Overlooked - Liberty

106 Overlooked: Surveillance and personal privacy in modern Britain
patterns arising from data matching or data mining might not justify or legitimise the use of human
surveillance or reference to the police for investigation. However, it is more likely to satisfy the more
easily achievable requirements of accessing communications data. ‘More easily achievable’ in this
context can be taken to mean both in terms of the legal grounds justifying the accessing of
communications data and in terms of the resource that will be necessary to ‘investigate’ further.
Once an application for access to communications data has been authorised, this will allow access
to email, mobile and phone traffic which might take investigation further. If for example, it appears
that a series of calls or emails have been made to individuals who are themselves suspected of
involvement in criminal activity, then a greater level of intelligence-led investigation might be
considered necessary. If, however the communications data does not reveal any unusual traffic, then
no further action might be considered necessary. It is, however, extremely unlikely that the person
who had had his or her communication traffic studied will be aware of the fact. The sheer number
of applications made coupled with involvement after the event limits any practical involvement of, or
accountability to, the Interception of Communications Commissioner’s office.
Therefore, one potential consequence of growing reliance on data matching practices might be a
ripple effect impacting upon the exercise of RIPA powers. The growth of data matching and data
mining practices are also likely to raise issues in relation to the way suspicions are recorded. If a
pattern of data throws up an anomaly that results in investigation and possible identification of
criminal activity, then it is likely that that pattern will be recorded for future reference as flags
indicating some sort of impropriety. However, as any two sets of data pattern are unlikely to be
identical the indicators are likely to be quite general in nature. As a consequence any similar data
pattern is likely to be ‘caught in the net’ and might warrant further investigation. Again, largely
automated processes could have the potential for a ripple effect.
Central to the use of data mining and data matching capability will be the holding of mass
informational data. This study has focused on the National Identity Register created by the Identity
Cards Act 2006 as being potentially the largest and certainly the most topical example of mass
information holding. However, this is only one of many examples. As well as other centralised
databases such as the Children Index there are numerous centralised records detailing individual
finances, benefit entitlements and so on. Meanwhile the growth of data sale such as with
Experian’s credit reference database demonstrates increasing reliance on mass data holding in the
private sector.
The mass of available data is staggering. As has been said earlier, increasing use of automated
sifting is a logical method of identifying potential impropriety. Privacy concerns must be
considered in the light of clearly legitimate aims of detecting and preventing crime, protecting
children, and so on.
The legislative framework
Ideally, the legislative environment in which privacy issues arise should ensure proportionality and
legitimacy of data sharing and other privacy matters. However, it is arguable that the two main
privacy acts, the Data Protection Act (DPA) 1998 and the Human Rights Act 1998 (through Article
8) are unable to keep up with, and by themselves provide sufficient safeguards against, information
sharing capabilities.