Fines – the ICO’s poker game begins

Today’s announcement that Hertfordshire County Council has accepted the fine from the Information Commissioner for its sloppy procedures that failed to prevent details of a child sex abuse case from being sent to a member of the public sets an extremely interesting precedent. And if I were a Hertfordshire council tax payer I would be furious that the Council didn’t take steps to challenge the fine. The council may well have behaved disgracefully, but is this misbehaviour really worth £100,000? That amount would probably be enough to employ another couple of workers in the Council’s Childcare Litigation Unit to help prevent more children from being abused.

I would love to know who thought it would be the easy way out, just to pay the fine and hope the matter will die away. They may have though that “it’s only public money” – but it does means that this public money won’t be able to be spent on the vital stuff that the Council was supposed to finance. Like a parking fine, the penalty will be discounted by 20% if the Council makes the payment to the Commissioner by 21 December.

Who’s going to be so accountable that they actually lose their job over this mistake? I only hope that their payment procedures are not so poor that the money isn't paid in time for the Council to take advantage of the 20% discount.

There is really serious point here, though.

The Council did not have to accept the finding. They could have appealed to what is now called the (First-tier Tribunal) General Regulatory Chamber, and at that stage the Commissioner would have been required to provide a more detailed explanation, together with some evidence, about the way the fine was set. Some words of explanation are set out in the decision notice, but I don’t see enough about how the Commissioner has quantified the harm that may accrue to an individual as a result of the poor processes that the Council had adopted.

Data controllers need to carefully appreciate the Commissioner’s thought process, as I expect that risk catalogues will now be revisited in the light of this decision – and the decision in that of A4e Ltd, also announced today, who managed to lose an unencrypted laptop containing details of 24,000 clients to whom confidential legal advice had been provided. The loss occurred during a burglary at the home of a home-worker. Despite being in the midst of a laptop encryption programme when the unfortunate article was stolen. A4e Ltd were subsequently fined £60,000 – again with a 20% discount if they pay before 22nd December.

There is a right of appeal, against both the imposition of the monetary penalty and the amount of the penalty specified in the monetary penalty notice.

Now, since I don’t know what legal advice or research has been carried out to assess how well the Commissioner had managed to quantify harm in these cases – and how his assessments match up to those awarded by judges who are required to make rulings in other liability trials, I would welcome a “friendly” appeal to the First-tier Tribunal to “sanity check” these penalties.

And could I also suggest that an experienced data protection lawyer offer his services on a pro bono (voluntary) basis to Hertfordshire County Council. The council may be incompetent, but they need all the money they can get to make life less miserable for those at risk who live in that county. That lawyer will make a real name for themselves if they manage to reduce, or quash, these initial penalty notices.

Penalty notices like this affect all data controllers, not just those who get caught.


Sources:
http://www.ico.gov.uk/~/media/documents/library/Data_Protection/Notices/hertfordshire_cc_monetary_penalty_notice.ashx
http://www.ico.gov.uk/~/media/documents/library/Data_Protection/Notices/a4e_monetary_penalty_notice.ashx
http://www.borehamwoodtimes.co.uk/news/8685408.Council_apologises_after___100_000_fine_for_data_breaches/

.

Careful: this image is not available on Streetview

OMG!

Yes it is. It’s not (quite) visible from the street – so a Google Streetview camera wouldn’t be able to capture this image as the car cruised along Water Street in Wilmslow.

So this may be its first public outing.

What is it?

It’s the extension which has just been built to accommodate all of the Wilmslow-based Information Commissioner’s staff in a single building. And the office environment is very, very different to what it was before.

Formally opened last month by local MP, George Osborne, motivational slogans are painted on the walls. Stuff about empowerment, rather than pay. Open plan. Clear desk policy. Nice coffee. New carpets. And the Commissioner works in one of the corners, rather than in an office of his own.

Minutes after taking this image (earlier today), an official from Internal Compliance scampered over to ask me who I was and what I was doing. We couldn’t think of a good enough reason for me not to keep the image, so here it is.

It makes a change from gazing at the Streetview images of babies being born, naked men in car boots, dead bodies and people wearing horses heads. Admittedly, those images are cooler!

Source:
http://www.telegraph.co.uk/news/worldnews/europe/germany/8156048/Birth-of-baby-captured-on-Google-Street-View.html
http://www.telegraph.co.uk/news/newstopics/howaboutthat/8152990/Naked-man-spotted-in-car-boot-on-Google-Street-View.html
http://www.telegraph.co.uk/technology/google/8046212/Google-forced-to-remove-dead-body-images-from-Brazil-Street-View-service.html
http://www.bbc.co.uk/news/10401345

.

German Data Protection gone mad

The German Data Protection regulators made a pact with Google before its Streetview service was allowed to be launched in that great country.

The deal was that the service could go live so long as people who didn’t want their properties to be visible were allowed to ask for them to be blurred.

And this image is the result. If you live in a block of flats, you have the right to mask your personal data (?) by masking the entire block. Don’t ask me what rights the other residents in the block have to insist that their flats be unmasked. It appears that in such cases, the wishes of the many (who want to be visible) can be vetoed by the actions of the few (well, by a single objector, actually).

Der Spiegel Online reports that 244,000 objections have been received - and their properties have been blurred. That’s some three per cent of the total number of properties which were captured by Streetview. The other 97% apparently aren’t sufficiently bothered to object.

But in this context, is a home really something that we would sensibly recognise as “personal data”? It looks like an inanimate object to me. I don’t know the identity of the owner (or the tenants) in the building that’s been blurred out, and I guess I never will. And nor do I want to. I just wonder what checks Google made to verify that the objector was actually owning or living in that building. And whether any of the non-objectors were consulted, too.

What is Google supposed to do when the owner of the house has, following a subject access request, decided that the information in the database is inaccurate? Does Google have an obligation to return to the area to take an updated image of a freshly painted building, or to photograph new dormer windows that have just been installed in the roof?

The mind boggles.



The Register has, helpfully, given us some indication of the checks that Google makes when it receives an instruction to blur the images of a building. Apparently, some clown contacted Google and demanded that they blur one on a street corner in Munich. Which they did. Before realising that they were actually blurring the Munich offices of, er, Google.

You can’t make it up.

Source:http://www.theregister.co.uk/2010/11/19/street_view_germany/

.

Who’s been a naughty file sharer, then?

It looks as though another nail is being hammered into the Digital Economy Act’s coffin. And this time it’s the Solicitors Regulation Authority wielding the hammer. So, if the SRA is getting uneasy about what some lawyers have been up to recently, I wonder what’s going to happen next.

Some lawyers have been accused of of knowingly "targeting people innocent of any copyright breach" when they sent "bullying" settlement letters to those suspected of being involved with unlawful ("illegal") broadband ISP based Peer 2 Peer File Sharing. This has come about because they gathered public Internet Protocol addresses from file transfers (uploads) on Peer to Peer networks, and used these records to get customer details from Internet Service Providers after having first obtained a court order.

Thousands of people whose addresses were subsequently obtained then received letters which suggested they were involved with copyright file sharing. Many of these letters demanded several hundred pounds in compensation for the alleged act and a further fee to cover costs. Those receiving the messages were threatened with legal proceedings if they refused to pay, which in reality rarely ever happened.

The real scandal was that the people who sent these letters (apparently) knew that IP addresses, which are assigned to your computer each time you go online, are not an effective way of determining a computer user's true identity. At least one middle aged lady received an allegation that she was involved in downloading gay pornography – which came as an awful surprise both to her and to her son, who had not previously discussed his sexuality with either of his parents.

Sensitive personal data? But whose?

We all know that Internet Protocol addresses can easily be faked, hijacked, redirected and generally abused or used in ways that can be hard to detect. And we all know that the owner of a particular internet connection, such as in case of a hotel, business or shared public/home Wi-Fi network (secure or not), may not be the individual responsible for the actual act itself.

So I wonder what Ofcom’s going to do now. I was at one meeting today to hear an official from the Information Commissioner's Office recommend that Privacy Impact Assessments be carried out for most initiatives that involve the processing of personal information. And we all know that the Information Commissioner can now carry out privacy audits on all public authorities, whether they want to learn of his views or not. Will Ofcom carry out and publish a Privacy Impact Assessment about these proposals, in order that everyone can be satisfied that the case has been made for the initiative and that all the legitimate privacy concerns have been addressed? Will the Information Commissioner demand to see one before the process which is currently under construction goes horribly wrong?

Will Ofcom really continue to tell the Internet Service Providers to keep logs of people whose IP addresses have been possibly used by someone else for nefarious purposes, in order that they can report to the copyright owners when there have been a number of similar allegations? Could the Internet Service Providers be accused of sending thousands of bullying letters, too? These providers like to send nice letters to their customers. Not letters containing threats.

And then, finally, are Internet Service Providers really expected to cut off the accounts of people whose IP Addresses have possibly been used by someone else? Is this madness?

Or will someone come to their senses and ask themselves how much angst really needs to be caused in possibly hundreds of thousands of households up and down the country, as parents realise what their offspring have actually been up to?


Source:
http://www.theregister.co.uk/2010/11/19/davenport_lyons_sra/
http://www.ispreview.co.uk/story/2010/11/19/sra-claims-uk-law-firm-knew-file-sharing-threat-letters-targeted-innocent-people.html

.

Shhh – don’t mention the Commission’s data retention conference

So little notice was taken about an obscure European Commission conference on communications data retention, held back in July 2009, that the Commission is going to hold another one. This event is to be held in just a couple of week’s time, although I bet that hardly anyone will be aware that it is either being arranged, or how the items for discussion actually affect them.

The first session was attended by some 140 participants and speakers made up of representatives from law enforcement authorities, industry, civil society, regulators, academics and other examples of the usual suspects. The participant list makes great reading, as it reveals the names and contact details of some extremely interesting people, including someone from the Hungarian Special Service for National Security, and someone from the Romanian Intelligence Service. I hope these spooks weren’t using their real contact details. If they were, they might want to ask for them to be deleted before anyone reads about it.

The presentations were of the predictable sort.

A representative from KPN, the Dutch telecommunications company, commented that KPN was struggling with implementation. The Data Retention Directive was aimed essentially at telephony but has been “copied” to the internet.

A Swedish privacy activist commented that there was a great deal of controversy surrounding the Data Retention Directive when it was discussed by the European Parliament and some MEPs expressed “indignation, anger and frustration” at the way in which negotiations had been carried out between the chairmen of the big political groups and the UK presidency of the EU at the time. This activist could have been referring to Charles Clarke who, at the time, was the British Home Secretary, and would therefore have chaired the relevant meetings of the Council of Ministers.

A representative for a Belgian internet service provider commented that there is uncertainty about implementation requirements with a lack of harmonisation across the EU for pan-European operators. Implementation guidelines are needed to support providers implement interoperable vendor solutions. There is a lack of technical guidance with regard to response times, the format for delivering data to LEAs, the retention obligations with regards to transit and third party providers, centralised storage, internet telephony services and unsuccessful calls, to mention a few issues, results in diverging implementations across Member States. Also, providers' systems were built to be business-grade rather than forensic-grade, designed to retain data for billing, and making them suitable for Law Enforcement Authority investigations requires significant adaptation and expense.

Nothing new here.

And now, there is to be another conference, and many of the issues under consideration look quite significant. They include questions such as
• The purpose of data retention, and whether the retained information ought to be available for investigations into issues other than serious crime. What types of less serious crime, or frivolous crime – or non criminal acts – ought this information be available for?
• Should the rules should be extended to include web browsing, as well as electronic communications. [And whether there is much point in extending the rules if users are going to spend over half their digital lives browsing on Facebook (or Google), which may not be affected by these retention rules if they can successfully argue that they are not a Communications Service Provider. All the internet service providers will be able to record is thet the user has gone to Facebook (or Google). Not what they've done once they've got there.]
• Should the retention periods be tweaked?
• Should the range of authorities able to access this information be changed?
• How should Member States deal with requests from law enforcement agencies from other Member States?
• Should there be changes to the cost recovery rules?
• Should there be more rules to guarantee the security of these systems?

All of this is pretty heavy going for a day’s conference. And quite relevant too, I suppose, if we are to take as gospel the Home Office’s business plan, which I blogged about last Monday, which contained a commitment to complete work on its plans to develop and publish proposals for the storage and acquisition of internet and e-mail records by the end of December, in order that it can start to implement the key proposals between January 2011 and the next General Election.

Perhaps, at some stage, in the new spirit of transparency which is spreading through all aspects of Government, the Home Office will consult widely on what its position ought to be on the issues that will be discussed on 3 December in Brussels. Or, perhaps it may embark on what it might call a “targeted consultation exercise” with the usual suspects, just to make sure it is going to be able to deliver on any commitments (or comments) it makes.

But then again, perhaps the Home Office won’t consult at all. It may not even turn up.

Let’s see if it does any of these.


Sources:
http://ec.europa.eu/home-affairs/doc_centre/police/docs/meeting_report_09_07_14_en.pdf
http://www.poptel.org.uk/statewatch/news/2010/nov/eu-com-data-retention-discussion-paper.pdf


.

Cracking the problem of cookies

The hot news (at least where I was) today was all about cookies. No mention of the engagement of HRH Prince William and Kate Middleton. The data protection community is obviously made of other stuff, and a select group congregated in central London this afternoon to work out what the Department for Business Innovation & Skills should get Parliament to approve as the law, and how Ofcom and the Information Commissioner’s Office should enforce it.

What’s the real problem, then?

Well, the European Commission is changing the rules about the way some cookies can be used, and how some types of information stored on a subscriber’s electronic device can be accessed. It appears that by next May, the UK will have fallen into line with the new regime.

Fallen into line may be a somewhat ambitious phrase – as, right now, no-one really knows what each Member State is going to do to achieve compliance with the rules. Not only are they extremely hard to comprehend, few Member States seem to have had the will so far to try to understand and propose how the rules should be implemented. So, three cheers for BIS and for the UK, and for providing leadership to the rest of the EU in this very important issue. Where we tiptoe, others will surely tread.

There appears to be no change to the law so long as the information in a consumer’s electronic device is only being accessed because it is strictly necessary to provide the user with an information society service which they had explicitly requested.

There will however be a change to the law if it is intended that information needs to accessed for other purposes. And in these cases, the subscriber will have to provide their freely given, specific and informed consent before the relevant information is accessed for these other purposes.

As you can imagine, everyone is having a wonderful time trying to work out what cookies provide stuff which is strictly necessary for the provision of the service, and what cookies might not be permitted until the freely given, specific and informed consent turns up. So, when I type a URL and press the "Enter" key, apparently some of what I see will arrive because it is what I wanted to see, and apparently some of what I see will arrive because I will have somehow consented to seeing it.

Does this matter?

It could matter if you run a website and try to make any money out of it. If all you do is provide what the geeks call an information society service, then you might be fine. Unless, of course, you use cookies for other purposes – such as counting unique users to your site, or working out what interests them on your site, so that they (whoever they are) can be served with more relevant advertising banners (that they probably won’t notice anyway). So I think it affects the Information Commissioner's own website as well as many other Government websites, as they try and do cool things like counting unique users to their site, too. In practice, though, I would expect people to adopt an increasingly flexible definition of what is strictly necessary. It could easily turn into something pretty close to what a website owner decides is simply useful to have.

What is going to happen?

Well, I think it’s likely that two separate things could happen.

First, the browser manufacturers (of whom you can count on the fingers of both hands) will probably be invited to meet and, in a concerted manner (but not in a manner that will incur the ire of the competition authorities) work out whether it’s possible to provide users with a more granular way of making choices about what types of cookies to accept, and from whom. The cool new descriptive term for this is the development of enhanced browser settings. It appears that the burgers at the European Union don’t like the concept of default browser settings, and instead want evidence that users have made choices about their settings. But, let’s get real here. How many people are really sufficiently interested and engaged in these matters to want to be provided with clear and comprehensive information about the consequences of the various browser setting choices that will be made available to them. I guess that far more people probably read the new terms and conditions on their iTunes account each time Apple changes them. And that’s not very many.

Second, the 4 million website owners (yes, there could be that many) will probably be expected to read the implementing guidance that will eventually appear on the BIS and ICO websites, and they will then be expected to work out for themselves whether it’s possible to provide users with a more granular way of making choices about what types of cookies to accept, and from whom. The cool new descriptive term for this activity is likely to be trying not to give the impression people are ignoring an incomprehensible law.

If I were a busy regulator, I would ask myself whether I should try and do a deal with, say, 10 browser manufacturers, or hold out and negotiate an understanding with 4 million website owners.

No contest, really.

I think I would start by approaching the browser manufacturers, and make so much noise that the website owners who use techniques other than cookies to access information for purposes other than to serve up the requested information on their website, begin to understand that they may have a bit of a problem. And I would wait and see if they came up with any cunning plans to become compliant with the law, and take no action - at least until anyone complained. If these web owners were causing harm to users and were not being transparent and were not getting their consent, then of course I would be down on them like a ton of bricks. But I suspect that, as a busy regulator, I might well have far more serious matters of poor compliance on my regulatory horizon. And I would want to focus on those matters, rather than waste scarce resources trying to improve behaviour that didn’t seem to be doing anyone any harm, anyway.



Postscript:
Perhaps, after all, I really am put of touch with the rest of society. What on earth am I really doing, blogging about cookies, when almost everyone else I know is celebrating the great news of the Royal engagement!

.

Oh Err, a radical approach to tackling illegal internet content

I’ve just read an unusually interesting contribution to the debate on how we should deal with illegal content on the internet.

It came in the form of a speech at last month’s Annual General Meeting of the Internet Watch Foundation, and was delivered by Martin Geddes, former Strategy Director at BT and a refreshingly radical thinker about this stuff. Don't switch off yet. If your mind is broad enough to take the music of the Gorillaz, it ought to be able to appreciate what Martin is trying to say. Here’s a flavour:

The danger to the Internet industry is political. Is it inevitable the agenda will be driven by politicians rather than industry? This depends on the amount of scare stories in media. Youth usage is up, and temptation to interfere becomes too high. Just as with the ill-considered Dangerous Dogs Act of 1991, we may see the ‘Dangerous Devices Act of 2013’ as being the low point that wakes the industry up to its responsibilities.

Given the size of the threat to their ability to innovate and revenue models, surprisingly little is spent on CSR by internet and online media companies. Mumsnet, Consumer Reports, and the Daily Mail can change the political environment faster than any technology solution can adapt. There is high uncertainty on future events. These stakeholders need to be involved, educated and participate in addressing these problems.

In tackling illegal content, there are powerful lessons to follow from the worlds of drugs, political and religious extremism, and copyright piracy. Most critically, decentralised and multi-disciplinary solutions work best. This requires transparency, open source techniques, peer networks of industry practitioners, and voluntary co-operatives to take action.

The achievable mission for the Internet industry is to prevent contagion of illegal content into mainstream society. Containment of the problem is realistic, eradication in the face of multiplying technology complexity is not.

The music industry, insisted that the utterly natural human impulse to share music non-commercially constitutes theft. As a result the industry lost the moral authority it needed to preserve copyright as a social institution. It became normal and acceptable to break the law, especially for younger people. At the extreme example of this social norm breaking down, The Economist reports that the total sales of CDs in China in 2009 was only $19 million .

The Internet is an amplifier of human social behaviour. Tackling determined paedophiles through Internet blocking technology is a futile exercise. Preventing widespread access to such content is not. Fortunately the use of illegal content is rightly seen as repulsive by the great majority of people, who do not seek to find it and wish to see it actively prevented. Contagion containment fits with the wishes of ordinary Internet users, and does not require ‘1984’-like total control over the Internet.

In order to prevent contagion into the mainstream, a broader response is required.

• Political: A ‘panic button’ in social media applications or in browsers, and safe harbour law on seeing and reporting illegal content, in order to capture data about the problem from the end users.
• Economic: As the Net evolves, make the cost for Chinese and Russian sites more expensive than revenue. Make it cost the bad guys more. Tax trade with low-compliance hosting sites to reflect social harm. Make payment and content delivery networks carry more responsibility for whom they do business with.
• Social: Make corporate social responsibility (CSR) a board-level priority, to pre-empt political interference. Engage with stakeholder groups outside of the technology industry – schools, journalists, mental health care providers, even mainstream adult content providers.
• Technical: Focus on traceability and auditability in content and communications, allow for a more flexible response to be built on top of this data. Put more blocking intelligence at the ‘edge’ in the device and operating system.

Martin was perhaps at his most radical when suggesting a social role for internet service providers to play in dealing with the users of illegal internet content. Those of a delicate constitution should avoid reading the rest of this blog. As far as he was colncerned, the best response is to help the mainstream media adopt a less hysterical attitude to casual users of illegal content; it is a mental health problem that demands education, not just vilification. Work with the NHS to offer helplines, and if you block access to a site make that transparent and offer a place to get such help for those at the margin of use of illegal content. Engage people with different skills sets: epidemiologists , psychologists, and anthropologists are as valuable as network engineers.

This is strong stuff. It makes an awful lot of sense, but I wonder how many politicians have the stomach to look their constituents in the eye and explain that they are helpless because they are being asked to deal with a behavioural condition rather than an issue that will readily respond to regulation. I think its the industry that needs to exert more control over this playground, not the politicians.

But that’s never prevented politicians from trying (and frequently failing) to regulate behavioural conditions before.


Source:
http://www.martingeddes.com/papers/

.