Tag: privacy

EMPLOYMENT VETTING IN THE COURT OF APPEAL

Posted on | by Timothy Pitt-Payne KC

Employment vetting is of great interest to information lawyers.  Any vetting scheme depends on the systematic sharing of information about individuals.  Such schemes will always give rise to difficult questions about fairness.  An important recent decision of the Court of Appeal explores some of these issues, in the context of article 6 of the European Convention on Human Rights (ECHR).

Governors of X School v Queen on the application of G [2010] EWCA 1 concerned a teaching assistant at X school (“the employee”), who was accused of having sexual contact with a 15 year old boy on work experience at the school.  The school governors conducted a disciplinary hearing, and dismissed the employee.  The employee brought judicial review proceedings to challenge the governors’ decisions not to allow him legal representation at the disciplinary hearing or at a forthcoming appeal hearing.  He argued that these decisions violated his right to a fair hearing, under article 6 of the European Convention on Human Rights (ECHR).  The employee’s claim succeeded at first instance.  The Court of Appeal upheld that decision, rejecting the governors’ appeal.

The basis of the employee’s claim was that an adverse finding in the disciplinary proceedings would expose him to statutory procedures that would prevent him from working with children.  The Court of Appeal summarised the relevant procedures, by reference to three phases in the employment vetting regime:  (i) the “list 99” procedure, under section 142 of the Education Act 2002, prohibiting certain individuals from working in education; (ii) the transitional regime, under the Safeguarding Vulnerable Groups Act 2006 (“the 2006 Act”), whereby after 20th January 2009 certain cases under section 142 were referred to the new Independent Safeguarding Authority (ISA); and (iii) the substantive regime under the 2006 Act, whereby list 99 was replaced with effect from 12th October 2009 by the “children’s barred list”, established under section 2(1)(a) of the 2006 Act.

The Court of Appeal considered whether the school disciplinary proceedings were a determinant of the employee’s civil right to practise his profession as a teaching assistant, so as to engage article 6 of the ECHR.  Dismissal by the governors would not itself preclude the employee from practising his profession.  A decision to include the employee on a statutory barring list would, however, have that effect.  The question was whether the disciplinary proceedings had a substantial influence or effect on the barring proceedings, and therefore on the determination of the employee’s civil right to practise his profession. The answer was yes: therefore, the disciplinary proceedings engaged article 6.

The Court went on to consider whether article 6 required that the employee should be entitled to legal representation in the disciplinary proceedings.  Article 6 did not entail a right to legal representation in every case:  but in this case there was such a right, given the seriousness of what was at stake for the employee, and given the potential for legal representation to make a difference to the outcome.

The above analysis assumed that the case was to be treated as civil rather than criminal for the purposes of article 6.  The employee argued that the case ought to be treated as criminal:  given its other conclusions, the Court of Appeal did not need to decide this point.

The governors were a public authority under the Human Rights Act 1998, and therefore subject to the duty under section 6(1) of that Act, not to act incompatibly with Convention rights.  The implications of the Court of Appeal’s decisions for private sector employers are uncertain.  Such employers are not subject to the section 6(1) duty, and are not susceptible to judicial review.  But in an unfair dismissal claim against a private sector employer, the employee might well rely on Governors of X School in order to argue that a failure to permit legal representation would render any dismissal unfair.

The case is of very considerable importance.  It illustrates the wide consequences of the vetting scheme introduced by the 2006 Act.  The scheme will give rise to a host of difficult legal issues:  the Courts are only just beginning to explore them.

DNA Database – A Controversial Behemoth

Posted on | by Anya Proops KC

The police DNA database for England and Wales is currently the largest DNA database in the world. It has in excess of 5 million profiles, including the profiles of many individuals who have been found to be innocent of any charges made against them. The rapid development of this vast database has inevitably fuelled debates about the rise of the Surveillance ‘Big Brother’ State. Most notably, concerns have been expressed that the database unjustifiably interferes with the individual’s right to privacy, particularly having regard to the retention of records relating to people who have not been convicted of any offence (there are at least 850,000 profiles of such persons on the DNA Database). Earlier this year, these concerns resulted in a judgment by the European Court of Human Rights that the existing approach to the retention of DNA data relating to unconvicted individuals was unlawful (Marper v UK – see also my earlier post on the Marper case). Concerns have also been expressed as to the disproportionate presence of individuals from ethnic minorities on the database, particularly young black men, and as to the resulting discriminatory potential which is effectively built into the system.

Two recent important developments suggest that the controversies surrounding the database are only likely to intensify in the coming months. First, the government has opted to use the Queen’s Speech to lay before Parliament a bill which contains a number of inevitably controversial provisions relating to the database (the Crime and Security Bill). Second, a government backed commission, the Human Genetics Commission (HGC) has today issued a report entitled ‘Nothing to Hide, Nothing to Fear?’ which criticises a number of aspects of the existing database system.

The following aspects of the Bill are particularly worthy of note:

·         The Bill contains provisions aimed at giving the police additional powers to take DNA samples from individuals who have been previously arrested for crimes but whose biometric has yet to be obtained. The effect of the provisions is that the police will be entitled to take biometric data from someone who may have been arrested some time ago and before the new provisions came into force (clause 2(1)). The provisions also afford the police new powers to take DNA samples from UK nationals or residents who have been convicted overseas of serious sexual and violent offences (clause 3(1)). These powers would equally apply to convictions occurring prior to the coming into force of the new provisions.

 

·         The bill also sets out a statutory framework for the retention and destruction of biometric material (including DNA samples, DNA profiles and fingerprints) that has been taken from an individual as part of the investigation of a recordable offence (clause 14). These powers were consulted upon in the Keeping the Right People on the DNA Database paper published in May 2009. In effect, the provisions envisage a somewhat more nuanced approach to the retention of data with retention periods for the various categories of data depending on a number of factors including the age of the individual concerned, the seriousness of the offence or alleged offence, whether the individual has been convicted, and if so whether it is a first conviction. Most notably:

 

o   the fingerprints and DNA of adults who are arrested but unconvicted will prima facie be retained for a period of 6 years

 

o   the fingerprints and DNA of adults who are convicted will be retained indefinitely

 

o   lesser retention periods apply to persons under the ages of 18 and 16 and, in respect of such minors the gravity of the offence will be in issue

 

o   chief constables are however afforded a power to determine that any retention period may be extended by up to two years for reasons of national security

 

o   all DNA samples must be destroyed six months after being taken.

 

·         The Secretary of State will be afforded powers to make a statutory instrument prescribing the manner, timing and other procedures in respect of destroying relevant biometric material already in existence at the point the legislation comes into force. This will enable the Secretary of State to ensure that the retention and destruction regime set out in this Bill is applied to existing material (clause 19).

 

·         The National DNA Strategy Board which already exists to oversee the operation of the database will be put on a statutory footing (clause 20).

It remains uncertain whether any of these provisions will make it onto the statute books in advance of the forthcoming general election. However, it must be said that the growth in police powers which would be afforded under the Bill does not sit particularly comfortably with the serious concerns as to the existing system identified in the report from the HGC. Those concerns include, not least, concerns about the disproportionate representation of members of ethnic minorities; the retention of data relating to unconvicted persons for any period of time and, further, the problems of function creep.

NEW TECHNIQUES FOR APPLYING RIPA – OUTCOME OF HOME OFFICE CONSULTATION

Posted on | by Anya Proops KC

The Regulation of Investigatory Powers Act 2000 (RIPA) has attracted a considerable amount of negative publicity over the past couple of years. In no small part, this has been due to public outcry in response media reports of local authorities using their powers under RIPA to engage in activities such as monitoring the use of domestic wheelie bins, recording dog-fouling incidents on camera and carrying out surveillance on families suspected of trying to cheat the school catchment system (see further the discussion of the case of Paton v Poole Borough Council below). Concerns have been expressed by members of the public as well as privacy campaigners that such actions on the part of local authorities constitute abuses of their powers both because the surveillance powers of the state should not be used for trivial purposes and because there has been a failure on the part of the authority to achieve a proper balance between the rights of the state to identify civil and criminal wrongdoing and the individual’s right to have his or her privacy respected. Those concerns resulted in the Home Office commencing a consultation in April 2009 on proposals to introduce new RIPA techniques which would purportedly help ensure that RIPA would only be used when it was necessary and proportionate. Last week, the Home Office published a summary of the responses to those proposals along with an announcement. In the announcement, the view expressed by the Minister for State Security, Counter-Terrorism and Policing, David Hanson, was that the responses to the consultation had been broadly positive. He said that, subject to certain minor amendments, he would now take steps to introduce the proposals as secondary legislation. The announcement suggests that the new legislation will aim to:

  • clarify the test of necessity and proportionality so techniques will not be used for trivial purposes such as investigating dog fouling or people putting bins out a day early
  • raise the rank of the authorising officer for RIPA techniques in local authorities to senior executive at a minimum of ‘Director’ level
  • give elected councillors a role in overseeing the way local authorities use covert
    investigatory techniques
  • require constituents’ communications with MPs on constituency business to be
    treated as confidential information, and therefore subject to authorisation by a
    higher rank of officer
  • treat covert surveillance of legal consultations as ‘intrusive’ rather than ‘directed’
    surveillance, meaning that it can only be carried out by a very limited number of
    public authorities, primarily the police and intelligence agencies, and only with
    independent approval
  • clarify how provisions currently in the Policing and Crime Bill will reduce
    bureaucracy relating to RIPA in police collaborative units comprising two or
    more forces

It also appears that, following a proposal by the Local Government Association, local authorities will need to appoint a single official to be responsible for ensuring that all authorising officers are of an appropriate standard. Notably, the Home Office rejected suggestions that a more radical approach should be adopted, namely removing local authorities from the scope of RIPA altogether.

Coincidentally, the Investigatory Powers Tribunal, chaired by its President, Mummery LJ, was itself hearing a complaint last week brought under s. 65 RIPA that a particular local authority had unlawfully exercised its surveillance powers under RIPA. In Paton v Poole Borough Council, which was heard on 5 and 6 November, the IPT was called upon to decide whether the Poole BC had acted unlawfully under RIPA when it conducted directed surveillance of Ms Paton and her family. The surveillance had been conducted in circumstances where the council suspected that Ms Poole may have been dishonestly trying to abuse the school catchment system by giving a false address when applying for a place for her child at a local school. It was accepted by the council before the IPT that, in fact, its suspicions about Ms Paton had proved to be unfounded. However, the council nonetheless sought to maintain the position before the IPT that the surveillance constituted a necessary, proportionate and, hence, lawful exercise of its powers under RIPA. In advancing this case, it was argued on behalf of the council that there existed no simple means of uncovering fraudulent abuses of the school catchment system that did not involve any invasion of privacy rights. The council was represented by 11KBW’s Ben Hooper.

Proving Identity and Privacy – Scottish Consultation Paper

Posted on | by Anya Proops KC

The Scottish government has recently published a consultation paper on certain draft identity management and privacy principles. The draft principles have been developed with a view to ensuring that public services in Scotland are better placed to manage the process of proving identity (e.g. in the case of benefit claims) in a way that protects individual privacy. The deadline for responses is 23 November 2009

Blogger’s Identity Not Private Information

Posted on | by Anya Proops KC

Yesterday, the High Court handed down an important judgment on the application of the law of privacy to anonymous bloggers. The case involved a detective constable, Mr Horton, whose anonymous blog, ‘Night Jack’, gave a behind-the-scenes insight into modern policing. The prize-winning blog attracted a huge following. When a journalist at the time discovered Mr Horton’s identity by carrying out his own detective work, Mr Horton sought and was granted an injunction restraining the Times from revealing his identity. However, that injunction was lifted in a judgment handed down on 16 June 2009 by Eady J: The Author of a Blog v Times Newspapers Ltd [2009] EWHC 1358 (QB).

 

The central issue in the case was whether the developing law of privacy entitled Mr Horton to retain anonymity in respect of the blog. Eady J held that the injunction should be lifted because Mr Horton had failed to demonstrate that there was a legally enforceable right to maintain anonymity in respect of his identity. In reaching this conclusion, Eady J applied a two stage test: first, he considered whether Mr Horton had established that he had a reasonable expectation of privacy in respect of his blogging activities; second, he considered whether, if there was a reasonable expectation of privacy, that expectation was nonetheless overridden by the public interest in disclosure.  Eady J found that Mr Horton lost on the first limb of the test because the essentially public nature of his blogging activity meant that, judged objectively, Mr Horton could not reasonably expect that his identity would be treated as private information. Having decided the case against Mr Horton on this basis, Eady J nonetheless went on to consider the public interest arguments. With respect to those arguments, he held that there was in any event an overwhelming public interest in disclosure of the information. This was the case particularly given the public interest in revealing that the person making critical and politically controversial comments about the force through the blog was himself a particular serving police officer. In reaching these conclusions, Eady J rejected arguments to the effect that the injunction should be maintained given the risk that disclosure of his identity would increase the risk that Mr Horton would face disciplinary action.

Doing it by the book

Posted on | by Timothy Pitt-Payne KC

The Information Commissioner’s Office has today announced the latest version of the Privacy Impact Assessment Handbook.  As the title indicates, its purpose is to help organisations to identify and address the privacy risks of their activities.

Following the HMRC data breach in November 2007, the Cabinet Office introduced a requiring for all central Government departments and their agencies to conduct Privacy Impact Assessments (PIAs) when developing new systems. The ICO encourages all organisations to incorporate data protection safeguards into any new project involving personal information.

The handbook is in two parts: Part I (the first two chapters) gives an overview of the PIA process, with detailed information about privacy, common risks, and possible solutions; Part II  then gives a practical guide to conducing a PIA.  There are also four appendices, with examples of screening questions, checklist templates, and privacy strategies.

The handbook should help organisations to make reasoned judgments about the privacy implications of new projects or technological innovations. Some of the recommendations may overlap with privacy work already being done by organisations. A PIA does not have to be conducted as a totally separate exercise; indeed, it may be helpful to look at privacy issues in a broader policy context.

Many thanks to Andrew Smith, currently a pupil at 11KBW, for researching this post and preparing a first draft.