Overlooked - Liberty

44 Overlooked: Surveillance and personal privacy in modern Britain
evidence before individuals were apprehended, secure data retention, and operator training and
supervision. Individuals should be protected by the need for consent for disclosure of images, and
be able to obtain redress readily. With the exception of the evidence proposal, these are factors
within the remit of the data protection regime, and to different degrees reflected in the existing code
of practice. The new draft code, still at consultation stage, does seem to be attempting to
strengthen and address some of these outstanding issues.
Other regulatory options, that appear to be attractive to the public, are beyond the powers of the
Information Commissioner, and the informational aspect of privacy, and appear to engage more
directly with Article 8, and surveillance attributes. They go beyond the protection of individual
interests and raise complex questions about the accountability of the public sector in the use of
visual surveillance, and its role in monitoring other uses of visual surveillance. These options include
a system of licensing, a role for local authorities in granting permission for the siting of cameras in
public places, and consultation and participation by local people in the decision whether to install
cameras and where to place them. Privacy or surveillance impact assessments may also have a role
to play 97 . Such options are incapable of implementation without further public discussion and the
development of consensus. Public awareness is needed to raise the level of debate, and a forum in
which those responsibilities that fall outside the remit of the Commissioner, but engage Article 8, can
be explored and refined.
Three key questions emerge as we think of the future of visual surveillance technologies within the
existing UK regulatory framework. The first is practical, and asks whether operators are meeting the
requirements of the DPA, and maintaining signage, disciplined control rooms, and good data
management and retention practice. The second encompasses the answer to that question, and
asks whether the DPA is a sufficiently robust framework to enable the ICO to fulfil its role: “primarily
to ensure that the Data Protection Principles apply in detail to the operation of surveillance in public
places, and are seen to be properly and wholeheartedly enforced” 98 .
The ICO lacks resources to build and promote its existing intervention, investigation and
enforcement capacity, and can be expected to acknowledge that without general powers of
inspection it is not possible to be confident that operators are complying with the legislation and
code of practice. At European Union level, the Committee established to monitor the implementation
of the EU Data Protection Directive 99 (the Directive upon which the Data Protection Act 1998 is
based) is exploring what is needed for practical compliance, and seeking to harmonise compliance,
has recognised that the ICO, along with its counterparts in other European countries, is underresourced.
But the ICO also needs sufficient powers. The Committee’s call upon Member States to
ensure that supervisory authorities take a more proactive step towards enforcement should add
weight to this debate.
The further question addresses imminent developments in the form of technological advances in
surveillance methods and data sharing, and asks whether the DPA framework can or should be the
only tool with which we meet the challenge as a society. The answer here appears to be that there is
97
A Report on the Surveillance Society, Surveillance Studies Network, ICO, 2006 where the potential of
privacy and surveillance impact assessments are discussed in detail.
98
ICO, 2004
99
http://ec.europa.eu/justice_home/fsj/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf