Report - Guardian

The LSE Identity Project Report: June 2005 251unintended omissions from the Bill as drafted, which will be rectified in later legislativestages.The audit trail and the Data Protection Act 1998Under the Data Protection Act 1998, individuals have a general right of access topersonal data held about them. The Information Commissioner has commented inrelation to apparent restrictions on this right of “subject access” in the Draft Bill, that inthe current Bill,“there is no longer any attempt to restrict an individual’s right ofaccess under the Data Protection Act 1998 to certain ‘audit’ or ‘datatrail’ information.” 673The Home Office has even attributed their decision to create such extensive data trailsto “representations from the information commissioner”. 674 If true, this amounts to anown-goal for the national regulator of information privacy, because the consequence ofcreating a dense and perhaps ubiquitous audit trail are a much worse outcome forprivacy than the potential abuses against which it is purported to act as a safeguard.Access of any part of an individual’s entry in the Register (including access to the audittrail) should itself generate a corresponding new entry in the audit trail. Therefore theentries in the audit trail will logically comprise two types of event:- consented or aware : a person presenting their card for online verification, toauthorise use of some public or private service, and concomitant disclosure ofinformation from the Register. This includes occasions when an individualexercises their right of subject access to information held in the Register, anddisclosure of that information to the data subject.- non-consented or unaware : access to the Register without the individual’sawareness and/or specific consent, for example to ascertain identity by means ofmatching with a live biometric obtained after arrest by the police, or checks by apublic or private organisation empowered to do so without notifying theindividual.It is critically important to note that audit trail events of the first kind reveal informationabout the individual’s activities, behaviour and movements, whereas the preponderanceof audit trail events of the second kind record the activities and behaviour oforganisations conducting checks on the Register.Disclosure under a Subject Access RequestUnder DPA 1998, disclosure of information to an individual asserting their subjectaccess right is exempted to the extent it would be:673 The Identity Cards Bill - the Information Commissioner’s Perspective,http://www.informationcommissioner.gov.uk/cms/DocumentUploads/The%20Identity%20Cards%20Bill%20Dec%2004.pdf674 Stephen Harrison’s speech to the Law Society, reported in the Guardian 23 rd March 2004, ‘Government will TrackID card use’, http://www.guardian.co.uk/guardianpolitics/story/0,,1175638,00.html.