Interpretation of "Processing"

Another important case has reached the UK Court of Appeals, Johnson v MDU and examines the notion of "processing" personal data. Here is a short extract from Out-Law.com.

David Paul Johnson took a case against the Medical Defence Union (MDU), a non-profit body which provides indemnity policies for its members. The MDU had refused to renew Johnson's policy after it conducted a review of his case and Johnson argued that the organisation had not
processed his data fairly and had therefore breached the Data Protection Act. The MDU operates a scoring system of its own invention which allocates points to certain complaints or allegations made against a doctor, even if they are never proved or pursued. By 2002 Johnson, who had been an MDU member since 1986, had built up enough of these points to trigger a review of his policy by the MDU. He had built up points by consulting the MDU over professional issues, including complaints. He had never been the subject of a claim of professional negligence. His case had been judged after an MDU staff member had looked through his files and collated information from them into a new computer document. Most of the files were manual and fell outside the Data Protection Act's definition of a "relevant filing system". Three were computer based, though, and so their use was controlled by the Act. Johnson claimed that this task was processing, as defined and controlled by the Act's first principle, which says that processing of personal data must be fair and lawful. Johnson claimed that his data was unfairly processed, in breach of the Act. The High Court agreed that the activity carried out by the MDU was processing under the Act, but said that it was unfair only in a minor and inconsequential way, and that therefore there was no breach. Both parties appealed the judgment, Johnson arguing that the processing was unfair and the MDU arguing that the High Court was wrong to say that its actions counted as data processing. The Court of Appeal said that the actions were not data processing. "Mr Johnson, who agrees that he has no right in contract or in any other chapter of English law to challenge [MDU examiner] Dr Roberts's selection of the information contained in his personal data, asserts that he can nonetheless mount these proceedings because her act of analysis is covered by the First Data Protection Principle," said presiding judge Lord Justice Buxton in his ruling. "I would not be prepared to conclude that the 1998 Act has had that effect, and the other widespread effects suggested above, unless I was driven to it. Far from that being the case, neither the 1998 Act nor the Directive give any support to the appellant's case. I would therefore hold that the Judge was wrong to find that Dr Roberts's selection of the data amounted to processing of data in the terms of the Act," he said.

Monitoring of Electronic Communications

A colleague had sent me some information about a recent case (Copland v UK) that has reached the European Court of Human Rights, which concerned an individual's personal communications (including e-mails) that were being monitored without her consent. The Court unanimously held that this was an infringement of her violation to her right to respect for private and family life under Art. 8(1) of the European Convention of Human Rights. Clearly, the monitoring of employees emails have important privacy and data protection implications.

Whilst the privacy of communications is not absolute (sufficient warning by the employer), it would be useful to consult the UK's ICO's employment practice code as a starting point. Plus, the ICO's recently commissioned report on surveillance (pdf).

DNA database

There is a case pending before the European Court of Human Rights concerning the storage of DNA. This is an interesting case as it concerns an individual who has not been charged with an offence. No doubt DNA of an individual is "personal data" within the meaning of the Data Protection Directive 95/46/EC ("sensitive data" if it relates to the health of the individual). See the extract below from Out-Law News:

The Government's DNA retention policy combined with increasingly sophisticated statistical techniques means that eventually most citizens in the UK will be linked to data stored on the police's DNA database, according to a privacy law expert. The outcome of an appeal to the European Court of Human Rights (ECHR) that challenges the UK's DNA retention policy will not limit the ultimate reach of the DNA database, only the speed of its compilation, says Dr Chris Pounder of Pinsent Masons. Under last year's Police and Justice Act, the police are allowed to retain DNA data on those arrested even if those arrested are not convicted of or even charged with any crime. Data derived from these samples are then added to the National DNA Database. Michael Marper's case before the ECHR could change this law. Marper was accused of harassment by his partner. He was arrested and DNA samples were taken. The charges were dropped when he reconciled with his partner, but police refused to destroy his DNA samples and related data. Marper exhausted his appeals through the English courts and then complained to the ECHR that the retention of his DNA is a breach of his rights to privacy under the European Convention on Human Rights. Earlier this year the ECHR decided that there was enough of importance in the case that it will hear it. "The Court finds that serious questions of fact and law arise, the determination of which should depend on an examination of the merits," said the ECHR in January. "The application cannot be regarded as manifestly ill-founded within the meaning of the Convention. No other grounds for declaring it inadmissible have been established." The ECHR has previously ruled in favour of the police's right to retain DNA, but that case involved a man who had been convicted of a crime. A Dutch bank robber, Mr Van der Velden, argued that police had failed to respect his private life by storing his DNA profile. The ECHR said that this interference with his privacy was proportionate.

See also:

• 
  
  PRIVIREAL Project

ICO's response to proposed changes to the FOIA by the Government

The UK ICO has issued its response to the Government's proposals to introduce changes to the FOIA in reducing the number of FOI requests. The ICO is of the view that existing rules would enable the government to achieve its objectives without having to introduce further changes. The main points are:

a more robust application of section 14 (exclusion of vexatious requests) would, to a very significant extent, address the mischief at which the new cost proposals purport to be directed;
• there are grave doubts about the extent to which the aggregation of non-similar requests would be workable in practice, particularly if determined applicants took steps to circumvent the new provisions;
• the proposed concepts of reading, consultation and consideration time, will present very real difficulties for challenge and adjudication;
• the proposals will introduce new layers of procedural and bureaucratic complexity. There is likely - as feared by Frontier Economics - to be “a substantial increase in
requests for internal review and appeals to the ICO, with a substantial increase in costs”.
• there will certainly be a surge of difficult procedural complaints to ICO which can be predicted to start no less than two months after the new Regulations have been implemented. Unless further resources are made available, regrettably, the net effect – at least for the forthcoming year - has to be the prospect of more time taken to resolve difficult cases, an increase rather than a reduction in the backlog of complaints and the diversion of resources onto complaints about costs rather than substantive issues of disclosure of official information in the public interest....

5. The ICO believes that a more robust application of section 14, in line with the published guidance and decision notices, would, to a very significant extent, address the mischief at which the new cost proposals purport to be directed.

See also:

• ICO's response to consultation on draft FOI and DP (appropriate limits and fees) regulations 2007

Telemedia Act 2007

The German Telemedia Act 2007 (Telemediengesetz) replaces the German Teleservices Act, the Teleservices Data Protection Act and the Federal Media Services Treaty. It takes effect on March 2007 and regulates all electronic information and communication services except pure telecommunication and broadcasting (so-called "Telemedia Services"). It covers webshops, mobile commerce, newsgroups, music download platforms, video on demand (VOD), internet search engines, emails and even simple company websites, but not to live-streaming of video, web-casting, IPTV (Internet Protocol TV) or VoIP (Voice Over Internet Protocol - internet telephony). The new Act has been criticised for not going far enough to protect the privacy of the user on the internet. There is no English translation available, but Wikipedia has an entry on this (in German). See also:

• Telemediengesetz: 13 Fragen zum neuen Telemediengesetz
• German Telemedia Act introduces new rules for new Media
• CeBIT - German organisations critical of new law against spam

Another paper

I have been away for the last few days attending the SLSA Conference 2007, hence the lack of blog posts. This is a jointly written paper, but may be of interest to those who have experience with this aspect of work. Here is the abstract:

Title: "All or nothing: this is the question?: the application of Art. 3(2) Data Protection Directive 95/46/EC to the internet"

The Data Protection Directive 95/46/EC (hereinafter the “Directive”) was passed in 1995 to harmonise the national data protection laws within the European Community with the aim of protecting the fundamental rights and freedoms of individuals including their privacy as set out under Art. 1 of the Data Protection Directive. The rules governing the processing of personal data are deemed to be inapplicable in the two instances outlined by Art.3(2). Processing of personal data taking place as part of activities falling outside of Community law are excluded from the DPD. The Directive is also deemed to be inapplicable if the processing of personal data is undertaken by a natural person in the course of a purely personal or household activity. It is the second part of Art. 3(2) which is examined in more detail. The ruling by the European Court of Justice in Lindqvist provides us with a fresh opportunity to re-examine whether the policy justifications for the exclusion under Art 3(2) continue to remain relevant in the light of widespread use of new technologies such as blogs, podcasts and web pages for processing and distributing information. Greater clarity regarding the implication of new communication technologies for DPD policy is necessary if the laws on data protection are to evolve in a coherent and principled manner.

Keywords: Data Protection Directive 95/46/EC; internet, private purposes, blogs, podcasts

Although this is still a work in progress, we hope to have this published by the end of the year. Any thoughts or views are welcome.

Data Protection - a new website

Here is another website on data protection in the EU - Set up by Dr Jóri, Data protection.eu aims to 'carry out a comparative analysis of European data protection legislations, that can help the data protection community of Europe to answer them.'

Information on data protection laws is certainly needed and trying to find up-to-date sources can be difficult, so the website will indeed be useful to those who work in the data protection field. Other websites worth visiting include:

• Privacy, Laws and Business
• Compliance and Privacy
• Data Protection Forum
• Data Protection Resources

Enquiry into a "Surveillance Society"

An enquiry is being conducted by the UK Parliament into the surveillance of citizens by the Government. Here is a short extract from the latest press release.

The UK Parliament has launched an enquiry into the surveillance conducted on citizens by the Government. It will investigate the growing number and scope of government databases holding increasing amounts of information on citizens. The Home Affairs Committee will conduct the inquiry, called 'A Surveillance Society?', so that it can produce rules for Government to follow when building up increasing amounts of sensitive and private information on the general public. "The inquiry will consider the growth of numerous public and private databases and forms of surveillance," said a Committee statement. "They either derive directly from the work of the Home Office and its related public functions or are controversial because whilst they offer the potential to play a part in the fight against crime their use may impinge on individual liberty." "The inquiry will focus on Home Office responsibilities such as identity cards, the National DNA Database and CCTV, but where relevant will look also at other departments’ responsibilities in this area, for instance the implications of databases being developed by the Department of Health and the Department for Education and Skills for use in the fight against crime," it said.

Data Protection Resources: new URL

Just a reminder Data Protection Resources has a new URL address. It is now at http://freespace.virgin.net/r.wong253/. Please update your webpages.

Royal Academy of Engineers - Report on Privacy

The report on privacy (entitled Dilemmas on Privacy and Surveillance) has finally been published by the Royal Academy of Engineers and can be found here (pdf). The underlying theme is that engineers should design systems that protect the privacy of individuals. The report is about 64 pages long. Here is a short extract from the executive summary:

This study identifies likely developments in information technology in the near future, considers their impact on thecitizen, and makes recommendations on how to optimize their benefits to society. The report focuses on an area wherethe developments in IT have had a particularly significant impact in our everyday lives - the use of IT in surveillance,data-capture, and identity management. It looks at the threats that these technologies may pose and at the roleengineering can play in avoiding and managing these risks.

RFID - changes to the Directive on Privacy and Electronic Communications 2002/58/EC

There has been a lot of discussion surrounding the privacy implications through the use of RFID by companies, but in the latest press release, the European Commission is anticipated to introduce changes to the Directive on Privacy and Electronic Communications 2002/58/EC (pdf) to take account of RFID chips. Here is a short extract:

The European Commission will make changes to the Privacy and Electronic Communications Directive to take account of the exploding market in radio frequency identification (RFID) chips, it has said. Amendments will be proposed by the middle of this year. The Commission has published a Communication, intended as "a step towards a policy framework," for dealing with RFID chips, whose usefulness is seen by some to be at odds with privacy and data protection. RFID is a radio technology which allows chips to be identified at short distances by chip readers. The chips themselves are so cheap – just a few pence each – that they are useful in all sorts of commercial applications, from goods transit to stock management and even shop checkouts. It is the application of the chips to people and the things people do with the chipped goods, though, that has always worried privacy activists. Information Society and Media Commissioner Viviane Reding said that the advisory group she was forming to monitor RFID would work in conjunction with the Article 29 Data Protection Working Group, an existing, independent EU advisory body. Reding announced the creation of an RFID Stakeholder Group to help the Commission develop its RFID policy as part of an action plan to address the potential pitfalls and benefits of using RFID technology.

One has still to read the Communication (pdf) issued by the European Commission, but see:

• European Commission: Towards an RFID Policy for Europe

Search Engine results

Google has decided to anonymise personal data that it receives from its search engine. Whilst the discussion of search results derived from search engines is not new, the privacy implications are important. The types of data that could be held about a user include information such as the search term itself, the IP address, and details of how a user makes searches, such as the browser used and previous queries to Google. Perhaps the question is whether any individuals has put in a request to Google about information held about them from the search engines?

Here is a short extract from the BBC website:

Privacy bodies have welcomed Google's decision to anonymise personal data it receives from users' web searches. The firm previously held information about searches for an indefinite period but will now anonymise it after 18 to 24 months. "This is an extremely positive development," said Ari Schwartz, deputy director of the Center for Democracy and Technology, a US-based watchdog. "It's the type of thing we have been advocating for a number of years." However, governments could still force Google to hold onto data or hand it over to authorities. "By anonymising our server logs after 18 to 24 months, we think we're striking the right balance between two goals: continuing to improve Google's services for you, while providing more transparency and certainty about our retention practices," a statement from the search giant said. It's a step forward, but I would like to see them anonymising data in a much shorter period Richard Clayton, Cambridge University It added: "Unless we're legally required to retain log data for longer, we will anonymise our server logs after a limited period of time." Peter Fleischer, Google's privacy counsel for Europe, said the decision has been taken after consulting with privacy bodies in theUS and Europe. He said: "We believe that privacy is one of the cornerstones of trust. We will be retroactively going back into our log database and anonymising all the information there."

Source: BBC Privacy Bodies back Google Step

Privacy law in the US?

I came across a press release whereby Microsoft Chairman Bill Gates urges Congress to pass legislation on privacy:

Microsoft Chairman Bill Gates has added to his legislative wish list, renewing his push for Congress to pass an "all-inclusive" consumer privacy and security law by year's end.

In his keynote speech at a dinner here Wednesday hosted by the advocacy group Center for Democracy and Technology, Gates shifted his focus away from the calls for education and immigration changes that dominated his appearance at a morning Senate hearing. There's a critical need for federal privacy rules that require transparency about data collection practices, grant users access to their own data and dictate what companies must do if a breach occurs, Gates told an audience of about 900 people in a cavernous ballroom at the Ritz-Carlton Hotel here. Microsoft isn't alone in requesting federal privacy legislation. The Windows maker is allied with a number of tech titans, including eBay, Hewlett-Packard, Google, Intel and Oracle, that have begun lobbying Congress to override what they deem a patchwork of disparate state laws.

Privacy in the US certainly seems to be patchy, but whereas the European Data Protection Framework is much stricter in protecting the privacy of individuals (Art. 1 states fundamental rights and freedoms of individuals), this cannot be said of the US. Whether the legislation will be framed along the lines of the European Data Protection Directive is not clear, but for anyone interested in the differences between the US/Europe protection of privacy, see:

• Kang and Buchner. Privacy in Atlantis, Harvard Journal of Law and Technology, Vol. 18, No. 1, Fall 2004.

• Reidenberg, R. and P. Schwartz. Data privacy Law (Michie, 1996).

Art. 29 Working Party: Opinion on transfer of PNR to US Authorities

The Art. 29 Working Party has issued its opinion aimed at travel agents/airlines that provide travel services to passengers flying to and from the United States. Here is the executive summary:

This opinion and its annexes (frequently asked questions and model notices) are aimed attravel agents, airlines, and any other organisations providing travel services to passengersflying to and from the United States of America. This opinion and the annexes update andreplace the previous opinion of 30 September 2004 (WP97).The current legal framework for transferring PNR information to the US authorities iscovered by the interim agreement of 16 October 2006. Negotiations for a new agreementare expected to start in 2007.There remain obligations on travel agents, airlines and other organisations to provideinformation to passengers about the processing of their personal information, and thisopinion aims to give advice and guidance on who needs to provide what information, how and when. Information should be provided to passengers when they agree to buy a flight ticket, andwhen they receive confirmation of this ticket.The opinion gives advice on providing information by phone, in person and on theinternet. The Art. 29 Working Party has established the model information notices (the annexes tothis opinion) to make providing this information easier for organisations, and to makesure the information provided is consistent across the European Union.The shorter information notice gives passengers summary information about transfers oftheir data to the US authorities, and how to find out more information.The longer notice is in the form of frequently asked questions and has more details aboutthe processing. It explains passenger data more widely, before focusing on PNR data. It also includes links to the interim agreement and other relevant documents.

See:

1. Art. 29 Working Party: Opinion on Transfer of PNR to US Authorities (pdf)
2. Out-Law: Travellers to US left in the dark over information transfer
   

Data Protection Resources: New URL

Just a note that I have a new URL for my website on Data Protection Protection Resources. It is now http://freespace.virgin.net/r.wong253/. Please update your links.

Freedom of information

Some of you may be aware that there are likely to be changes to the UK Freedom of Information Act 2000 and introduce restrictions on information to be requested. In the Times today:

The Information Commissioner will tomorrow demolish one of the main arguments being used by Government to introduce restrictions on people’s right to know about the State. Richard Thomas, who will be appearing before MPs on the Constitutional Affairs Committee, is expected to say that public bodies already have wide-ranging powers to ignore requests that are designed to waste civil servants’ time. The Government believes that laws introduced in 2005 requiring much greater disclosure of information from the public sector place an unfair burden on civil servants. However campaigners say that the proposed restrictions are unnecessary and designed to save the Government from embarrassment after a series of damaging disclosures.

The Freedom of Information Act 2000 already has a provision that does not allow for "vexatious or malicious requests". Are the changes necessary? I leave this with you to decide.

File Sharing and Privacy

I came across a news report from Sky News yesterday on file sharing and identity theft. Trying to find a repeat of the report (podcast) on Sky News website has proven difficult, but there is a short piece asking for views on file-sharing worries. On the report, though, one user on a peer-to-peer networking found, to his surprise that he was not merely downloading files, but also downloaded personal details belonging to individuals. Although he notified Sky News on this, it raises questions about personal data and protection of individuals' personal information online. No doubt, identity theft is a problem, but is the UK Data Protection Act 1998 or even the European Data Protection Directive 95/46/EC satisfactory in dealing with these difficult issues?

The UK Data Protection Act 1998 places a responsibility on "data controllers" (those who hold our personal information) to make sure that our personal information is carefully safeguarded (not the actual legal terminology, but see Schedule 1 of the DPA 1998 for a start). However, with file sharing, is it always identifiable who the data controller is? Probably technological means such as the data controller's IP address (of their computer) is one way of ascertaining the identity of the data controller, but even then, there is the question of being certain that the IP address belongs to the filesharer. No doubt, these will be issues that will have to be considered by the ICO.

First UK case on Spyware

There was a recent case R v Waters, that reached the Court of Appeal about a man who had conspired to install spyware software on his wife's computer. He was sentenced to four months imprisonment and the Court of Appeal upheld the ruling:

Computers are an established part of modern life. An increasing amount of personal and private information is kept on computers, not only by the State and large organisations but also by individuals. The privacy of that information must be protected and it is vulnerable to the kind of unauthorised interference and intrusion that occurred in this case. The judge correctly identified deterrence as an element of sentencing in this case. In our judgment, a sentence of imprisonment for offences such as this was not wrong in principle.

For further reading, see also:

• Deterrent sentence appropriate for "computer spying" [2007] Justice of the Peace & Local Government Law 171(7),
  115

• SCL: Spyware Sentence
  

Data Protection Act 1998

I received a recent press release about changes to be made to the UK Data Protection Act 1998 to strengthen the penalties against those who misuse personal information.

Following the results of a consultation paper launched last summer, the Department of Constitutional Affairs has announced that much tougher powers to sentence those found guilty of breaching Data Protection principles will be given to courts. For the first time, this will mean that courts may impose prison sentences for individuals who trade in, or deliberately misuse personal data. The change is intended to combat the illegal trade in personal information which has become highly profitable in recent years. Several reports by the Information Commissioner have highlighted the inadequacy of current penalties, as the fines imposed on those who breach the provisions of the Data Protection Act do not appear to have deterred others from participating in the trade. In the worst cases, judges will have the power to impose prison sentences of up to two years in addition to unlimited fines.

This follows a recent report from the ICO who called for tougher penalties against those who are involved in the illegal trade of personal information. See:

• What price privacy? (pdf)
• What price privacy now? (pdf) - a review after 6 months since the ICO's first report on "What privacy privacy"
  
  

Data snooping

There was a recent press release from the BBC on the confusion surrounding data snooping laws.

Balancing the needs of the police to investigate crimes online with the privacy of individual web users has become controversial as governments seek to extend their snooping rights in cyberspace. Already European ISPs and phone companies are in the process of implementing an EU directive which forces them to retain a variety of communication data for up to two years. Now, a republican congressman, Lamar Smith, has put forward a bill for discussion in the US Congress that could see a similar regime operating Stateside. Experts think it is unlikely that the US will introduce draconian data retention laws any time soon, not because they do not want to but because similar European legislation is currently in varying degrees of disarray.

The Data Retentions Directive 2006/24/EC (pdf) amends the Data Protection Directive 95/46/EC and Directive on Privacy and Electronic Communications 2002/58/EC. It will require organisations to store data of up to 2 years (Art. 6). However, some provisions continue to remain unclear when considering how the Directive (when implemented) will work in practice. For example, the Directive draws a distinction between retaining "traffic data" and "location data", but is it always necessarily clear how this is applied to the internet? Some articles/websites worth reading:

• Bignami, F. Protecting Privacy against the Police in the European Union: The Data Retention Directive (pdf)
• Wikipedia: Telecommunications Data Retention
• EPIC: Data Retentions