv-code-of-practice.pdf

Previous blog: D-Day for the Domestic Purpose exemption and the use of CCTV installed at home. http://amberhawk.typepad.com/amberhawk/2014/12/d-day-for-the-domestic-purpose-exemption-and-the-use-of-cctv-installed-at-home.html

 

D-Day for the Domestic Purpose exemption and the use of CCTV installed at home

I was just explaining to my psychiatrist that December 11th this week will be a very exciting day for data protection aficionados. The European Court of Justice (ECJ) is about to make a second landmark judgement on the Domestic Purpose exemption (Section 36 of the Data Protection Act) and whether or not the Act should apply to domestic CCTV installed to protect the home.

Currently the ICO believes that the domestic purpose exemption does apply, but if the ECJ follows the Advocate General, then it won’t if the home CCTV covers public spaces (e.g. the street) outside the home.

I think the use of domestic CCTV is an emerging problem (especially if drones are used to spy on neighbours). We have had a number of course delegates that have mentioned that they have become aware of being under CCTV surveillance by neighbours when sunbathing in their garden.

Indeed, many households are installing security CCTV systems for security purposes which expressly monitor the public space outside their home. The Evening Standard (last Friday) reported someone collecting CCTV images on their personal phones of those entering an abortion clinic; images that subsequently appeared on YouTube in order to shame those seeking an abortion. So should the Section 36 exemption apply here?

Anyway to the story that has caused the problem. František Ryneš is a Czech journalist who published a number of articles about the controversial sale of plots of land. Following publication his wife’s house was attacked by vandals a number of times. Mr  Ryneš  therefore installed a security camera in front of the door. The camera recorded the space immediately in front of the house, including the pavement, the road and the house opposite.

Less than a week after the camera was installed the house was once again attacked. Mr Ryneš provided the police with the images from the camera and the vandals were identified. One of the vandals then complained to the Czech data protection authorities that Mr Ryneš had recorded him on public property without his permission. Mr Ryneš was then fined for infringing data protection rules.

Hence the question arose as to whether a data protection regime should apply to these “domestic” CCTV installations. If it doesn’t,  would the domestic exemption continue to apply to those who take camcorders to record their young child’s performance in a school play or orchestra? As you know, the ICO regularly says that this processing falls within Section 36.

The domestic purpose exemption relies on the text of Article 3 of the Data Protection Directive (95/46/EC). This states that processing of personal data “by a natural person in the course of a purely personal or household activity” is not subject the Directive. So, in the Ryneš case, can capturing images of those in a public place be classified as “a purely personal or household activity”?

The Advocate General is of the view that the "personal activities" within the meaning of Article 3, are activities which are connected with the private life of a person which does not appreciably touch the privacy of others. This means that recording a family gathering at a hotel, or family events in public places, or in connection with events shared by family members can be activities associated with “personal or family activities” (as required by A.3).

However video surveillance, which extends to the public space, because it includes people who have no connection to the family concerned, even within a home, cannot be regarded as strictly personal. This could mean that those who leave a covert CCTV system in a care home to assess the quality of care delivered to their elderly Grandmother cannot claim the domestic purpose exemption.

In short, according to the Advocate General, the systematic video surveillance of public space by natural persons is therefore not exempt from data protection requirements whether the surveillance is undertaken by private bodies, state authorities or the domestic CCTV.

Therefore processing of personal data by Mr Ryneš does not fall within the definition of "purely personal or household activity" as he systematically undertook video surveillance outside the home.  It follows that the processing of personal data falls within the scope of Directive 95/46.

So get ready for December 11th (and quite a lot of hostile anti-euro comment) if the ECJ follows the Advocate General. Remember, the ECJ usually follows the Advocate General (but didn’t in Google Spain!).

References associated with Domestic Purposes

Thursday 11th December 2014: Judgment in Case C-212/13 Ryneš. This case asks the question whether a camera fixed to private property can also capture images of people on the public rights of way in front of the property. Mr Ryneš has appealed against that decision and the Czech court which asked the ECJ whether such use of a camera breaches the Data Protection Directive.

In the “Solicitors from Hell” case (where a blogger invited anybody to enter all sorts of inaccurate scuttlebutt about lawyers to be published) the ICO refused to enforce the Act because the processing fell within the “domestic purpose exemption”. This view that was panned by the court. See the Solicitors from Hell ([2011] EWHC 3185 (QB)) and  http://amberhawk.typepad.com/amberhawk/2012/01/judgement-reinforces-the-link-between-lawful-processing-the-first-data-protection-principle-and-human-rightsother-law.html

In the Lindqvist case the ECJ ruled that posting personal details on the Internet was not subject to the Article 3 exemption, because the personal data were no longer private. This in turn means that many Facebook postings loose the domestic purpose protection (although in the UK, the ICO has turned a blind eye to the ruling). Lindqvist (ECJ, Case C-101/01, 6 November 2003). See “Baby battle woman can’t claim data protection exemption for YouTube video, warns expert” http://www.out-law.com/page-8401

Also, with respect to possible infraction proceedings, the Commission has published the fact that the UK’s inclusion of “recreational purposes” in the domestic purpose exemption is too broad. See http://amberhawk.typepad.com/amberhawk/2011/02/european-commission-explains-why-uks-data-protection-act-is-deficient.html