On 26 February 2010 the New York Times had a dramatic headline : ” When American and European Ideas of Privacy collide.” The article, by the respected collumnist Adam Liptak, arose out of the ruling from an Italian Court that Google executives had violated Italian privacy law by allowing a user to post a video showing an autistic boy being bullied. The article states that the ruling calls attention to the “profound European commitment to privacy, one that threatens the American conception of free expression and could restrict the flow of information on the Internet to everyone.2 The ruling balanced ECHR Article 8 rights against free speech and ruled in favour of the former. Given the biorderless quality of the Internet, that balance has the potential to affect Nations that prefer to “tilt towards the values” protected by the First Amendment to the US Constitution (whose “distant cousin” is Article 10 of the ECHR), and makes Europe the “effective sovereign of global privacy law”. The word “privacy” does not appear in the US Constitution. The Italian prosecution would have been “unimaginable” in the US. The article concludes : “Britain is only slowly moving towards the Continental model.”
Author: James Goudie KC
CIVIL MONETARY PENALTIES FOR SECURITY BREACHES OF PERSONAL DATA
The Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010, SI 2010/31, and the Draft Data Protection (Monetary Penalties) Order 2010, create a framework for the Information Commissioner to serve a monetary penalty notice on a data controller if he is satisfied there has been both a serious contravention by the data controller of the data protection principles and that the contravention was of a kind likely to cause substantial damage or distress. Such contraventions must be either deliberate or something which the data controller knew would occur (or ought to have known) and of a kind likely to cause substantial damage or substantial distress, but in respect of which he failed to take reasonable steps to prevent.
The Regulations prescribe the maximum amount of a monetary penalty. They also set out the minimum details to be contained in a notice of intent, and in a monetary penalty notice.
The Order sets out procedural details of the issue of a monetary penalty notice following a notice of intent. It also contains details of when enforcement action can be taken, and the power to cancel or vary a monetary penalty notice issued by the Information Commissioner, as well as details of appeal rights of data controllers.
VOLUNTARY ORGANISATIONS: DO THEY FEAR THE CONSEQUENCES OF FOI REQUESTS?
A study, carried out by researchers at the University of Strathclyde, has examined the use of FOI by voluntary organisations and campaign groups across Scotland. It found that where requests for information were refused, more than half of respondents reported that the public authority failed to notify them of their right to appeal against the refusal, despite there being a legal requirement to do so. The researchers also found that, where appeals against refusal were made to an authority, one in four respondents said the authority failed to notify them of their right of further appeal to the Scottish Information Commissioner. The research was undertaken as part of an ongoing 3-year study into the use of FOI laws by the voluntary sector. The study also found that almost half (49%) of the voluntary sector respondents surveyed would be discouraged from requesting information under FOI because of a fear that it might harm working or funding relationships.
The full research study, entitled ‘Public Communication, Democracy and Citizenship: Assessing Civil Society Uptake of Freedom of Information’ is due to be published in 2011. The research report published on 4 January 2010 “Voluntunteering Information? The use of FOI laws by the Third Sector in Scotland – Survey Findings” brings together the first-phase quantitative findings from this study. The research is funded by the Economic and Social Research Council (ESRC), and is supported by the Scottish Information Commissioner. The research was launched in 2008 following evidence to suggest that the FOI ‘right to information’ might not be being used to its full potential by Scotland’s voluntary and campaign organisations, with only 4% of the appeals received in 2007 by the Commissioner coming from the sector. This figure compared with 6% from the media, 7% from politicians, and 77% from the public.
The Scottish Government is currently considering extending the FOI Act to cover additional bodies. It announced on 8 December 2009 that it plans to consult on the extension of FOI to cover PFI/PPP contractors, trusts that provide cultural and leisure services and bodies such as the Association of Chief Police Officers in Scotland, the Glasgow Housing Association and privately-run prisons. The Scottish Information Commissioner has welcomed the announcement, arguing that the practice of handing the delivery of public services to third party organisations not covered by FOI is eroding the public’s right to information.
Court of Appeal judgment on Police Database
On 19 October 2009, the Court of Appeal, in Chief Constable of Humberside Police v Information Commissioner (2009) EWCA Civ 1079, allowed police appeals against a decision of the IC, upheld by the IT, that data on old minor convictions (of which there are probably about 1 million) must be deleted from the Police National Computer (“the PNC”). The Court of Appeal held that retaining information for police operational needs in the fight against crime and for other purposes was justified and did not infringe the data protection principles (“the DPP”) under the DPA 1998, especially principles 3 (personal data shall not be excessive in relation to the purpose for which they are procured) and 5 (personal data shall not be kept for longer than is necessary).
Waller LJ, applying the approach from the Bichard Inquiry, following the Soham murders, said, at paragraph 43: “If the police say rationally and reasonably that convictions, however old or minor, have a value in the work they do that should, in effect, be the end of the matter.”
Carnwath LJ referred to the importance in a case of this kind having the involvement of a Judge with direct and hands-on experience of the criminal system. Hughes LJ, with direct hands-on experience of both the criminal and family systems, summarised the position as being that it is for the data controller to determine the purpose(s) for which the data is processed; it is not open to the IC to impose his own determination of those purposes; the imposition of a concept of ‘core police purposes’ was misconceived; and in any event the proper purposes of the police in managing the PNC plainly include the retention of information for provision to others who have a legitimate need for it.
Hughes LJ emphasized practical considerations and in particular the value, in the public interest, of the existence of a single comprehensive record of convictions and of its being held by police forces acting collectively. Hughes LJ said, at paragraph 107: “Like both Waller and Carnwath LJJ, I take the clear view that if senior police officers with considerable operational experience are satisfied that even very old and comparatively minor convictions may sometimes be of assistance in police investigations, then unless that view is perversely or unreasonably held, it is not open to the Commissioner to substitute his own view of their potential use. But I should also add that the opinion expressed by the police witnesses in this case entirely accords with what is seen to be true from time to time in major criminal investigations. As was in evidence in these proceedings, Dame Janet Smith also reached a similar conclusion when considering the investigation into Dr Shipman. Such old convictions, if never subsequently repeated, may very well not be the kind of material which it is proper to put before a jury, … but that does not begin to mean that they have not been of use in the investigation. Quite apart from propensity (or lack of it) to offend in a particular manner, they are likely to be useful for other reasons, of which location and associates are but two simple examples. Moreover, the critical consideration is not the use of the conviction standing by itself, but its potential value in conjunction with other information pieced together by a skilled detective.”
Hughes LJ further observed that many others depend heavily, and reasonably, on the maintenance by the police of these records. Those others include (but are not limited to) the criminal courts, the family courts and those concerned with the protection of children and the vulnerable. He said that the criminal courts have a plain need for reliable and comprehensive information. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to criminal proceedings. There are at least two situations in which the need for such records arises daily. The first is in sentencing. The second relates to the credit of witnesses, especially those relied upon by the Crown. The Secretary of State for Justice expressed the view in this case that “providing anything less than full information to the courts would potentially undermine the criminal justice process”. Hughes LJ agreed.
Hughes LJ also stated that the importance of multi-agency working to child welfare in general, and to child-centred family proceedings in particular, has been recognised for many years, has been the repeated subject of judicial and ministerial exhortation alike, and is difficult to overstate. It is, nowadays, the daily norm of cases in the family courts. The Rehabilitation of Offenders Act 1974 is expressly made not to apply to these proceedings either. It may well be that at times such co-operation throws up difficult questions about the extent of disclosure which a police force ought to make to social services or other child welfare professionals, but that is not a reason for failing to have available a comprehensive record in order to make a fully-informed decision about it.
As regards the vetting of potential employees, Hughes J said that, given the statutory framework, it is plain that it is part of the necessary public purposes of the PNC that it maintain a complete record of convictions etc to enable the statutory scheme to work.