ICO’S SURVEILLANCE REPORT 2010: ‘SLEEPWALKING’ RISK REMAINS; ‘PRIVACY IMPACT ASSESSMENTS’ PROPOSED FOR NEW LEGISLATION

November 15th, 2010 by Robin Hopkins

The Information Commissioner has delivered his latest report to the Home Affairs Select Committee on “the state of surveillance” in the UK. The report traces privacy-related developments since the Commissioner’s 2006 report on the same theme, which memorably observed that the UK may be “sleepwalking into a surveillance society”. According to the November 2010 report, that warning

 “… is no less cogent in 2010 than it was several years ago. It is not being suggested that the UK is a ‘police state’ or that there are surveillance conspiracies afoot against the public. Neither the 2006 report nor this one supports such an assumption, and evidence for it is lacking. Much of what is taken to be surveillance is done for benign reasons and has beneficial effects on individuals and society. But much surveillance also goes beyond the limits of what is tolerable in a society based on the rule of law and human rights, one of which is the right to privacy.”

The report provides an illuminating summary of trends in (amongst others) the use of CCTV, body scanning and border control (including ‘ethnic targeting’ for security searches), workplace monitoring, social networking, ‘crowdsourcing’, the monitoring of protest activities and even the use of unmanned drones. Scrutiny is also given to a number of governmental policy tools, such as databases and the use of ‘social sorting’ (eg into groups such as ‘high cost, high risk’ social groups who are vulnerable to social exclusion’) to develop targeted welfare strategies.

As regards private-sector online commerce, the Commissioner recommends a number of measures to correct what he describes as the “worrying trend particularly with those who provide on-line services not to have thought through the privacy implications of their activities and given users robust privacy settings as a default”.

What to do about the risks identified in the report? The ICO’s recommendations focus principally on overhauling the legislative process insofar as it affects privacy, by introducing: 

  • a requirement for a privacy impact assessment to be presented during the parliamentary process where legislative measures have a particular impact on privacy;
  • an opportunity for the Information Commissioner to provide a reasoned opinion to Parliament on measures that engage concerns within his areas of competence, and
  • a legal requirement to make sure all new laws that engage significant privacy concerns undergo post-legislative scrutiny to ensure they are being implemented and used as intended by Parliament.

If implemented, these measures would add substantially to the ICO’s clout as the guardian of privacy.

The report can be found here, with the accompanying press release from the ICO here.

LANDMARK IPT DECISION ON LOCAL AUTHORITY’S USE OF RIPA

August 2nd, 2010 by Robin Hopkins

The Investigatory Powers Tribunal today issued its decision in the first substantive public case on the use of surveillance powers under the Regulation of Investigatory Powers Act 2000.

Poole Borough Council suspected that Jenny Paton and her family may have lied about living in the catchment area of a sought-after primary school in Dorset. It therefore monitored their activity for around 3 weeks in 2008. This included covertly monitoring the movements of family members and their car, as well as examining the contents of their rubbish.

The IPT found that:

(1) investigating a potentially fraudulent school application was not a proper purpose in the sense required by RIPA;
(2) in these circumstances, the Council’s actions were in any event disproportionate, in that they were not necessary to achieve that aim, and
(3) the Council’s actions had breached the family’s rights under Article 8 of the ECHR.

Poole Borough Council has accepted the ruling and apologised to Ms Paton and her family.

PRIVACY ACROSS THE POND

June 25th, 2010 by Anya Proops

On Thursday, the US Supreme Court unanimously held that a Police Chief did not violate a police officer’s 4th amendment rights by reading personal text messages which the officer had send via a pager provided to him by his employer – see the judgment here. The 4th amendment guarantees a person’s privacy, dignity, and security against arbitrary and invasive governmental acts. The text messages were sent on a pager provided by the officer’s employer, they included a number of sexually explicit messages. The texts were reviewed as part of a process of examining whether officers were using the pagers excessively for personal use. In a judgment which rejected a broad right of privacy for workers, the Supreme Court recognised that interferences with privacy may be justified where there is a reasonable suspicion that rules are being breached by the employee. Notably, the Supreme Court recognised that, in an age of fast-evolving technology, the law of privacy should develop flexibly rather than through the introduction of broad, rigid rules.

UK interception regime upheld in Strasbourg

May 18th, 2010 by Ben Hooper

The European Court of Human Rights handed down a significant judgment today in Kennedy v. UK (application no. 26839/05).

A warrant under s. 8(1) of the Regulation of Investigatory Powers Act 2000 permits the interception of the communications of a particular person (or particular set of premises). Mr Kennedy sought to challenge the Art. 8 compatibility of the s. 8(1) warrant regime, and in particular sought to criticise its foreseeability. The Court unanimously rejected his challenge and, in a relatively detailed judgment, upheld the compatibility of the domestic law.

The case is also interesting for the Court’s analysis of Mr Kennedy’s Art. 6 complaint. Mr Kennedy had brought domestic proceedings in the Investigatory Powers Tribunal, which had resulted in two public decisions on legal issues, together with a final ruling that no determination had been made in his favour (i.e. that there had either been no interception, or that any interception that had taken place had been lawful). In Strasbourg, Mr Kennedy complained that the restrictive procedures of the Tribunal had breached Art. 6. In its judgment, the Court avoided deciding whether Art. 6 applied to such proceedings, but went on to confirm that if Art. 6 did apply then the Tribunal’s procedures satisfied its requirements.

GOOGLE IN EUROPE – PRIVACY CONTROVERSIES CONTINUE

May 2nd, 2010 by Anya Proops

In March 2010, we posted on a New York Times article which explored how Google’s quest to increase access to information via the internet appeared to be clashing with European privacy laws. The article followed in the wake of the prosecution in Italy of Google executives for violating Italian privacy laws after Google allowed a user to post a video showing an autistic boy being bullied. More recently, further controversies over Google’s record on privacy rights have emerged. First, privacy regulators from a number of different countries, including our own Information Commissioner, Christopher Graham, wrote a joint letter to Google’s chief executive and challenging him to improve protections for users, thereby highlighting concerns that Google is not doing enough to protect the privacy of users – see further this article in the Guardian dated 20 April 2010. Second, last week reports emerged that German regulators had renewed their criticism of Google’s Streetview when it emerged that Google was using the Streetview system to archive information about the location of household wireless networks – see this article in the New York Times dated 29 April 2010. What these developments suggest is that the clash between European social values and the expansion of Google’s techno-commercial empire is likely to continue for some time to come.

Banned Aid

November 21st, 2009 by Timothy Pitt-Payne QC

In March this year the Information Commissioner took enforcement action against the Consulting Association, which had been operating a secret blacklist of employees in the construction industry, including details of trade union activity. We posted about this story here, earlier this year.

Today, the Guardian has extensive coverage of what has happened since.

The Department for Business, Enterprise and Regulatory Reform has now consulted on draft regulations under section 3 of the Employment Relations Act 1999. The consultation ended on 18th August 2009. The proposed regulations are intended to outlaw the compilation, dissemination and use of blacklists of trade unionists. They would make it unlawful to refuse employment, or to dismiss employees or subject them to a detriment, for reasons related to a prohibited blacklist. Individuals who suffer loss through blacklisting would be able to bring claims either in the Employment Tribunal or in the civil courts, depending on the nature of their complaint.

The trade union UCATT commissioned a report from the Institute of Employment Rights about the proposed regulations. The report, by Professor Keith Ewing, was published on 15th September 2009: it is entitled “Ruined Lives”, and deals specifically with blacklisting in the construction industry. It includes sample material from Consulting Association files.  The report gives a fascinating history of the practice of blacklisting, going back to the late 19th century. It suggests a number of changes to the draft Regulations, including: that keeping or using a blacklist, or supplying information to it, should be a criminal offence; and that there should be a right to compensation for the fact of being included on a blacklist, even if the inclusion does not lead to any loss.

A further point to note about the draft Regulations is that they deal specifically with the blacklisting of trade unionists (as does section 3 of the 1999 Act). So they would not assist individuals who had been blacklisted for other reasons; e.g. because of their political beliefs and affiliations, or because they have a history of raising concerns about health and safety issues.

A number of individuals have brought employment tribunal claims arising out of alleged blacklisting. The claims have been consolidated and there will be a case management discussion in Manchester ET on 24th November 2009. This blog gives further information.

Meanwhile the Information Commissioner’s Office (ICO) has taken control of the Consulting Association database. Individuals who think that they may have been blacklisted can contact the ICO; for more information, see this page of the ICO’s website.

Home Office publishes response to its consultation on communications data

November 16th, 2009 by Robin Hopkins

The Home Office has published a summary of responses to its April 2009 consultation paper on ‘communications data’, i.e. information about a communication that does not include the content of the communication itself. At present, such data is owned by communications service providers and accessed by certain public authorities under disparate statutory powers for the purposes of combating, for example, fraud, terrorism and other serious crime. The government is considering an overhaul so as to bring all communication types (such as web chat) and all relevant service providers (some of whose contractual positions place them beyond the current statutory arrangements) within the system.

 

The attendant tension between individual liberty and public protection is reflected in the 221 responses to this consultation.

 

A substantial minority of respondents objected in principle to any ‘surveillance’ of communications. A majority (albeit a fairly narrow one) agreed that communications data served an important public purpose and that the government should therefore act to maintain the capability of public authorities to make use of this type of information.

 

As to what form this action should take, only one element of the government’s proposed approach was widely welcomed, namely its rejection of a central database for holding all data of this type. Reservations were otherwise expressed about technological feasibility, data security and the proportionality of public authorities’ use of communications data.

 

Nonetheless, such reservations were not deemed forceful or widespread enough to deter the government from its proposed course. A number of respondents’ suggestions have been rejected, including the specifying of categories of data which should not be retained, and the requirement for a magistrate’s authorisation before communications data can be accessed.

The government is also satisfied that the DPA 1998 and RIPA 2000 provide sufficient safeguards against abuse of such data. A legislative review is, however, proposed, to see if a single means of authorised access (through RIPA 2000) would be practicable. Fresh or consolidating legislation appears likely.

11KBW Information Law Seminar

June 4th, 2009 by Panopticon Blog

11KBW last night hosted a successful and well-attended information law seminar. The seminar was chaired by James Goudie QC and papers were presented by Tim Pitt Payne and Anya Proops. Tim presented a paper which considered issues of surveillance and employee banning lists and vetting (‘The Surveillance Society In and Out of the Workplace’). Anya presented a paper on recent FOIA developments (‘Recent FOIA Developments: Parliamentary Crises, Ministerial Vetoes and Beyond’). 11KBW would like to thank all those who took the time to attend. If you are legal practitioner and are interested in attending future 11KBW information law seminars, please contact our Head of Marketing, Lucy Miller (lucy.miller@11kbw.com; 0207 632-8500).

Privacy and the Police – Important Court of Appeal Judgment

May 22nd, 2009 by Anya Proops

By a two to one majority, the Court of Appeal decided yesterday, in Wood v Commissioner for Police of the Metropolis [2009] EWCA Civ 414, that the Metropolitan Police had acted unlawfully when it retained photographs which it had taken of an anti-arms trade campaigner as he was leaving the AGM of Reed Elsevier Plc (“REP”). This is an important judgment on the scope of the Article 8(1) right to privacy and on the scope of the justification defence available under Article 8(2).

The factsREP is the parent company of a company which organises trade fairs for the arms industry, Spearhead Exhibitions Limited. As a result of its association with Spearhead, REP’s offices have been subject to demonstrations, some involving criminal damage. In April 2005, Mr Wood attended REP’s AGM at the Millenium hotel in London in his capacity as shareholder. At the time, Mr Wood was a media co-ordinator for Campaign Against the Arms Trade (“CAAT”). It was not in dispute that Mr Wood was of good character, had no criminal convictions and had never been arrested. Moreover, his behaviour at the AGM had been entirely unobjectionable. However, as he was leaving the hotel, Mr Wood was overtly photographed by a photographer acting on behalf of the police. He was then questioned by police but declined to confirm his identity or answer their questions. The police claimed that, upon leaving the AGM, Mr Wood had been joined by a former member of CAAT with a history of unlawful activity against organisations involved in the arms industry. That assertion was disputed by Mr Wood. The police also claimed that it had taken the photographs in order to be able to identify offenders if offences were or had been committed at the AGM or if they were subsequently committed at the arms fair.

The High Court judgment The High Court dismissed Mr Wood’s judicial review claim that the police’s actions had breached his Article 8 right to privacy. It did so on the basis that the police’s actions had not interfered with Mr Wood’s Article 8(1) right to private life (Wood v Commissioner of the Police for the Metropolis [2008] EWHC 1105 (Admin)).

The Court of Appeal judgment The Court of appeal disagreed with the High Court’s conclusion that there was no interference with Mr Wood’s Article 8(1) right to privacy. It held that the mere taking of photographs in a public place was not itself capable of engaging Article 8. However, having regard to the particular circumstances of the case, Mr Wood’s Article 8 right to privacy had been interfered with. In particular, this was so because the photographs had been taken by an organ of the State, the police action was unexplained at the time it happened and, further, it carried with it the implication that the images would be kept and used in the future. On the question of whether the police was able to establish that interference was justified, and hence lawful under Article 8(2), the Court of Appeal unanimously agreed that the taking and retention of photographs of Mr Wood pursued legitimate aims, namely the prevention of disorder or crime and in the interests of public safety or the protection of the rights and freedoms of others. However, they disagreed on the question of whether the measures used by the police to pursue those legitimate aims were proportionate in all the circumstances. The majority (Lord Collins and Dyson LJ) held that, whereas retaining the photographs for a few days after the meeting was permissible, once it had become clear that Mr Wood had not committed any offence at the meeting, it was unreasonable and, hence, disproportionate for the photographs to be retained pending the trade fair. This was because there was no reasonable basis in the circumstances for fearing that Mr Wood might commit an offence at the trade fair. It is apparent from Lord Collins’ judgment that he was particularly concerned as to the potential ‘chilling effect’ which similar police actions would have on future potentially peaceful campaigners (see paragraph 92). Laws LJ dissented on the question of whether the interference was proportionate. He held that the interference was not disproportionate particularly because: ‘The taking of the pictures was in no sense aggressively done. The retention of the pictures was carefully and tightly controlled. The appellant’s image was not placed on any searchable database, far less a nationwide database indefinitely retained. But for the commencement of these proceedings the images of the appellant would have been destroyed after the DSEi exhibition’ (paragraph 58). The judges did however agree that the instant case was wholly distinguishable from Marper (ECtHR decides retention policy in respect of police DNA database gave rise to unjustified interferences with right to privacy – see my earlier post on the Home Office response to Marper and also Tim Pitt Payne’s NLJ article on the judgment itself).

It is important to note that the result of the Court of Appeal’s judgment is that the taking of the photographs did not per se constitute a unlawful interference with Mr Wood’s right to privacy. Rather what was unlawful was the excessive retention of the photographs beyond a time when there was any reasonable basis for supposing that Mr Wood may engage in criminal conduct at the arms fair. On the question of whether this judgment sets a precedent on the question of whether the police can generally take photographs of ostensibly law-abiding citizens, it is worth noting Lord Collins’ concluding comments: ‘it is plain that the last word has yet to be said on the implications for civil liberties on the taking and retention of images in the modern surveillance society. This is not the case for the exploration of the wider, and very serious, human rights issues which arise when the State obtains and retains the images of persons who have committed no offence and are not suspected of having committed any offence’ (paragraph 100).

 

 

 

CCTV In the Dock

May 18th, 2009 by Anya Proops
A Home Office funded review on the effectiveness of CCTV cameras in the fight against crime has found that it has only a ‘modest impact on crime’. The review, undertaken by the Campbell Collaboration found that the use of CCTV was not effective in cutting vehicle crime in car parks, especially when used alongside improved lighting and the introduction of security guards. The review’s conclusions are likely to prompt further debate not only on the cost effectiveness of using CCTV as a weapon to cut crime (CCTV is now the single most heavily funded crime prevention measure operating outside the criminal justice system) but also on whether the pervasive use of CCTV within our society can be justified, particularly given its potential to interfere with the right to privacy.  Notably, The Home Office cited the review in the context of its response to the House of Lords Comittee on the Constitution Inquiry into ‘Surveillance: Citizens and the State’ (and see my earlier post on the Committee’s report). In its response, the Home Office stated that: In reviewing existing policies and processes, the Government will seek to ensure that due consideration is given to the following key principles: Are robust safeguards in place to protect the information and indiviudal liberties? Are our plans and actions proportionate to the damage and the threat they are seeking to prevent? Are we being as transparent as possible? Are citizens being given the right amount of choice?The Home Office’s response should be read in conjunction with the Information Commissioner’s response to the Committee’s report which was published in 15 April 2009.