Overlooked - Liberty

120 Overlooked: Surveillance and personal privacy in modern Britain
by virtue of S.10 DPA. While S.10 seems to provide further protection under the DPA, it also serves
to again demonstrate how data sharing practices have outstripped protections. The Act caters for
situations where the processing of a particular piece or pieces of information cause harm to an
individual, where they are aware of that harm and are able to request that the processing not take
place. This does not match up to the mass processing reality of 2007.
At the heart of a response to these changes in data processing culture should be a significant
strengthening of the power and ability of the ICO to regulate the notification process effectively.
Notification needs to be more about regulation than about administration. The ICO needs to be able
to determine in advance whether processing might be constitute ‘assemble’ processing and take
action to prevent it. The ICO needs to be capable of limiting processing purposes, of making
decisions on societal rather than individual impact of what might constitute damage or distress, and
of strict interpretation of what constitutes excessive processing for purpose. In order to make any
of these changes effective, the Information Commissioner needs to be given effective enforcement
power to prevent any processing he considers to be incompatible with data protection principles.
Concerns over the effectiveness of the DPA also arise from the definition of ‘personal data’. This
definition impacts upon the scope of processing regulated by the DPA. The DPA defines ‘personal
data’ as:
‘data which relate to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the
possession of, the data controller’ 233
Meanwhile the definition set out in the EU Data Protection Directive states;
‘‘personal data’ shall mean any information relating to an identified or identifiable natural person
(‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular
by reference to an identification number or to one or more factors specific to his physical,
physiological, mental, economic, cultural or social identity’ 234
The Articles in the directive are preceded by a series of explanatory ‘recitals’. Recital 26 states:
‘Whereas the principles of protection must apply to any information concerning an identified or
identifiable person; whereas, to determine whether a person is identifiable, account should be taken
of all the means likely reasonably to be used either by the controller or by any other person to identify
the said person; whereas the principles of protection shall not apply to data rendered anonymous
in such a way that the data subject is no longer identifiable’(emphasis added) 235 .
The definition of personal data in the DPA is, therefore, more restrictive than that allowed for in the
Directive. The DPA bases the definition of personal data as relating to a living individual identifiable
from the data itself or from other information held by the data controller. The Directive is more
expansive by allowing the definition to include data identifiable by the controller or any other person.
233
Section 1(1).
234
Ibid 87 at Article 2(a).
235
Ibid 87 Recital 26.