Author: Timothy Pitt-Payne KC

California court says don’t cry before you’re hurt

Posted on | by Timothy Pitt-Payne KC

In November 2007 it was announced that HMRC had lost two CDs containing personal information about 25 million people.  Since then there has been a steady stream of stories about data losses, mainly from the public sector.

The Data Protection Act 1998 requires appropriate measures to be taken against the accidental loss of personal data.  Breach of this requirement can lead to enforcement action by the Information Commissioner. An individual whose data was lost could claim compensation from the data controller under section 13 of the Act, but only on proof of damage.  If the individual had suffered identity fraud as a result of the breach then this would probably be sufficient.  What if the individual argued that he was now at a higher risk of ID fraud, even though no fraud had yet taken place?  Would this count as damage?

A US district court in California has recently considered a similar question.  In Ruiz v Gap and Vangent a laptop was stolen containing unencrypted personal data of 750,000 Gap job applicants.  In a class action, the plaintiff sued for negligence, contending that he and the other class members had suffered damage consisting of exposure to an increased risk of ID fraud.  The Court granted summary judgment to the defendants and dismissed the claim.  Speculative harm, or the threat of future harm, was not enough for a cause of action in negligence.  The plaintiff relied on cases where recovery had been allowed for medical monitoring after negligent exposure to toxic substances; the court rejected the analogy.  It also noted that Gap had informed those whose information was on the laptop, and had offered to provide them with 12 months of free credit monitoring.  The plaintiff had not taken up this offer.

In policy terms it is questionable whether strengthening individual rights of action is the best way to deal with data loss.  Of course, individuals who suffer direct financial loss – through ID fraud or otherwise – should be compensated.  But in the Ruiz type of claim individual damages are likely to be modest.  There is no great social benefit in spending a lot of time and money in order to provide a wide class of individuals with low-level compensation.  Instead the focus should be on deterring breaches and avoiding recurrence.  The Information Commissioner’s new power to fine for serious data protection breaches (DPA section 55A) is a step in the right direction, though not yet in force.

If the UK regulatory framework needs further strengthening then one option would be legislation requiring data controllers to notify affected individuals where information is lost or stolen.  Last year the Thomas/Wolpert data sharing review recommended notification to the Information Commissioner as good practice, but not as a mandatory requirement.  The Government agreed.  Its response (see page 19) made clear that it had considered, and rejected, the possibility of a US-style law requiring notification of data breaches to the individuals affected.

Incidentally, I found the Ruiz case via the excellent blog maintained by InfoSecCompliance LLC, a US firm specialising in privacy, information law and data security. David Navetta is their founding member.

Employment vetting in the news

Posted on | by Timothy Pitt-Payne KC

There’s an employment law supplement in the latest Legal Week, and I have an article about employment vetting. 

At the end of the article there’s a short discussion of something I’ve written about previously on this blog; the amount of personal information that’s now put on the internet, and its implications for recruitment. Looking at the way the article is presented, it’s clear that the editorial team thought that this was the interesting bit of the article.

I’ll be speaking about employment vetting again next week, at the Local Government Group conference on 29th April.   This event is a wide-ranging legal update for local authority lawyers – it’s a joint event between LGG and 11KBW.  If you’re coming to the conference, do come and introduce yourself and let me know what you think of the blog.

Include me out

Posted on | by Timothy Pitt-Payne KC

In the past few days there has been a lot of media coverage about online behavioural advertising – see for example this article published earlier this week in the Financial Times, under the euphonious title “A deeper peeper”. 

One important issue in this context (e.g. in assessing whether this form of advertising involves unfair processing of personal information under the Data Protection Act) is the extent to which individuals can opt out of having information collected about their web usage.  An opt out facility is offered by this site, which is maintained by a number of online advertising companies (including Google).  

If you want to see whether Google is collecting information about your advertising preferences, or if you want to change that information, then you can do so here.

There’s an important general point here.  Privacy will in future depend increasingly on two things.  One is the development of tools to enable individuals to protect their privacy.   The other is the willingness of individuals to find out about those tools and to use them.  The Information Commissioner issued a report on this subject – entitled “Privacy by design” – in November 2008.  

The other side of the coin, as far as behavioural advertising is concerned, is that some individuals will actually welcome the prospect of receiving advertisements that are targeted to their individual interests.  For instance, a number of Amazon users are happy to see book recommendations that reflect their previous use of the Amazon site.

DPA/FOIA overlap

Posted on | by Timothy Pitt-Payne KC

The overlap between FOIA and the DPA gives rise to  a number of difficult problems.

In a paper just posted on 11KBW’s website (and originally delivered to a JUSTICE/Sweet & Maxwell conference in December 2008) I discuss some of these issues.  In particular, I deal with the practical problems that arise when an individual makes a request for information to a public authority and some (but not all) of the information constitutes his own personal data.  Because the request falls under both the DPA and FOIA, the Information Commissioner will need to deal with any complaint under two different legal regimes; if the requester subsequently appeals, the Information Tribunal will not have jurisdiction to deal with all the issues raised by the request.  The article suggests that the present position is unsatisfactory and discusses options for reform.

A problem shared is a breach of the DPA?

Posted on | by Timothy Pitt-Payne KC

It’s a good time for a conference about information sharing.  The data sharing provisions in the Coroners and Justice Bill have been withdrawn, in the face of widespread criticism – including from the Bar Council (for more background, see our previous posts here and here).   The question whether anything will be done to implement last year’s Thomas/Wolpert review remains an open one. 

Against this background, Northumbria University’s conference on 17th April is topical.  Speakers include Richard Thomas (coming to the end of his term as Information Commissioner), Marcus Turle from Field Fisher Waterhouse, and Steve Eccleston from Sheffield City Council.  I shall be delivering a paper about breach of confidence and its significance for information sharing (I will post it on the 11KBW website after the conference).

Reviewing the situation

Posted on | by Timothy Pitt-Payne KC

Under FOIA, there is no statutory duty on public authorities to operate an internal review procedure relating to their handling of FOI requests.  There is however an incentive for them to do so – if a review procedure  is available but has not been exhausted then the Commissioner can decline to entertain a complaint from the requester under FOIA section 50. 

Section 45 of the Act enables the Secretary of State to issue a Code of Practice giving guidance to public authorities about how they should operate their functions under the Act.  The Commissioner can make a practice recommendation (under section 48) where a public authority’s practice appears not to comply with the Code.

The Code issued under section 45 in November 2004 states that authorities should operate a review procedure, with decisions being made within a reasonable time.  In February 2007 the Commissioner issued guidance that a reasonable time for completing an internal review is 20 working days from the date of the request; in a small number of cases it might be reasonable to take longer, but in no case should the time taken exceed 40 days.

Today the Information Commissioner’s Office (ICO) has issued a press release about a Practice Recommendation addressed to Greater Manchester Police (GMP) dated 31st March 2009.   The Recommendation expresses concern both about the time taken by GMP to deal with internal reviews (over 150 working days in one case) and the apparent inaccuracy of some of the information provided to the ICO by GMP.  The Commissioner recommends that GMP should take steps to ensure its future compliance with the time limits in the ICO’s February 2007 guidance.   Paragraph 52 of the recommendation is significant, emphasising the ICO’s willingness to take formal action where there is continuing non-compliance with the Code. 

Incidentally, although the Practice Recommendation refers to the ICO’s February 2007 guidance, new guidance about internal reviews (dealing with both FOIA and EIR) was issued on 16th February 2009.  A useful summary of recent guidance issued by the ICO is available here, courtesy of the FOI blog maintained by the Campaign for Freedom of Information.

I am grateful to Andrew Smith (currently a pupil at 11KBW) for drawing the Practice Recommendation to my attention and helping to draft this post.