Tag Archives: ICO

February 28, 2014 · 4:02 pm

Fight back against damage and distress caused by inaccurate records

The distressing case of Sheila Holt, a woman in a coma, who was “harassed”* by the Department of Work and Pensions (DWP), and Seetec (DWP’s contractor carrying out work capability assessments) when they sent letters to her demanding she attempt to find work, casts light on an aspect of data protection law which is sometimes overlooked, at the expense of, for instance, data security.

I think Sheila Holt’s case suggests a possible serious contravention of the Data Protection Act 1998 (DPA) regarding the need to hold accurate records of people’s personal information. If it were indeed found to be a serious contravention, it could give rise to the possibility of a civil claim against those responsible, and enforcement action by the Information Commissioner.

We have all, I’m sure, been exasperated by organisations which fail to update their records, or mix our records up with someone else. This exasperation has even found an outlet of sorts in comedy. But behind it lies a point given serious focus by Sheila Holt’s case, and it relates to a legal obligation under the DPA. I will explain in a little detail how this works, but it does occur to me that the DPA is an underused weapon in citizens’ and consumers’ armoury, when faced with unyielding bureaucracy, and at the end of this post I will suggest an approach people might take in such circumstances.

 Please note – none of this is new, and for some readers of this blog it is basic, but I thought it would be helpful to lay it out, for any future reference. I remind readers that it is not to be taken as advice, let alone legal advice.

In what follows, the aggrieved individual is a data subject, and the organisation with inaccurate records is the data controller (this is a broad generalisation for the purposes of this post).

By s4(4) of the DPA a data controller must comply with all of the data protection principles in Schedule One of the DPA, and the fourth principle says that “Personal data shall be accurate and, where necessary, kept up to date”. 

If a data subject wants to check the accuracy of the records held on them, they can submit a request under section 7 of the DPA. This gives a broad entitlement to know who is holding their information and for what purposes, and to have the information “communicated” to them (generally in the form of copies/print-outs). If the records are shown to be inaccurate then the data subject should notify the data controller and require them to correct them.

If they fail to do so, and continue using the inaccurate records, and the inaccuracies give rise to serious (or potentially serious) consequences, then the data subject may be able to serve a legal notice requiring the data controller to stop: Section 10(1) DPA allows a data subject to serve a data controller with a notice requiring it to cease processing data which is causing or is likely to cause substantial damage or substantial distress (and that damage or distress is unwarranted). Section 10(3) DPA requires the data controller within 21 days either to comply with the 10(1) notice, or provide reasons why it will not. Section 10(4) allows a court, upon application from someone who has served a 10(1) notice, to order steps to be taken.

So, it is at least possible that a data subject who has been put to considerable time, or cost or effort because of inaccurate (“unwarranted”) records, can serve a section 10 notice. However, if this doesn’t apply (perhaps the damage or distress can only be described as minor) there is a more direct legal route: Section 14(1) DPA allows a court, on the application of a data subject that personal data of which the applicant is the subject are inaccurate, to order rectification.

Additionally, there may be the possibility of compensation. Section 13(1) DPA provides that “An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”. Section 13(2) provides that “An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation…if the individual also suffers damage by reason of the contravention” (emphases added). So, no compensation for distress unless “damage” can be shown (per Buxton LJ “…section 13 distress damages are only available if damage in the sense of pecuniary loss has been suffered…” in Johnson v Medical Defence Union [2007] EWCA Civ 262). But if a data subject can show pecuniary loss, the door to distress damages is opened (possibly even if the former is only nominal – see Halliday v Creation Consumer Finance Ltd [2013] EWCA Civ 333 where the defendant conceded nominal damages of £1, thus allowing a section 13(2) claim to proceed).

One further or parallel recourse for an aggrieved data subject is to ask the ICO, under section 42 DPA to assess whether it is likely or unlikely that that the handling of their data has been or is being carried out in compliance with the Act. A “compliance unlikely” assessment could, potentially, be used to bolster a claim under sections 10, 13 or 14. Moreover, it could lead to potential regulatory action against the data controller (for instance a civil monetary penalty notice under section 55A DPA, or an enforcement notice under section 40 DPA – although it should be noted that it would have to be a particularly serious breach of the “accuracy principle” to warrant such action, and to date, none such has been taken by the ICO). Systematic or egregious inaccuracy of records can often be an indicator of deeper information management failings, which should draw the ICO’s attention.

None of these various claims or actions under the DPA is likely to bring much comfort or relief to Sheila Holt and her family, but those who are harmed and distressed by inaccuracies in their personal information might want to consider doing some or all of the following 

  • Quantify, reasonably but comprehensively, what pecuniary damage you have suffered (letters written/phone calls made/ time off work/opportunities lost
  • Quantify how much consequent compensation for distress you think you are owed
  • Write to the data controller asking for the error to be rectified, and suggesting you might be owed appropriate compensation (as calculated above). Say that if they are not able to meet your demand you reserve the right to ask the IC to make a s42 assessment and/or make a claim under section 14 and (if appropriate) section 13(1) and (2). Say that you also reserve the right to draw the IC’s attention to what might be a serious contravention of the DPA of a kind likely to cause substantial damage or substantial distress
  • Serve a section 10(1) DPA notice requiring the CRA to cease processing inaccurate data (and to rectify) and tell them you reserve the right to seek compensation from them

The Information Commissioner’s Office (ICO) has helpful guidance on taking a data protection case to court.

*”harassed” was the word use in Parliament by the Minister

30 Comments

Filed under damages, Data Protection, Information Commissioner

Tagged as ,

February 24, 2014 · 8:35 am

Hospital records sold to insurance companies – in breach of the Data Protection Act?

I’ve asked the ICO to assess whether the sale of millions of health records to insurance companies so that they could “refine” their premiums was compliant with the law

I’m about to disclose some sensitive personal data: I have been to hospital a few times over recent years…along with 47 million other people, whose records from these visits, according to reports in the media, were sold to an actuarial society for insurance premium purposes. The Telegraph reports

a report by a major UK insurance society discloses that it was able to obtain 13 years of hospital data – covering 47 million patients – in order to help companies “refine” their premiums.

As a result they recommended an increase in the costs of policies for thousands of customers last year. The report by the Staple Inn Actuarial Society – a major organisation for UK insurers – details how it was able to use NHS data covering all hospital in-patient stays between 1997 and 2010 to track the medical histories of patients, identified by date of birth and postcode.

I don’t know if this use of my sensitive personal data (if it was indeed my personal data) was in compliance with the Data Protection Act 1998 (DPA), although sadly I suspect that it was, but section 42 of the DPA allows a data subject to request the Information Commissioner to make an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions of the DPA. So that’s what I’ve done:

Hi

As a data subject with a number of hospital episodes over recent years I am disturbed to hear that the Hospital Episode Statistics (HES) of potentially 47 million patients were disclosed to Staple Inn Actuarial Society (SIAS), apparently for the purposes of helping insurance companies “refine” their premiums. I became aware of this through reports in the media (e.g. http://www.telegraph.co.uk/health/healthnews/10656893/Hospital-records-of-all-NHS-patients-sold-to-insurers.html). I am asking, pursuant to my right under section 42 of the Data Protection Act 1998, the ICO to assess whether various parts of this process were in compliance with the relevant data controllers’ obligations under the DPA:

1) I was not aware, until relatively recently, that HESs were provided to the HSCIC – was this disclosure by hospitals compliant with their DPA obligations?

2) Was the general processing (e.g. retention, manipulation, anonymisation, pseudonymisation) of this personal data compliant with HSCIC’s or, to the extent that HSCIC is a data processor to NHS England’s data controller, NHS England’s DPA obligations?

3) Was the disclosure of what appears to have been sensitive personal data (I note the broad definition of “personal data”, and your own guidance on anonymisation) to SIAS compliant with HSCIC’s (or NHS England’s) DPA obligations

4) Was SIAS’s subsequent processing of this sensitive personal data compliant with its DPA obligations?

You will appreciate that I do not have access to some information, so it may be that when I refer to HSCIC or NHS England or SIAS I should refer to predecessor organisations.

Please let me know if you need any further information to make this assessment.

with best wishes, Jon Baines

We’ve been told on a number of occasions recently that we shouldn’t be worried about our GP records being uploaded to HSCIC under the care.data initiative, because our hospital records have been used in this way for so long. Clare Gerada, former Chair of the Council of the Royal College of General Practitioners wrote in the BMJ that

for 25 years, hospital data have been handled securely with a suite of legal safeguards to protect confidentiality—the exact same safeguards that will continue to be applied when primary care data are added

Well, it seems to me that those legal safeguards might have failed to prevent (indeed, might have actively permitted) a breach involving 47 million records. I’m very interested to know what the Information Commissioner’s assessment will be.

UPDATE: 24 February 2014

An ICO spokesperson later said:

“We’re aware of this story, and will be gathering more information – specifically around whether the information had been anonymised – before deciding what action to take.”

UPDATE: 25 February 2014

At the Health Select Committee hearing into the care.data initiative HSCIC and NHS England representatives appeared not to know much about what data was disclosed, and in what circumstances, and effectively blamed NHSIC as a predecessor organisation. This echoed the statement from HSCIC the previous evening

The HSCIC believes greater scrutiny should have been applied by our predecessor body prior to an instance where data was shared with an actuarial society

UPDATE: 27 February 2014

GP and Clinical Lecturer Anne Marie Cunningham has an excellent post on what types of data were apparently disclosed by NHSIC (or HSCIC), and subsequently processed by, or on behalf, of SIAS. I would recommend reading the comments as well. It does seems to me that we may still be talking about pseudonymised personal data, which would mean that the relevant data controllers still had obligations under the DPA, and the ICO would have jurisdiction to investigate, and, if necessary, take regulatory action.

See also Tony Hirst’s blog posts on the subject . These are extremely complex issues, but, at a time when the future of the sharing and linking of health and other data is being hotly debated, and when the ICO is seeking feedback on its Anonymisation Code of Practice, they are profoundly important ones.

UPDATE: 14 March 2014

The ICO has kindly acknowledged receipt of my request for assessment, saying it has been passed to their health sector team for “further detailed consideration”.

UPDATE: 24 May 2014

Er, there is no real update. There was a slight hiccup, when the ICO told me it was not making an assessment because “[it] is already aware of this issue and is investigating them accordingly. Given that we do not necessarily require individual complaints to take consider taking further action your case is closed”. After I queried the legal basis for failing to make a section 42 assessment as requested, the position was “clarified”:

…we will make an assessment in relation to this case, however we are unable to do so at this present time…This is because the office is currently investigating whether, as alleged in the media, actual personal data has been shared by the HSCIC to various other organisations including Staple Inn, PA consulting and Google

I don’t criticise the ICO for taking its time to investigate: it involves a complicated assessment of whether the data disclosed was personal data. In a piece I wrote recently for the Society of Computers and Law I described the question of whether data is anonymous or not as a “profound debate”. And it is also highly complex. But what this delay, in assessing just one aspect of health data disclosure, does show, is that the arbitrary six-month delay to the implementation of care.data was never going to be sufficient to deal with all the issues, and sufficiently assure the public, and medical practitioners, to enable it to proceed. A vote on 23 May by the BMA’s Local Medical Committee’s conference emphatically illustrates this.

13 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Information Commissioner, NHS, Privacy

Tagged as , , ,

January 31, 2014 · 4:55 pm

The care.data leaflet campaign – legally necessary?

Readers of this blog [sometimes I imagine them1] may well be fed up with posts about care.data (see here, here and here). But this is my blog and I’ll cry if I want to. So…

Doyen of information rights bloggers, Tim Turner, has written in customary analytic detail on how the current NHS care.data leafleting campaign was not necessitated by data protection law, and on how, despite some indications to the contrary, GPs will not be in the Information Commissioner’s firing line if they fail adequately to inform patients about what will be happening to their medical data.

He’s right, of course: where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) then it is not obliged, pace the otherwise very informative blogpost by the Information Commissioner’s Dawn Monaghan, to give data subjects a privacy, or fair processing notice.

(In passing, and in an attempt to outnerd the unoutnerdable, I would point out that Tim omits that, by virtue of The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000, if a data subject properly requests a privacy notice in circumstances where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) and would, thus, otherwise not be required to issue one, the data controller must comply2.)

Tim says, though

The leaflet drop is no way to inform people about such a significant step, but I don’t think it is required

That appears to be true, under data protection law, but, under broader obligations imposed on the relevant authorities under Article 8 of the European Convention on Human Rights (ECHR), as incorporated in domestic law in the Human Rights Act 1998, it might not be so (and here, unlike with data protection law, we don’t have to consider the rigid controller/processor dichotomy in order to decide who the relevant, and liable, public authority is, and I would suggest that NHS England (as the “owner of the care.data programme” in Dawn Monaghan’s words) seems the obvious candidate, but GPs might also be caught).

In 1997 the European Court of Human Rights addressed the very-long-standing concept of the confidentiality of doctor-patient relations, in the context of personal medical data, in Z v Finland (1997) 25 EHRR 371, and said

the Court will take into account that the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention (art. 8). Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general…Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community

This, I think, nicely encapsulates why so many good and deep-thinking people have fundamental concerns about care.data.

Now, I am not a lawyer, let alone a human rights lawyer, but it does occur to me that a failure to inform patients about what would be happening with their confidential medical records when GP’s were required to upload them, and a failure to allow them to opt-out, would have potentially infringed patients’ Article 8 rights. We should not forget that, initially, there was no intention to inform patients at all (there had no attempt to inform patients about the similar upload of hospital medical data, which has been going on for over twenty years). It is, surely, possible therefore, that NHS England is not just “helping” GPs to inform patients without having any responsibility to do so (as Dawn Monaghan suggests), but that it recognises its potential vulnerability to an Article 8 challenge, and is trying to avoid or mitigate this. Whether the leaflets themselves, and the campaign to deliver them, are adequate to achieve this aim is another matter. As has been noted, the leaflet contains no opt out form, and there seem to be numerous examples of people (often vulnerable people, for instance in care homes, or refuges) who will have little or no chance of receiving a copy.

At the launch of the tireless MedConfidential campaign last year, Shami Chakrabarti, of Liberty, spoke passionately about the potential human rights vulnerabilities of the care.data programme. Notifying patients of what is proposed might not have been necessary under data protection law, but it is quite possible that the ECHR aspect of doing so was one of the things on which the Health and Social Care Information Centre (HSCIC) has been legally advised. Someone made an FOI request for this advice last year, and it is notable that HSCIC seem never to have completed their response to the request.

1I make no apologies for linking to one of Larkin’s most beautiful, but typically bleak and dystopian, pieces of prose, but I would add that it finishes “…These have I tried to remind of the excitement of jazz, and tell where it may still be found.”

2Unless the data controller does not have sufficient information about the individual in order readily to determine whether he is processing personal data about that individual, in which case the data controller shall send to the individual a written notice stating that he cannot provide the requisite information because of his inability to make that determination, and explaining the reasons for that inability

2 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Europe, human rights, Information Commissioner, NHS, Privacy

Tagged as , ,

January 23, 2014 · 11:22 am

Staffs Police to drop controversial naming “drink drivers” twitter campaign

ICO confirms hashtag campaign prior to conviction was unlikely to be compliant with the Data Protection Act. Other forces to be advised via ACPO of issues raised by the case

Over the Christmas period Staffordshire Police ran a social media campaign, in which drivers arrested and charged with drink-driving offences were named on twitter with the “hashtag” #drinkdriversnamedontwitter. It seemed to me, and others, that this practice arguably suggested guilt prior to any trial or conviction. As I said at the time

If someone has merely been charged with an offence, it is contrary to the ancient and fundamental presumption of innocence to shame them for that fact. Indeed, I struggle to understand how it doesn’t constitute contempt of court to do so, or to suggest that someone who has not been convicted of drink-driving is a drink driver

and I asked the Information Commissioner’s Office (ICO)

whether the practice is compliant with Staffordshire Police’s obligations under the first data protection principle (Schedule 1 of the Data Protection Act 1998 (DPA)) to process personal data fairly and lawfully

The ICO have now issued a statement. Their spokesman says

The ICO spoke to Staffordshire Police following its #DrinkDriversNamedOnTwitter campaign. Our concern was that naming people who have only been charged alongside the label ‘drink driver’ strongly implies a presumption of guilt for the offence, which we felt wouldn’t fit with the Data Protection Act’s fair and lawful processing principle.

We have received reassurances from Staffordshire Police that the hashtag will no longer be used in this way, and are happy with the procedures they have in place. As a result, we will be taking no further action. We’ve also spoken with ACPO about making other police forces aware of the issues raised by this case.

I think this is a very satisfactory result. The ICO have, as I said previously, shown that they are increasingly willing to investigate contraventions of the DPA not limited to security breaches. No one would defend drink driving (and it was not the naming itself that was objectionable, but the tweeting of the names in conjunction with the hashtag) but the police should not be free to indicate or imply guilt prior to conviction – that is quite simply contrary to the rule of law.

What I still think is disappointing though, is that after an initial prompt response from the Attorney General’s twitter account (which missed my point), there has been no word from them as to whether the practice was potentially prejudicial to any forthcoming trial. Maybe they’d like to rethink this, in light of the statement from the ICO?

1 Comment

Filed under Data Protection, human rights, Information Commissioner, police, Uncategorized

Tagged as , , ,

January 18, 2014 · 11:11 am

If not that, then this?

Does the dropping of criminal charges against police officers under data protection and computer misuse legislation open the door to investigation of their employer’s civil liabilities?

The BBC reports that criminal charges have been dropped against three Nottinghamshire police officers. The charges appear to have been originally brought under the Data Protection Act 1998 (DPA) and Computer Misuse Act 1990 (CMA), and, according to the Police Federation it seems they were dropped because

prosecutors had found issues with training and advice on data protection for officers

Under section 55 of the DPA it is an offence to knowingly or recklessly, without the consent of the data controller, obtain or disclose personal data or the information contained in personal data. But the elements of the offence are not made out if the person doing this acted, for instance, in the reasonable belief that he or she had a lawful right to obtain or disclose the data, or if the obtaining was necessary for the purpose of preventing or detecting crime. Similarly, the offence of unauthorised access to computer material under section 1 of the CMA is only committed if the person knows that the access is unauthorised. If inadequate training and advice on access to data is given to employees of a data controller, then it will be difficult – as this story seems to reveal – to bring prosecutions. Effectively, the mens rea element of the offence is lacking.

However, perceptive readers of this blog might have noticed something: if incidents of inappropriate access to personal data have occurred, as appears to have been the case here, and the individuals accessing the data have been inadequately trained, does that not raise issues about the employer’s (the data controller’s) compliance with the seventh data protection principle in Schedule One of the DPA? This provides that

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data

The Information Commissioner’s Office (ICO) has repeatedly stressed that appropriate staff training is essential for compliance with the seventh principle. The ICO has the power, under section 55A of the DPA, to serve a civil monetary penalty notice on a data controller which has seriously contravened the DPA, where the contravention is of a kind likely to cause substantial damage or substantial distress. One wonders whether the ICO will now look into Nottinghamshire Police’s compliance with the Act, in view of the fact that incidents serious enough to bring now-dropped criminal charge took place, and the fact that they appear to have taken place against a background of inadequate staff training.

5 Comments

Filed under Breach Notification, Data Protection, Information Commissioner, monetary penalty notice, police, Privacy

Tagged as ,

January 6, 2014 · 5:01 pm

Unintended data protection consequences of Defamation Act and ICO proposals?

Might changes to defamation law, and to the Information Commissioner’s practices, lead to an increase in court claims about accuracy of personal data?

A statement is not defamatory unless its publication has caused or is likely to cause serious harm to the reputation of the claimant

This is the bold subsection (1) to section 1 of the Defamation Act 2013, which was commenced in England and Wales on 1 January 2014. This – in part the culmination of a strong campaign – is a potentially significant change to domestic libel law, meaning that (in the words of the explanatory notes to the Act)

the bar [is raised] for bringing a claim so that only cases involving serious harm to the claimant’s reputation can be brought

But often where a bar is raised in one place, a gap will be found in another. I wonder if, along with another development -namely, the Information Commissioner’s proposals to change its approach to regulation of the Data Protection Act 1998 (DPA) – it might lead to an increase in DPA claims.

11KBW’s Robin Hopkins wrote an important article last year, whose title helpfully summarises its argument: The Data Protection Act in defamation cases: increasingly relevant, potentially primary? In it, he identified a possible trend, citing two cases in particular as illustration – The Law Society and others v Rick Kordowski [2011] EWHC 3185 (QB) and Desmond v Foreman, & Ors [2012] EWHC 1900 (QB), of

The Data Protection Act 1998…increasingly being deployed as part of a claimant’s arsenal in defamation claims […] in some circumstances, the DPA may appropriately play the lead role rather than a supporting one in a complaint about unjustifiable and damaging communications about individuals

There are a number of potential claims which an aggrieved individual can make using the DPA. For our purposes here, though, the relevant provisions are those at section 14, dealing with inaccuracy

If a court is satisfied on the application of a data subject that personal data of which the applicant is the subject are inaccurate, the court may order the data controller to rectify, block, erase or destroy those data and any other personal data in respect of which he is the data controller and which contain an expression of opinion which appears to the court to be based on the inaccurate data

Clearly, inaccuracy – normally in the form of an untruth – is an important part of a defamation claim. If, now, those claims formerly made in defamation which were not worth the wick, let alone the candle are (statutorily) barred by virtue of section 1 of the Defamation Act 2013, will persistent claimants seek another route? Inaccuracy of personal data is a prima facie contravention of the fourth data protection principle in Schedule One of the DPA, and section 14 is a legitimate and specific legal route by which a person may have that inaccuracy corrected.

It should be noted, though, that the court does retain discretion (n.b use of “may” in section 14) as to whether to order rectification etc. An alternative route has traditionally been, of course, by means of making a request for assessment, under section 42 of the DPA, to the Information Commissioner (IC), as to whether processing of one’s personal data has been or is being carried out in compliance with the DPA. Upon receipt of a valid request of this type, the IC is required (“shall make…”) to make an assessment (although he retains discretion as to what is an appropriate manner for it to be made). I say “traditionally” because, as David Erdos argued in a guest post on this blog recently, the IC, in a consultation on a future approach to dealing with DPA complaints and concerns

proposes to decide on its own account whether or not to assess the merits of a concern validly sent to it for assessment under the Data Protection framework

but, as David, notes, this proposal does not appear to be in accordance with the IC’s legal obligation to make an assessment in relevant circumstances.

Nonetheless, and to the extent that such a proposal (or a tweaking of it) might be held to be lawful, it certainly seems to signal a desire on the IC’s part to  (in Tim Turner’s words)

start ignoring more individual complaints, and concentrate on what it considers to be strategic priorities

If that is so, then might complainants who wish to challenge the accuracy of their personal data, more readily look to bring section 14 claims against the data controller? Might the IC be shifting its burden not only on to data controllers themselves, but also on to the already overloaded justice system?

Leave a comment

Filed under Data Protection, defamation, Information Commissioner

Tagged as , ,

January 4, 2014 · 8:33 am

ICO’s Consultation on Responding to Data Protection Concerns: An April Fool or Worrying Implications for the Rule of Law?

A guest post by Dr David Erdos, University Lecturer in Law and the Open Society, University of Cambridge

In the run up to Christmas, the Information Commissioner’s Office (ICO)  published a document entitled “Our new approach to data protection concerns”, which set out on a consultation basis how from 1 April 2014 it intends to deal with the concerns/complaints it receives vis-à-vis the Data Protection Act 1998.

It has been clear for some time that, rather in contrast to how it deals with complaints under the Freedom of Information Act 2000, the ICO’s approach to many of the approximately 40,000 Data Protection complaints it receives has been cursory. The proposals forwarded in the Consultation Document are nevertheless (to my mind at least) rather startling. In sum (and without any April Foolery intended!), the document states that from 1 April, the Office proposes to decide on its own account whether or not to assess the merits of a concern validly sent to it for assessment under the Data Protection framework. A quote on page 6 of the document is particularly enlightening. This states that in the future the ICO will respond to such concerns in the following fashion:

We may make an assessment under section 42 of the DPA where we think this adds value or where the customer has asked us to do so. We may simply offer advice to both parties and ask the organisation to take ownership of their customer or client’s concern. We will decide how we can best tackle each concern on a case by case basis. (emphasis added)

(Relatedly, it also seems to be no accident that the consultation is squarely aimed at those who are regulated by the ICO i.e. Data Controllers (indeed all the discrete questions asked could only be answered by them!) even though such a radical proposal obviously has serious implications for Data Subjects as well).

The ICO’s suggested approach is hugely problematic from a rule of law point of view. Section 42 of the Data Protection Act is crystal clear that “any person who is, or believes himself to be, directly affect by any processing of personal data” may make a request for assessment to the ICO “as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions” of the Act. On receiving such a request the Commissioner “shall make an assessment” (s. 42 (1)) (emphasis added). This duty is an absolute one and whether it has been carried out must also be communicated to the person who made the request (s. 42 (4)). All this is a transposition of Article 28(4) of the Directive which states that

Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of persona data. The person concerned shall be informed of the outcome of the claim.

The Directive particularly emphasises that the authority must hear claims for checks on the lawfulness of any restriction on Data Protection rights adopted by Member States under Article 13 of the Directive and that the person who made the claim shall “be informed that a check has taken place”. It is true that the UK legislation includes some language granting a degree of discretion to the Commissioner as to how he goes about making assessments. However, the obligation to carry out a legal assessment of processing vis-à-vis the Data Protection framework is mandatory. In contrast the ICO’s Consultation Document sees responding to concerns/complaints from the public with such an assessment as discretionary. From now on, it is suggested, a very large number of concerns/complaints will only be treated as a “source of intelligence” (p. 8) for the Office.

It is, of course, possible to have some sympathy for the ICO’s fear of being over-burdened by complaints, especially those which appear to be frivolous or vexatious. Even if this was accepted, however, one might reasonably worry about giving a regulatory agency, particularly one concerned with human rights, the sort of carte blanche discretion the ICO are envisaging in this Consultation. This discretion sits particularly uneasily with the pan-European commitment in the EU’s Charter of Fundamental Rights to recognise Data Protection as a discrete fundamental individual right, the duties arising from which are to be “subject to control” by the data protection agencies (Article 8). In any case, what is far more relevant from a rule of law perspective is that such a wide discretion is not part of the current legislative framework at either the national or the pan-EU level. To the contrary, the ICO has a statutory duty to consider all bona fide requests for assessment. This is a key right given to data subjects under the current Data Protection scheme. The ICO should not be seeking to unilaterally resile from it.

The ICO’s Consultation Document can be accessed here (http://www.ico.org.uk/about_us/consultations/our_consultations) and responses should be sent to consultations@ico.org.uk by 31 January 2014.

7 Comments

Filed under Data Protection, Information Commissioner

Tagged as ,

January 2, 2014 · 1:33 pm

Shaming the not guilty

UPDATE
9 January 2014, after a bit of prompting, the Information Commissioner’s Office have confirmed to me that they are looking into whether Staffordshire Police’s twitter campaign was compliant with the Data Protection Act
END UPDATE

Is Staffordshire Police’s social media campaign naming those charged with drink-driving offences fair and lawful?

A month ago I wrote about media coverage of Sussex Police’s crackdown on drink-driving. I was concerned that the impression was being given by the media that the police were “naming and shaming” people who had merely been charged – not convicted – with the offence. I asked Sussex Police if they were happy with the words attributed to them by the Eastbourne Herald but they chose not to reply (which I suppose is one way of dealing with enquiries from the public).

I have to concede that, in that instance, it was not clear whether the police themselves were suggesting people were guilty of an offence before any conviction. However, I heard today (thanks @primlystable) that Staffordshire Police have been running a campaign which is much more overt in its suggestion that people who have been charged with drink-driving offences can be called “drink drivers”. They have been running a social media campaign using the hashtag #drinkdriversnamedontwitter, and, they announce, there has been “overwhelming support” for it

Overwhelming support #drink drivers named on twitter

Staffordshire Police has received tremendous support for its name and shame tactic to reduce the number of drink-drivers.

Nearly 500 people completed an on-line survey asking whether they supported naming people charged with drink-drive offences and whether it would help people think about the consequences of this type of offence.

But the blurring of the line in that press release between the guilty and the not-proven-guilty is highly problematic. If someone has merely been charged with an offence, it is contrary to the ancient and fundamental presumption of innocence to shame them for that fact. Indeed, I struggle to understand how it doesn’t constitute contempt of court to do so, or to suggest that someone who has not been convicted of drink-driving is a drink driver. Being charged with an offence does not inevitably lead to conviction. I haven’t been able to find statistics relating to drink-driving acquittals, but in 2010 16% of all defendants dealt with by magistrates’ courts were either acquitted or not proceeded against 1.

I asked the Attorney General’s Office (by twitter) what it thought of the use of the hashtag against the names of those merely charged with an offence, but, in saying

Tweets are same details automatically given to Magistrates’court and made public at hearing – not contempt in this case

I think they rather missed the point – it wasn’t the naming of charged people which concerned me, it was the association of the name with the hashtag. And, in an excellent response on twitter @richgreenhill said

You’d be similarly sanguine about tweeting certain names and “#phonehacker” right now?

But I’ve also asked the Information Commissioner’s Office (ICO) whether the practice is compliant with Staffordshire Police’s obligations under the first data protection principle (Schedule 1 of the Data Protection Act 1998 (DPA)) to process personal data fairly and lawfully. The ICO has shown itself commendably willing recently to challenge unfair processing, and has, for instance, served DPA enforcement notices against Southampton City Council for making it a licensing requirement that taxi drivers have continuous CCTV-with-audio in their cabs, and against Hertfordshire Police for its automatic number-plate recognition “ring of steel” around Royston. I would urge the ICO to consider whether this current campaign warrants some regulatory action.

As I was writing this piece I saw a news item in which a traffic lawyer has called for the Staffordshire Police and Crime Commissioner (PCC) to resign as a result of the campaign, saying

By his comments he is now presuming that everyone named by his officers are guilty as charged even before they have appeared before a court. In other words he is demonstrating a cavalier disregard for the presumption of innocence.

His comments have potentially prejudiced every drink driving case before it is heard.

This pitches it stronger than I have, but I also note that Matthew Ellis, the PCC, has said in response

No-one will be named where there is any doubt

That is deeply concerning: it is no part of the police’s role to determine or pronounce on someone’s guilt or innocence.

1.Ministry of Justice, Criminal Justice Statistics, Quarterly Update to December 2010

16 Comments

Filed under Data Protection, human rights, Information Commissioner, police, social media

Tagged as , ,

December 30, 2013 · 1:47 pm

Making Motorman names public

UPDATE: 7 January 2014

In the comments to this piece the requester has informed me that the ICO is appealing this decision. Given how long the Upper Tribunal takes to turn things round, I don’t think we’ll be seeing these names for some time (if at all – if the ICO succeeds). I’ll keep the original post up though for the time being

END UPDATE.

So…will we get to see the names of the Operation Motorman journalists within the next week? Or will there need to be a bit of an extra push?

I tweeted earlier today to the effect that time is nearly up for the Information Commissioner’s Office (ICO) to disclose names of some of the journalists named in the ICO “What Price Privacy” report as having engaged the services of rogue private investigator Steve Whittamore, who was convicted in 2005  under the Data Protection Act 1998 (DPA) of offences of illegally obtaining personal data.

My blog post from earlier this month describes how the First-tier Tribunal ordered on 29 November 2013, after a rather convoluted series of hearings on the papers, that the ICO disclose within 35 days

many, but not all, of the names of journalists recorded…as clients of the investigator at the heart of Operation Motorman…together with the names of the media outlet with which [they were recorded as having been] associated at the time

By my calculations, those 35 days are up at 17:00 next Monday (see part 2.8 of Civil Procedure Rules and rule 12(1) of The Tribunal Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 2009). This is, of course, unless the ICO has appealed the decision, but, as at 19 December, no such appeal appeared to have been lodged.

It is possible, however – bear in mind that the Order was for disclosure within 35 days – that the information has already been disclosed to the applicant – a Mr Christopher Colenso-Dunne. If that is the case, and if the applicant chooses not to make it public, then we may not yet see those names (it has been suggested to me that the person by that name for whom Google gives a search return may not be the applicant here). The Freedom of Information Act 2000 (FOIA) does not, in strict terms, oblige a public authority to make information public. Rather, it must “communicate” information to a person who has requested it (subject to the application of any exemptions). Although it is often said that disclosure under FOIA is to be taken as disclosure to the world at large, this operates as a concept, not a requirement. Some public authorities do, however, operate a “disclosure log” where some or all information disclosed under FOIA is made publicly available.

The ICO itself has a disclosure log, although it restricts this to responses “which we feel are of wider public interest”. There also appears to be a bit of lag in uploading responses (the last was one from 18 October).

One would certainly hope that, if the ICO is not appealing the decision, it will proactively disclose the information ordered to be disclosed. But, just in case, I’ve made a FOIA request for the same information, via whatdotheyknow.com, where it would be available for anyone to see (and which, of course, I’ll withdraw if the information becomes public in the interim).

3 Comments

Filed under Data Protection, Freedom of Information, Information Commissioner, Information Tribunal, journalism

Tagged as , ,

December 24, 2013 · 2:20 pm

The seriousness of personal data breaches

Our privacy is, for good reason, important to all of us.

What a person has in his or her bank account, what a person chooses to write and to whom, what telephone calls a person chooses to make and to whom and other matters of that kind are, save in exceptional circumstances, the business of the individual and of nobody else.

The law recognises that right and protects it.

So begin the sentencing remarks of His Honour Judge McCreath in the Southwark Crown Court on 20 December. The sentences in question were imposed on three men who had been found guilty of offences under section 55 of the Data Protection Act 1998 (DPA). They took place against the background of the bidding for tenancy of the Olympic Stadium. The fines given were not insignificant: £100,000 for Howard Hill, £13,250 for Lee Stewart and £10,000 for Richard Forrest.

It is often said that the sanctions for a criminal breach of the DPA are inadequate. The Information Commissioner regularly recommends the commencement of statutory provisions which would allow a custodial sentence to be imposed in appropriate circumstances, and, indeed, after Lord Justice Leveson made the same recommendation, the government announced it would consult on whether to make the necessary Order to effect this.

It is certainly true that some sentences for the offence (of knowingly or recklessly, without the consent of the data controller, obtaining or disclosing personal data or the information contained in personal data) seem derisory. One stark example was the meagre £150 fine for a probation officer who revealed a domestic abuse victim’s new address to the alleged perpetrator. However, it should be noted, and the Olympic Stadium offenders’ sentences illustrate this, that the offence is, by virtue of section 60(2) of the DPA, an either-way offence. The always illuminating ukcriminallawblog has an excellent post explaining what this means:

[either way offences] are offences that can be tried either (hence their name) in the Magistrates’ or the Crown Court. These are generally cases where the culpability (the harm caused to society) is wide ranging and therefore sometimes they will be very minor offences and sometimes very serious ones…For example, theft is either way. It can vary from someone who shoplifts a packet of crisps up to somebody who steals millions of pounds from a bank.

On a plea of non-guilty to a section 55 charge the prosecution will be transferred to a crown court if it appears to the magistrates’ court that the likely sentence exceeds their maximum sentencing power of a £5000 fine. Once transferred, the fine is potentially unlimited. This is why the fines were so high in these cases.

I won’t rehash what is in the very clear and instructive sentencing remarks. But what I will say is that the seriousness with which a section 55 DPA offence is viewed by a court is inherently tied up with what value society attaches to privacy and security of personal data.

That value changes over time, and varies according to the evidence of the impact DPA contraventions have on the individuals affected.

4 Comments

Filed under Data Protection, Information Commissioner

Tagged as , ,