Report - Guardian

The LSE Identity Project Report: June 2005 253From the point of view of protection of the individual, the audit trail of Register accessevents, of which they are not aware or for which their consent is not required, should bemaintained for a sufficient period to allow redress of abuse, but there is no suchcompelling reason in the interest of the individual to retain a trail of consented/awareaccess events indefinitely.The design implications of fixing this problem are relatively simple. There is notechnological reason why an individual should not exercise their right of subject accessto their audit trail by periodically “downloading” a copy to a personal computer from anonline portal to the Register provided for this purpose. The evidential integrity of thisaudit trail data could be guaranteed by certifying it with a digital signature affixed bythe Register, (in accordance with the Electronic Communications Act 2000). There isthen no necessity to require the Register to maintain an original copy of the data, and itcould be deleted if the individual wishes. Of course the Register would create a newaudit trail from that time going forward, until again downloaded and deleted. Anysubsequent claim and investigation of abuse could rely on audit data in the individual'scustody (and if necessary cross-checked with decentralised secondary records held bypublic or private organisations empowered to make use of the Register).It may be argued that it would be useful for the Register to keep a copy of the trail incase the behaviour/whereabouts/activities of the individual subsequently needed to beinvestigated for some official purpose. But such retention would need to be justifiableunder the provisions of the Data Protection Act and ECHR Article 8 tests of necessityand proportionality.It may also be argued that the idea of downloading and then erasing trails of theconsented/aware events will only be of interest to an technophile elite, but the designand operation principles established through primary legislation should be durable, andit is only in the past decade that most people have had access to personal computers andthe Internet.There is therefore overall a strong case for differentiating between audit trail eventspertaining to Register access and identity verification of which the user is aware or towhich they have consented, and other types of event. It is not in the interests of theindividual for a comprehensive trail to be retained indefinitely - the cumulative threat toprivacy will at some point outweigh the risk of ancient abuse claims incapable ofpursuit. Furthermore the Investigatory Powers Tribunal imposes a one year time-limiton their acceptance of complaints, which would apply equally in relation to complaintsabout the conduct of Agencies in relation to the ID scheme.The residue of trails left after deletion of consented/aware events (at the individual’sdiscretion) would logically be those occasions when the Register was checked withoutthe knowledge or permission of the individual. The former category constitutes adossier of life events and behaviour about the individual and is therefore highly privacyinvasive,but the latter are predominantly information about the behaviour oforganisations using and accessing the Register. There is thus a compelling rationale todistinguish and clearly separate requirements and policies for the recording of these twotypes of events in any audit trail.