Overlooked - Liberty

More documents

Recommendations

Info

<strong>Overlooked</strong>: Surveillance and personal privacy in modern Britain 121 This might seem an obscure and rather academic point. However, it is extremely relevant in the context of the mass data matching and mining processes referred to in this work. We have expressed concerns that pressures towards greater matching and profiling of data might prove irresistible. The definition of data contained in the DPA allows a certain leeway to do this if the data is anonymised prior to passing to a third party for further processing. This would allow, for example, data from the one data controller (data controller ‘A’) to be passed to another data controller (data controller ‘B’) to be matched against information held by them. If the data had been anonymised by A before being passed to B (by allocating an identifying number for example) then it might not constitute personal data under the DPA while in B’s possession meaning B would not have to comply with DPA requirements. Once B had processed the data they could pass it back to A with, for example, any comment about the person to whom the identifying number related being a potential security or crime risk. As a consequence the data has not really been ‘anonymised’ as most people would understand the word. A more accurate definition might ‘pseudonymised’. This definition might be used to describe data that does not contain names, but which does contain an identifier (such as a number) unique per individual for some time window. This identifier allows for further information to be obtained which can then be linked back to the person linked to this identifier. The use of pseudonymised data to allow a way around the DPA would not be possible if the definition in the Data Protection Directive was to be applied. Any processing by B would still have to comply with data protection requirements as the person would be identifiable as a consequence of information held by A. The implication of this is that it may be possible for data held on the NIR or on other mass informational databases to be matched or profiled against data held elsewhere without reference to data protection principles if it is initially anonymised (even if de-anonymised once passed back). The extent of DPA applicability to anonymised data is a grey area. While certainty in data processing can sometimes be elusive 236 , a definition of personal data more in line with the Directive would ensure that ‘anonymisation’ does not allow avoidance of data protection principles. Changes such as those outlined above cannot occur without the necessary political will. It is not generally in the nature of a Government to pass laws that restrict its ability to act that increase its accountability or that give powers to other agencies. Certainly, recent administrations have not demonstrated any particular inclination to do so. However political parties can and do act differently if there is a belief that doing so could bring political capital. When the current Labour administration was elected in 1997 it was with manifesto commitments both to delegating power and increasing accountability and transparency. One of the first acts of Gordon Brown as the then Chancellor was to free the Bank of England from political control 237 . Further political decentralisation took place with devolution. The Government also incorporated the European Convention on Human Rights into domestic law though the Human Rights Act 1998. This meant that all public bodies had to act in a way that was compatible with human rights obligations and allowed for the Government’s own lawmaking to be considered in terms of Convention compatibility by the courts. The Freedom of 236 For example, the extent to which those who are passed data by data controllers for further processing are data processors or data controllers can be difficult to define. 237 http://news.bbc.co.uk/onthisday/hi/dates/stories/may/6/newsid_3806000/3806313.stm
122 <strong>Overlooked</strong>: Surveillance and personal privacy in modern Britain Information Act 2000 was intended to open up the machinations of public bodies to scrutiny by allowing members of the public to request details of their activities 238 . These were the initial acts of an incoming administration sensing political capital to be gained from reversing a perceived lack of openness and accountability in government. Ten years on a similar claim might be made about privacy. Government inroads into individual privacy are a matter of increasing public concern and any party that identifies a need to bolster privacy protection might well gain from taking a bold stance on improved protection. Recommendation: Increased Role and Powers for the Information Commissioner’s Office Bolstering the power and resource of the Information Commissioners Office is fundamental to ensuring that there is meaningful regulation of privacy and data protection. The Information Commissioner Richard Thomas has also argued for more substantive powers. In his evidence to the House of Commons’ Home Affairs Committee 239 he set out his stall as to what additional safeguards the ICO should enjoy. For the purposes of this work it is appropriate simply to provide a summary of these recommendations. While generally endorsing the suggestions in principle, we do question whether they go far enough. For example, the ICO is updating its code of Practice on CCTV. As we have stated in our main recommendation, we favour substantive legislative regulation of CCTV. The ICO identifies two work streams; awareness raising and practical measures. Raising awareness might involve new research into public attitudes to surveillance with reference to particular examples such as the creation of the NIR, plans for road user charging and the developments of e-borders. Practical measures will include the development of an Information Sharing Framework Code of Practice and an updated CCTV Code of Practice. The evidence also identifies scope for improved privacy enhancing technologies which reduce the need to provide identifying particulars in order to access services. The Information Commissioner also makes a strong case for the use of privacy impact assessments to be provided by both governmental and non-governmental agencies 240 . These would be prepared in conjunction when any new information system is proposed or extension of information sharing planned. As well as offering insight into privacy issues arising from those proposals, they could also allow for privacy assessment to be made by practitioners who are involved in rolling out schemes which have a privacy impact. The Commissioner has also expressed his frustration at the late stage in which his office is involved by central government in its plans and recommends a requirement for his opinion to be sought at an early stage of proposal development. Arguably the most important suggestions made by the Information Commissioner relate to the powers of his office. He is concerned that his ability to audit and inspect data protection compliance is hindered by the need to obtain data controller consent. He also makes reference to the limitations 238 It is tempting to add the DPA1998 to this list of decentralising and empowering acts. However, as the DPA was essentially brought in to give effect to a European Directive, this might be a claim too far. 239 http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/home_affairs_ committee_inquiry_into_surveillance_society.pdf 240 The Surveillance Society report (ibid 4 above) provides further information on PIAs starting at Page 89.
Page 1 and 2:
Overlooked: Surveillance and person
Page 3 and 4:
Acknowledgements I would like to th
Page 5 and 6:
II Overlooked: Surveillance and per
Page 7 and 8:
iv Overlooked: Surveillance and per
Page 9 and 10:
2 Overlooked: Surveillance and pers
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
10 Overlooked: Surveillance and per
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
Page 43 and 44:
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78: 70 Overlooked: Surveillance and per
Page 107 and 108: 100 Overlooked: Surveillance and pe
Page 127: 120 Overlooked: Surveillance and pe
show all

Overlooked - Liberty

Create successful ePaper yourself

Delete template?

Save as template?