Hawktalk

Consent for access to phones in some rape cases implies that such access is not necessary for law enforcement

This blog shows that the current furore concerning access to a rape victim’s phone, relying on consent of a rape victim, sits uneasily with a data protection analysis.  I also point out that there appears to be three forms of “consent” floating around in the GDPR/Data Protection Act 2018 (“DPA2018”) framework.

First of all, the relevant part of the DPA2018 to consider is the law enforcement elements, as access to the victim’s phone is by the police or prosecutors in relation to an investigation of a very serious criminal offence.  As the information accessed relates to an individual’s sex life, any processing relates to “sensitive processing” as defined in Section 35(8) of DPA2018.

Section 35(4) and (5) state that “sensitive processing” is justified in two alternative cases:

Case 1: “where the data subject has given consent to the processing for the law enforcement purpose”, and

Case 2: where (a) “the processing is strictly necessary for the law enforcement purpose” and (b) “the processing meets at least one of the conditions in Schedule 8”.

For completeness, both Cases require that the “controller has an appropriate policy document in place” (see Section 42 of DPA2018); this policy documents describes safeguards for the data subject (and other processes).  Schedule 8 reinforces the requirement that the processing is, for example, “necessary for the administration of justice” (or “necessary for the exercise of a function conferred on a person by an enactment or rule of law … for reasons of substantial public interest”).

The CPS press release justifies the use of victim consent by stating that:

“The new consent forms being rolled out by police are intended to achieve a consistency of approach nationally, so complainants are not treated differently in different forces. They replace those which were already been used in some forces. They are designed to bring clarity around the process and to give victims an understanding of how their data might be used so they can have confidence to come forward and support a prosecution”.

“It is not true that complainants in rape cases must automatically hand over personal data on their digital devices or run the risk of the prosecution being dropped. Mobile phone data, or social media activity, will only be considered by the police when relevant to an individual case….”

However, the CPS appear to have overlooked that Case 1 and Case 2 (specified above) are alternatives.  So, if the data subject consents to the processing via Case 1 then there is no need to consider Case 2.  In this way, Case 1 could allow for processing that does not need to be “strictly necessary for the law enforcement purpose” (my emphasis) as required by Case 2.

Or in other words,  Case 2 limits the access to a rape victim’s phone to circumstances that are “strictly necessary”; reliance on Case 1 widens access to a victim's phone in circumstances that cannot meet those strict necessity requirements.

Similarly, Section 35(2) states that:

“The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—

(a) the data subject has given consent to the processing for that purpose, or

(b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority”. (my emphasis on “or”)

The use of the word “or” makes consent an alternative to necessary processing.  It follows, again, that reliance on consent allows for processing does not need to be necessary for purposes of a competent authority.

This reinforces my conclusion that a data protection analysis sits very uneasily with CPS consent procedures.

Processing by consent is a viable option

I am not saying that the use of consent by the CPS is unlawful or wrong; it is just opens up the possibility for processing circumstances that should not be opened up.

One suspects this position has arisen because there is no definition of “consent” in Part 3 of the Law Enforcement part of the DPA2018 nor in the parent Law Enforcement Directive 2016/680; however, the Recitals to this Directive do refer to “consent”.  To complicate matters, there is a definition of “consent” in Part 4 (which relates to processing of personal data by the spooks) and “consent” as defined in Article 4(11) of the GDPR (as amplified by Article 7 and related GDPR Recitals).

Recital 35 of Directive 2016/680 states that where the law “require or order natural persons to comply with requests” (for personal data) then “the consent of the data subject, as defined in Regulation (EU) 2016/679, should not provide a legal ground for processing personal data by competent authorities”. This is because “Where the data subject is required to comply with a legal obligation, the data subject has no genuine and free choice, so that the reaction of the data subject could not be considered to be a freely given indication of his or her wishes”.

However “This should not preclude Member States from providing, by law, that the data subject may agree to the processing of his or her personal data for the purposes of this Directive, such as DNA tests in criminal investigations or the monitoring of his or her location with electronic tags for the execution of criminal penalties”.  This “provision by law” is what the Government have delivered in Section 35 of the DPA2018.

Recital 37 of Directive 2016/680 adds to limits on consent when processing is “particularly sensitive”  (e.g. “sensitive processing” as defined by the DPA2018).  Such processing “should also be allowed by law where the data subject has explicitly agreed to the processing that is particularly intrusive to him or her. However, the consent of the data subject should not provide in itself a legal ground for processing such sensitive personal data by competent authorities.”

In other words, there is an implication in these Recitals that “consent” for sensitive processing for law enforcement purposes is valid in limited circumstances but not in general.  There is no equivalent of Article 7 of the GDPR and the ability for the data subject to withdraw consent.

The ICO states in her Law Enforcement DPA2018 Guidance that the meaning of consent “aligns with GDPR and it must be unambiguous and involve a clear affirmative action”.  I am not sure about the ICO’s conclusions here; I think consent means what it meant under the DPA1998 (i.e. it includes the no-choice consent position which the GDPR has specifically excluded).

In conclusion, however, there appears to be three forms of consent that applies in the DPA2018. There is “GDPR consent” supported by Article 7 and withdrawal of consent; there is “spooky consent” which relates to Part 4 of the DPA2018 (in Section 84(2)) and finally an “unspecified consent” that applies for Part 3 which is different to the other two forms of consent.

Quite a consensual mess really.

References

CPS Press release on the access to phones: https://www.cps.gov.uk/cps/news/handing-over-mobile-phone-data-rape-prosecutions  (There is no reference to a data protection analysis in the Press Release but there is a commitment to “continue to work with victim groups and the Information Comissioner's Office to ensure our approach offers the necessary balance between the requirement for reasonable lines of inquiry and the complainant’s right to privacy”.)

Reference added after publication

The ICO made contact after the blog was published and made the following statement: “The ICO has an ongoing investigation into use of data extraction technology on the mobile phones of suspects, victims and witnesses. We are also currently looking at concerns raised around the collection, secure handling and the use of serious sexual crime victims’ personal information. A separate investigation will be tracking the journey victims’ information takes through the criminal justice system, from allegation, through disclosure and onto any compensation application that may be made. This is to identify areas where victims’ information is most vulnerable or where processing may be excessive and disproportionate.  These are ongoing investigations and we will be reporting on the outcomes in due course".

The ICO has a blog about the issue: Access to serious sexual crime victims’ personal information – how much is too much? https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2018/12/access-to-serious-sexual-crime-victims-personal-information-how-much-is-too-much/

Upcoming Data Protection/FOI qualification courses (May to July)

1. BCS Data Protection Foundation (3 days; London-May 21-23)
2. BCS FOI Practitioner course; London (6 days starts 4 June).
3. BCS Data Protection Practitioner, London (6 days starts June 11 or July 16).
4. BCS Data Protection Practitioner Upgrade/Conversion (2 days; London, July 23 & 24).

Details on www.amberhawk.com or by emailing info@amberhawk.com

Amberhawk wins a Cyber Security Challenge UK prize - but it has been returned

{Blog changed on 2nd April due to the threat of legal action by the Homeland Security Department of USA}

Amberhawk is pleased to announce that it has won a Cyber Security Challenge UK competition for the best idea in 2019 (so far) to prevent cyber-crime in the young.  Our idea involves enhanced parental responsibility, increased awareness of computer crime and teaches children under the age of ten about the dangers from hacking.  No special technology or software is needed.

To celebrate our win, lucky children involved in our idea can obtain a “Guantanamo-Bay style” onesie in tasteful Amberhawk Orange; the onesie is designed by Yves St. Lawrence (Ivenka Trump’s favourite fashion house).  We are calling this garment the “Amberhawk Onesie”; it costs £7.99 and if you want to see what one looks like, click on the following URL: (https://cdn.shopify.com/s/files/1/2684/7740/products/wjhcgqrqf4m_1024x.jpg?v=1543508800)

Our idea to improve security is deceptively simple and relies on the wide offence in Section 1 of the Computer Misuse Act 1990 (“CMA”).  This states that a person is guilty of an offence if—

(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;

(b) the access he intends to secure is unauthorised; and

(c) he knows at the time when he causes the computer to perform the function that that is the case.

Note that there is no definition of a “computer” in the CMA;  the absence of a definition avoids any problem that a future innovative change in technology would make the legal definition of “computer” defunct.  The Courts are thus free to decide what a “computer” means, in the context of any particular case, and at any future time.

The parental responsibility component of our prize arises because computer technology is becoming ubiquitous in the modern home; given the advent of the Internet of Things, there are many seductive buttons to press and colourful knobs to turn.  Often children under the age of 10 play with such buttons/knobs associated with such computer technology much to the chagrin of parents (who often say something like: “Stop that! Don’t do it again!”).

Sometimes a child ignores such stern invocations and retains a clear intent to cause a modern electronic device (e.g. usually a TV) to perform a function (e.g. to play an episode of Thomas the Tank Engine).  Technically, therefore, the child is committing an offence under Section 1 of the CMA and parents can gently explain this fact to their law-breaking children.  Note the Section 1 offence does not need to an actual episode of Thomas the Tank Engine to be played, just that there was an intent to gain access without parental authorisation.

Getting “the criminal” to wear an Amberhawk Onesie when a parent remonstrates with a child is designed to reinforce parental strictures.

Some leading Conservative Party thinkers such as Sahib Javid (Home Secretary) have already suggested that Crime Stoppers’ grants could be available for deprived families to purchase Amberhawk Onesies for their children.  This is subject to the usual assessments to protect the public purse (e.g. means testing, DNA samples to check on parentage, criminal and immigration background checks).

If parents still fail to impress their recidivist children about the seriousness of their repeat offences, Home Office advice is to tell children, dressed in their Amberhawk Onesies, to stand on a specially designed “naughty step”.  Perhaps, it is suggested, children could be sent to bed early without supper, wearing their Amberhawk Onesie as pyjamas.

Obviously, there is no involvement with the police at this stage but Mr. Javid said that, in a post a hard-Brexit, a UK free of European Convention of Human Rights could adopt this as a future policy.  In really serious cases, the Home Secretary said “a good ticking off by the neighbourhood police officer and the wearing of handcuffs could be arranged”.

If you want to purchase one or more Amberhawk Onesie, email info@amberhawk.com with “Amberhawk Onesie” in the subject line.

Stop press: we can no longer sell Amberhawk Onesies.  The USA's Department of Homeland Security have contacted us to say they have all the Intellectual Property rights in the design of all Guantanamo Bay jump-suits and that they have issued a "Cease and Desist" notice.  As a result we have had to return our prize as the idea does not work.

References

Cyber Security Challenge UK competitions:  https://www.cybersecuritychallenge.org.uk/competitions

Sajid Javid is generally opposed to the European Convention of Human Rights: https://www.theyworkforyou.com/mp/24854/sajid_javid/bromsgrove/divisions?policy=6703

DP/FOI qualification: pubic courses (May-July)

• BCS Data Protection Foundation (3 days; London-May 21-23)
• BCS FOI Practitioner course; London (starts 4 June).
• Because of demand, the next BCS Data Protection Practitioner, London course that can be booked is (6 days starting June 11 or July 16).
• BCS Data Protection Practitioner Upgrade/Conversion (2 days; London, July 23 & 24)

Details on www.amberhawk.com or by emailing info@amberhawk.com