Google’s Streetview – ICO Responds

Posted on | by Anya Proops KC

The launch of Google’s Streetview service in March 2009 sparked considerable debate within the British media. Privacy campaigners criticised the intrusive nature of the service, which enables internet users to access 360 degree views of people, homes, cars and streets in 25 of Britain’s cities. It would appear that the Information Commissioner has now had his say on the matter. According to an article published in yesterday’s Observer newspaper, the Information Commissioner rejected a complaint brought by Privacy International which challenged the legality of the service. Notably, the Observer reports that the Commissioner dismissed the suggestion put forward by Privacy International that consent should have been sought from individuals whose image was captured in the pictures shown by Streetview. He apparently compared the Streetview service with images of individuals broadcast during televised football matches, where similarly consent would not be sought. Of course, Streetview is not the only part of Google’s operations which have given rise to privacy concerns. Not least in recent weeks, concerns have been raised about another Google innovation, which enables advertisers to target adverts on individual Google users by relying on  site-visit profiles developed by Google. The so-called behavioural targeting system enables Google to build up a profile of the internet sites visited by a particular user when using the Google search engine. The profile is then used as a basis for indicating what advertising the user may be interested in. Concerns expressed about the new system have included that individuals are not asked whether they wish to receive targeted advertising and, further, that the right to opt out of the system is not adequately advertised to users.

Guardian article on Streetview:

https://www.guardian.co.uk/technology/2009/apr/12/google-street-view-privacy

Channel 4 report on Behavioural Targetting System

https://www.channel4.com/news/articles/science_technology/how+google+adverts+got+personal/3076122

A problem shared is a breach of the DPA?

Posted on | by Timothy Pitt-Payne KC

It’s a good time for a conference about information sharing.  The data sharing provisions in the Coroners and Justice Bill have been withdrawn, in the face of widespread criticism – including from the Bar Council (for more background, see our previous posts here and here).   The question whether anything will be done to implement last year’s Thomas/Wolpert review remains an open one. 

Against this background, Northumbria University’s conference on 17th April is topical.  Speakers include Richard Thomas (coming to the end of his term as Information Commissioner), Marcus Turle from Field Fisher Waterhouse, and Steve Eccleston from Sheffield City Council.  I shall be delivering a paper about breach of confidence and its significance for information sharing (I will post it on the 11KBW website after the conference).

Recent ICO decisions on Freedom of Information

Posted on | by Amy Rogers

In Decision Notice FS50139215, issued this week, the Commissioner has ordered the Met Police to disclose particular CCTV footage showing the movements of the perpetrators of the terrorist attacks on London on 7 July 2005.

The Met had argued that the footage was exempt from disclosure under sections 30(1)(a) (information held for the purposes of an investigation) and 38(1)(a) (health and safety) of FOIA.

The Commissioner accepted that the exemption in section 30(1)(a)(i) and (ii) of FOIA was engaged. However, he rejected arguments that such disclosure would render meaningful police investigation impossible and that, pending any trial, the CCTV footage should only be disclosed to the CPS, the Courts or other bodies involved in the investigative process.

The Commissioner’s comments on the public interest in full disclosure of any material relating to the 7/7 bombings are of particular interest. He noted, for example, that whilst there had already been widespread media coverage in relation to the bombings, “full disclosure in order to avoid any suspicion of ‘spin’ or ‘cover up’ will continue to be in the public interest regardless of the volume of related information that has previously been disclosed”. On similar lines, he observed that in circumstances in which the 7/7 attacks had been the subject of conspiracy theories, the fact that “disclosure would presumably support the official account of the time line and basic facts of the attacks and reduce any perceived lack of transparency about how this account was formed, along with removing any suspicion of ‘spin’ or ‘cover up’” was a valid public interest factor in favour of disclosure.

The Commissioner rejected the Met’s claim that the exemption under section 38(1)(a) of FOIA (health and safety) was engaged at all, emphasising that the arguments advanced by the Met on this point had lacked detail in relation to the specific CCTV footage in question. He also concluded that, whilst not cited by the Met, the personal data exemption in section 40(2) of FOIA was engaged in respect of footage from which individuals other than the perpetrators of the attacks could be identified. The Met must redact this information, such as by pixellation, before the footage is disclosed.

In other Decision Notices issued this week, the Commissioner has held that:

  • Oxford, Cambridge and Manchester Universities and Kings College and University College, London must disclose information relating to primate research. A complainant had sought such information from a number of universities, including information as to the numbers and species of primates referred to in returns to the Home Office, and as to current research. The Commissioner held that the exemptions relied upon by the universities were not engaged (variously, sections 38 (health and safety), 40 (personal data) and 43 (commercial interests) of FOIA).

 

  • The Department of Health must disclose civil servants’ submissions to Ministers in relation to proposed variations to consultants’ contracts as part of its ‘modernising medical careers’ initiative. Whilst the exemption in section 35(1)(a) (policy) of FOIA was engaged, the public interest in maintaining the exemption did not outweigh that in disclosure (FS50151464).

 

  • In contrast, the FCO was entitled to refuse to confirm or deny whether it held particular information as to identification of a voice heard in the video showing the beheading of Ken Bigley in Iraq in 2004. The FCO successfully relied upon sections 23(5) (information supplied by or relating to the security services) and 24(2) (national security) of FOIA (FS50188323).

Reviewing the situation

Posted on | by Timothy Pitt-Payne KC

Under FOIA, there is no statutory duty on public authorities to operate an internal review procedure relating to their handling of FOI requests.  There is however an incentive for them to do so – if a review procedure  is available but has not been exhausted then the Commissioner can decline to entertain a complaint from the requester under FOIA section 50. 

Section 45 of the Act enables the Secretary of State to issue a Code of Practice giving guidance to public authorities about how they should operate their functions under the Act.  The Commissioner can make a practice recommendation (under section 48) where a public authority’s practice appears not to comply with the Code.

The Code issued under section 45 in November 2004 states that authorities should operate a review procedure, with decisions being made within a reasonable time.  In February 2007 the Commissioner issued guidance that a reasonable time for completing an internal review is 20 working days from the date of the request; in a small number of cases it might be reasonable to take longer, but in no case should the time taken exceed 40 days.

Today the Information Commissioner’s Office (ICO) has issued a press release about a Practice Recommendation addressed to Greater Manchester Police (GMP) dated 31st March 2009.   The Recommendation expresses concern both about the time taken by GMP to deal with internal reviews (over 150 working days in one case) and the apparent inaccuracy of some of the information provided to the ICO by GMP.  The Commissioner recommends that GMP should take steps to ensure its future compliance with the time limits in the ICO’s February 2007 guidance.   Paragraph 52 of the recommendation is significant, emphasising the ICO’s willingness to take formal action where there is continuing non-compliance with the Code. 

Incidentally, although the Practice Recommendation refers to the ICO’s February 2007 guidance, new guidance about internal reviews (dealing with both FOIA and EIR) was issued on 16th February 2009.  A useful summary of recent guidance issued by the ICO is available here, courtesy of the FOI blog maintained by the Campaign for Freedom of Information.

I am grateful to Andrew Smith (currently a pupil at 11KBW) for drawing the Practice Recommendation to my attention and helping to draft this post.

The Age of Internet Surveillance

Posted on | by Anya Proops KC

With effect from today, all UK internet service providers (“ISP”) will be required to retain data relating to every email which is sent and every online telephone call which is made using their services. The data, which must be stored by ISPs for 12 months, will not include the content of the email or the call. It will however include the date, time, duration and routing of the online communication as well as information as to the internet subscriber or user. The obligation to retain this data is imposed under the Data Retention (EC Directive) Regulations 2009 (“the Regulations”). The regulations were enacted in order to bring into effect the provisions of the Data Retention EU Directive 2006/24/EC. The Directive was itself enacted in response to concerns that a lack of consistency of approach to data collection across Europe, particularly in the field of internet communications, was hampering the fight against crime, including international terrorism. The effect of the Regulations, which come into force today, is that the data retention principles which already apply to telecoms providers under the Data Retention (EC Directive) Regulations 2007 will now also apply to internet providers. As well as retaining the communications data, the internet service provider must afford access to particular data where they are required to do so by law (regulation 7). They must also abide by certain principles relating to the protection and security of the data (regulation 6).

Recruiting the iPod generation

Posted on | by Timothy Pitt-Payne KC

In an article in today’s Financial Times, Benjamin Akande of Webster University talks about the “iPoders” – the generation born between 1982 and 2000.  He describes a generation of technology addicts, using the internet as its first resort for information-gathering, and nurturing personal relationships through social networking and twittering.  According to Akande, as it enters the workforce this cohort will be looking for organisations that share its appetite for technological innovation. 

One issue that Akande doesn’t discuss is how iPoders view their personal privacy.  How will they react if their technology-aware future employers treat Facebook and MySpace as a legitimate part of pre-recruitment due diligence?  It’s often suggested that today’s 20-somethings are deeply relaxed about information privacy.  A more realistic view may be that, as early adopters of social networking technology, they are learning the hard way about the implications of putting personal information online.  In 2007, Oxford University students were outraged when photographs on Facebook were used in order to crack down on post-exam celebrations. 

At the same time, employers need to be cautious about googling their job applicants.  For instance, interview panels know not to ask questions about any plans for starting a family.  But what if one of the interviewers finds out information of this kind, from his online researches into the candidates?  Unless the information is wholly disregarded, there is an obvious risk of a discrimination claim if the candidate is rejected.