Tag: surveillance

Include me out

Posted on | by Timothy Pitt-Payne KC

In the past few days there has been a lot of media coverage about online behavioural advertising – see for example this article published earlier this week in the Financial Times, under the euphonious title “A deeper peeper”. 

One important issue in this context (e.g. in assessing whether this form of advertising involves unfair processing of personal information under the Data Protection Act) is the extent to which individuals can opt out of having information collected about their web usage.  An opt out facility is offered by this site, which is maintained by a number of online advertising companies (including Google).  

If you want to see whether Google is collecting information about your advertising preferences, or if you want to change that information, then you can do so here.

There’s an important general point here.  Privacy will in future depend increasingly on two things.  One is the development of tools to enable individuals to protect their privacy.   The other is the willingness of individuals to find out about those tools and to use them.  The Information Commissioner issued a report on this subject – entitled “Privacy by design” – in November 2008.  

The other side of the coin, as far as behavioural advertising is concerned, is that some individuals will actually welcome the prospect of receiving advertisements that are targeted to their individual interests.  For instance, a number of Amazon users are happy to see book recommendations that reflect their previous use of the Amazon site.

Bad Phorm?

Posted on | by Anya Proops KC

The European Commission has announced that it is mounting a legal challenge in respect of the use of targeted online advertising in the UK. The challenge follows complaints which were made to the Commission in response to BT’s act of testing the technology on BT broadband users without their consent. The technology, which is the brainchild of a company called Phorm, enables internet service providers (ISPs) to profile what sites internet users visit so as to enable advertising companies more astutely to target their adverts on individual users. The Commission has taken the view that the UK has breached EU data protection laws by permitting the deployment of the technology in the absence of user consent. The Information Commissioner’s Office has previously stated that the use of the technology would be permissible if operated on the basis that users have opted in to the system. The Commission’s challenge raises real questions as to the legality of Google’s recently launched behavioural targeting system. See further my post on this system below.

The Age of Internet Surveillance

Posted on | by Anya Proops KC

With effect from today, all UK internet service providers (“ISP”) will be required to retain data relating to every email which is sent and every online telephone call which is made using their services. The data, which must be stored by ISPs for 12 months, will not include the content of the email or the call. It will however include the date, time, duration and routing of the online communication as well as information as to the internet subscriber or user. The obligation to retain this data is imposed under the Data Retention (EC Directive) Regulations 2009 (“the Regulations”). The regulations were enacted in order to bring into effect the provisions of the Data Retention EU Directive 2006/24/EC. The Directive was itself enacted in response to concerns that a lack of consistency of approach to data collection across Europe, particularly in the field of internet communications, was hampering the fight against crime, including international terrorism. The effect of the Regulations, which come into force today, is that the data retention principles which already apply to telecoms providers under the Data Retention (EC Directive) Regulations 2007 will now also apply to internet providers. As well as retaining the communications data, the internet service provider must afford access to particular data where they are required to do so by law (regulation 7). They must also abide by certain principles relating to the protection and security of the data (regulation 6).

Big Brother Takes to the Road

Posted on | by Anya Proops KC

Many of us are aware that, when in use, our mobile phones can be used by telecoms companies and security agencies to trace our whereabouts. However, few of us are likely to have been contemplating a scenario where our cars would contain built-in tracking devices enabling state authorities to have, in effect, a system of near total road surveillance. However, a new EU backed project, known as the Cooperative Vehicle-Infrastructure Systems (CVIS) project, may go a long way towards achieving that result. In particular, it is understood that the project, which is due to be unveiled later on this year,  envisages that, by 2013, such devices would commonly be built into newly manufactured cars and that a universal frequency will be made available so as to enable state authorities to monitor the location of all cars fitted with the device. As one might expect, privacy and civil liberties groups are said to be up in arms about this development. It is understood that the European Data Protection Supervisor will make a formal announcement on the privacy implications of CVIS technology soon.

Media article:

https://www.guardian.co.uk/uk/2009/mar/31/surveillance-transport-communication-box

CCTV Pixel Panic

Posted on | by Anya Proops KC

The use of CCTV cameras by local authorities has long been a controversial subject. Civil liberties groups regard the proliferation of such cameras as an unjustified infringement of the right to privacy. Others regard the use of such cameras as a necessary and, hence, justified evil in the fight against crime and anti-social behaviour. However, recent guidelines issued by the Department for Transport (DfT) has raised altogether different questions about the legality of local authority CCTV systems. In particular, DfT published guidelines last week confirming that, with effect from 1 April 2009, Westminster council’s mobile CCTV cameras would be rendered unlawful because they lack a sufficient number of pixels to meet the new quality requirements imposed under the Traffic Management Act 2004 (TMA). The DfT has confirmed that the cameras must be switched off by midnight on 31 March in order to avoid falling foul of new TMA provisions, which come into force on 1 April. This is an untimely development for those law enforcement agencies which were hoping to use the mobile cameras as part of the security strategy to manage the G20 summit. It is understood that Westminster Council has now written to the Transport Secretary, Geoff Hoon, as a matter of urgency requesting a special dispensation so that the cameras will not have to go dark on the eve of the summit.

Articles:

https://www.guardian.co.uk/uk/2009/mar/30/cctv-london-government-transport-g20

https://news.bbc.co.uk/1/hi/england/london/7971436.stm

Lords’ Report on Surveillance Society

Posted on | by Anya Proops KC

The House of Lords Constitutional Committee has today published an important report on the use of surveillance within society. The report, entitled ‘Surveillance: Citizen and State’, considers the constitutional implications that changes in the use of government surveillance and data collection have upon the privacy of citizens and their relationship with the State. The introduction to the Report states as follows:

’13.  We regard a commitment to the freedom of the individual as paramount. It is a precondition of the functioning of our existing constitutional framework. We also believe that privacy and the principle of restraint in the use of surveillance and data collection powers are central to individual freedom, and should be taken into account and adhered to at all times by the executive, government agencies, and public bodies. There is a danger that the growing use of surveillance by government and private organisations in the UK could constitute a serious threat to these principles and commitments. 14.  Mass surveillance has the potential to erode privacy. As privacy is an essential pre-requisite to the exercise of individual freedom, its erosion weakens the constitutional foundations on which democracy and good governance have traditionally been based in this country. Central to this inquiry is the question of whether surveillance, which has substantially increased over recent years, represents a threat to these foundations, and to what extent surveillance should be permissible within the current constitutional framework of the UK.’

Chapter 5 of the Report considers the role of surveillance regulators. With respect to the Information Commissioner, the Report stated that ‘given the impressive work that is currently being done by the Commissioner’s Office, there is a pressing need to strengthen his regulatory hand’.  The Report focusses on recent innovations to strengthen the Commissioner’s regulatory role, including: (a) Government approval for the Commissioner to be placed under a statutory duty to produce a data-sharing code of practice which would be approved by Parliament; (b) the Government’s decision to provide a statutory basis for the Information Commissioner to carry out inspections without consent of public sector organisations which process personal information systems; and (c) the introduction of the Criminal Justice and Immigration Act 2008, which will, when it comes into force, empower the Commissioner to impose monetary penalties on data controllers (in the public or private sector) for breaching the data protection principles knowingly or recklessly in ways that are serious and likely to cause substantial damage or distress. However, the Committee also made a number of recommendations aimed at enhancing the Commissioner’s powers still further (see chapters 5 and 9). Thus, it recommended:

  • that the Government instruct departments to consult the Information Commissioner at the earliest stages of policy development, so as to ensure that his views on privacy and data protection are properly taken into account;
  • that the Government reconsider the question whether the Commissioner should be given powers to carry out inspections of private sector bodies without consent (his powers being limited under the Criminal Justice and Immigration Act 2008 to public sector bodies);
  • that the Government consider expanding the remit of the Information Commissioner to include responsibility for monitoring the effects of government and private surveillance practices on the rights of the public at large under Article 8 of the European Convention on Human Rights;
  • that the Government should be required, by statute, to consult the Information Commissioner on bills or statutory instruments which involve surveillance or processing powers;
  • that, in conjunction with the Information Commissioner, the Goverment should undertake a review of the law governing the consent of individuals to the use of their personal data;
  • that the Government should commit to a plan of action, agreed with the Commissioner, to raise public awareness of the issues surrounding the use of surveillance.

Other notable recommendations in the report include:

  • Privacy Impact Assessments – The Government should amend the provisions of the DPA 1998 to make it mandatory for Government departments to produce and make available an independent, publicly available, full and detailed Privacy Impact Assessment (PIA) prior to the adoption of any new surveillance, data collection or processing scheme, including new arrangements for data sharing. That the Information Commissioner or other independent authorities should have a role in scrutinising and approving any PIA;
  • DNA Profiles – DNA profiles should only be retained on the National DNA Database (NDNAD) where it can be shown that such retention is justified or deserved. The Committee confirmed that it expected the Government to comply fully, and as soon as possible, with the judgment of the European Court of Human Rights in the case of S. and Marper v. the United Kingdom, and to ensure that the DNA profiles of people arrested for, or charged with, a recordable offence but not subsequently convicted are not retained on the NDNAD for an unlimited period of time.
  • CCTV – The Home Office should commission an independent appraisal of the existing research evidence on the effectiveness of CCTV in preventing, detecting and investigating crime. The Government should propose a statutory regime for the use of CCTV by both the public and private sectors, introduce codes of practice that are legally binding on all CCTV schemes and establish a system of complaints and remedies. This system should be overseen by the Office of Surveillance Commissioners in conjunction with the Information Commissioner’s Office.
  • Controlling Access to Personal Data – The Government should introduce regulations aimed at: (a) requiring the encryption of personal data to be mandatory in some circumstances and (b) ensuring that organisations avoid connecting to the internet computers which contain large amounts of personal information.
  • RIPA – The current administrative procedures contained in RIPA should be reviewed, including the system of authorisations. Government consultations on proposed changes to the Regulation of Investigatory Powers Act 2000 should include consideration of consider whether local authorities, rather than the police, are the appropriate bodies to exercise powers under RIPA. If it is concluded that they are the appropriate bodies, such powers should only be available for the investigation of serious criminal offences which would attract a custodial sentence of at least two years. The Government should take steps to ensure that these powers are only exercised where strictly necessary, and in an appropriate and proportionate manner. The Government should also examine the feasibility of rationalising the inspection system and the activities of the three RIPA Commissioners. (This recommendation was made in light of concerns expressed by the Committee that the current arrangement whereby three different offices oversee the operation of RIPA may result in inefficiencies and disjointed inspection).
  • Legislative Scrutiny – The Government should give high priority to post-legislative scrutiny of key statutes involving surveillance and data processing powers, including those passed more than three years ago. The statutes should be considered as part of a whole, rather than in isolation. This post-legislative role could be carried out effectively by a new Joint Committee on surveillance and data powers.
  • Article 8 – Instructions for Surveillance Bodies – The Government should instruct government agencies and private organisations involved in surveillance and data use on how the rights contained in Article 8 of the European Convention on Human Rights are to be implemented. The Government should provide clear and publicly available guidance as to the legal meanings of necessity and proportionality. A complaints procedure should be established by the Government and , where appropriate, legal aid should be made available for Article 8 claims.
  • Judicial Oversight – The Government should consider introducing a system of judicial oversight for surveillance carried out by public authorities, and that individuals who have been made the subject of surveillance be informed of that surveillance, when completed, where no investigation might be prejudiced as a result. Compensation should be available to those subject to unlawful surveillance by the police, intelligence services, or other public bodies acting under the powers conferred by RIPA.
  • ID Systems – The Government’s development of identification systems should give priority to ‘citizen-oriented considerations’.
  • More Effective Leadership – The role of data protection minister should be enhanced and its profile elevated because of the need for more effective central leadership.
  • Culture Change – The Committee supported the recommendations made in the Thomas-Walport Data Sharing Review Report for changes in organisational cultures, leadership, accountability, transparency, training and awareness, and it welcomed the Government’s acceptance of them.
  • Public Procurement – The Government should review its procurement processes so as to incorporate design solutions that include privacy-enhancing technologies in new or planned data gathering and processing systems.

The Report:

https://www.publications.parliament.uk/pa/ld200809/ldselect/ldconst/18/1802.htm

Media Coverage:

https://news.bbc.co.uk/1/hi/uk_politics/7872425.stm

https://www.guardian.co.uk/uk/2009/feb/06/surveillance-freedom-peers