Is the Home Office winning the battle for online privacy for us?

Writing in The Telegraph today, Milo Yiannopoulos has wondered whether we are winning the battle for online privacy. He thinks not, and has argued that online privacy norms are being dictated by companies with a vested interest in acquiring and selling our personal data.

His assumptions may be about to be misjudged. Help may be at hand – from the Home Office itself.

Let me explain.

We all know that the European Commission has been unhappy at the way the British Government has implemented bits of the E-Privacy Directive as it relates to interception, and that some people in Brussels have done a lot of work to try to find out just what bits of the Directive have not been fully incorporated into British law. I understand that one of the areas that has been keeping the Burghers at the Commission awake at night is the frightening prospect that the cracks which have appeared in British law are now so huge as to allow third parties to do a bit (or a lot) of intercepting in a totally unacceptable manner.

Someone has obviously got it in for Phorm and the bods who build and sell all this deep packet inspection kit that internet service providers are apparently so keen on acquiring.

It appears that the Burghers have had a look at our mighty RIPA, the Regulation of Investigatory Powers Act, and they have decided that the hurdles over which the interceptors should jump are not sufficiently high. They’ve taken a good look, in particular, at the provisions in section 3(1) of RIPA, which allows interception to take place if both the sender and the recipient have reasonable grounds for believing that consent has been given. And they don’t like what they’ve seen.

It appears that this reasonable grounds test is too easy to pass, and what needs to be done is that it should be replaced with the (higher) test which is contained in Article 5(1) of the E-Privacy Directive and Article 2(h) of the Data Protection Directive.

What am I on about?

I mean that the Burghers want to swap out the reasonable grounds test with the requirement that both sender and recipient of the communications must have consented to the interception. And, in this context, the consent would have to be freely given, specific and informed.

This appears to be a very much higher hurdle - and I’m not immediately sure how it can be achieved, in practice.

I can certainly understand how, say, the sender of a communication can consent in a manner which is freely given, specific and informed, so that all of their outgoing communications can be monitored. This is known as “one way consent” – but that is not sufficient to legitimise this interception activity. For it to be legitimate, apparently the consent has to be “two way”. But, and this is a big but, if the person doing the intercepting has no way of knowing who the sender will be communicating with until they start to communicate, then how on earth are they expected to obtain the freely given, specific and informed consent of the recipient of each of these communications?

Perhaps the Home Office’s cunning plan is to assume that since it’s pretty hard to get the recipient’s freely given, specific and informed consent to an interception on a communication they don’t even know they will receive, then all of this (unlawful) interception nonsense will simply fall away. And that Phorm will fade into oblivion and all this deep packet inspection kit (and maybe the odd cookie or two) will cease to be used for nefarious purposes. And then the internet will become a less surveilled place. And then we will all receive marketing material that is less relevant than would be the case if behavioral advertising techniques were to be permitted.

Or, perhaps I have got it wholly wrong, and that any changes to the interception legislation which are proposed by the Burghers at the European Commission will only have a limited impact. Why – well, the people doing most of this stuff won’t be based in the UK anyway, and probably won’t notice any changes to the British interception legislation. So, they could easily continue to place their spyware on our devices, and monitor our communications, after having satisfied themselves that there are reasonable grounds for believing that consent has been given.

Unless, of course, the Home Office has another cunning plan up its sleeve to enforce these new rules.


Source:
http://www.telegraph.co.uk/technology/internet/8119304/We-are-losing-the-battle-for-online-privacy.html
http://www.homeoffice.gov.uk/publications/consultations/ripa-effect-lawful-intercep/ripa-amend-effect-lawful-incep?view=Binary


.

The Government’s cunning plan for communications data retention

The Government has just unveiled its latest cunning plan for the retention of communications data, and the details are now available on the internet, for all to see.

In all their glory. Truly, this must be transparency of the highest order. I think the Government's intention is that Government Departments can then be held accountable for achieving outputs that accord with their published plans.

What is the plan? Well, to cut to the chase, have a look at section 5.3 of the Home Office’s business plan. Please note that it will be refreshed annually, so some of the details that are about to be unveiled in this blog may be subject to change.

Section 5.3 is entitled End the storage of internet and email records without good reason.

That’s a promising start.

The Home Office has announced that it has already started its initiative to develop and publish proposals for the storage and acquisition of internet and e-mail records, and this piece of work will end next month. So, this presumably means we will see some proposals published next month.

The Home Office will then implement key proposals, including introducing legislation if necessary, and it will start to do this next month and it will complete the work in June 2015.

That’s just before the next General Election.

No more details are publicly available. So I've saved you the trouble of having to look through the business plan for yourself.


Source:
http://www.number10.gov.uk/wp-content/uploads/HO_FINAL2.pdf


.

My meaning of “fairness”

I’ve recently had an email asking me to explain what I mean when I use the term “fairness”:

In your profile you mention that you prefer the principle of fairness. Me too. But can you tell me, what you mean by fairness? It is namely an ethical, not legal category. Fairness is not defined in the DP Directive of the EU, although it says, that personal data have to be processed fairly.

Well, here goes.

My sense of "fairness" relates to balancing the rights of data controllers as well as people - and trying to cut through the confusion that some people have that just because information "relates" to them, then it must "belong" to them in the sense that they must always have rights to control that information. We somehow need to respect information which is generated within someone's private sphere and find an easier way of flagging when that "private" information has ceased to become "private" and is now "public property".

For example a person’s religious beliefs may be "private" until they publically declare them, at which time they become "public property". Someone's criminal history should (subject, say, to the provisions of the Rehabilitation of Offenders Act) should be considered "public property". I don’t see why someone who tries to profit from their “good” reputation should always be allowed to hide the “bad” bits simply because it diminishes their commercial value. Thank goodness we have some judges who are prepared to query aplications for “super injunctions” and challenge the right of “celebrities” to retain their commercial value by masking stupid (or unlawful) acts which they may have been committed casually or, even worse, wilfully.

Someone’s credit history should not be a private matter to other credit providers, so long as at the time of initially applying for credit, the credit provider had made it known that it would share details of its clients’ credit histories with other credit providers. At work I receive a small trickle of computer-generated letters from people who have poor credit records, instructing me to delete the adverse credit information once their account is back in order again. These people receive computer-generated replies explaining that the company has a right (and it exercises this right, and it has told applicants that it will exercise this right) to share factual credit information with other credit providers, so that everyone involved can have a better picture of “their” customer and decide for themselves how much credit to allow at any particular time.

At work, I’ve tried to answer questions of fair processing by creating four different categories of customer information which can be generated from our corporate systems. I’ve then asked myself if I can explain the circumstances when it is fair that the company can:
1. use this information for its own legitimate purposes, and/or
2. sell (or otherwise provide) this information to third parties so that these third parties can use it for their own legitimate purposes.

I’ve asked myself when it would be “fair” for the company to do such things when it had simply explained its intentions to individuals (using, say, a privacy policy), and when it would be more appropriate to acknowledge that the information was sufficiently sensitive for individuals to have a specific right to allow (or not, as the case may be) their information to be used for such purposes.

My four categories of customer information are:
1. general customer contact & credit details (eg their name, address, credit history)
2. account administration details (eg how they use the services which the company provides – and as the company is a communications company, I mean who the customers were communicating with, etc)
3. the content of their private communications (as the company is a communications company, I mean what they said/texted/emailed/web pages visited, etc)
4. the content of their public communications (eg the content of blogs they posted and other views which they freely published on the internet and made available to all web users (not just those who know the access password to that website).

I’ve also asked whether the answer to each question would be different if I deliberately ensured that the customer information was rendered (to the business or to a third party) in an anonymous manner, so that no-one had any way of knowing who the person (or people) were who, say, used a particular communications device to surf the internet.

It’s not necessary for me to reveal the answers in this blog, as the purpose today is to explain the process I use to ask the same question (ie “when is it fair for me to ...) when considering whether or how different types of customer information can be used. The answers, so to speak, might well comprise confidential commercial information which I would not be at liberty to divulge in a private blog anyway. So I’m not going to.

(Perhaps, if I came up with some answers to these questions when I was not working, then they might be legitimate material for a future blog, but I’m not going to be doing that today).

My point, however, is that it’s not simply a question of giving a customer an option about whether their personal details can be used for marketing purposes. If only life were that simple.

I sense that I’m going to return to this point again, as I have barely scratched the surface of the question.

Issues around the “fairness” of protecting image rights are complicated. Google have found this out recently – although the matter of how images of buildings can be considered personal data will be considered in another blog. I do find it hard to understand, however, why so much fuss is made of images of the sides of buildings captured by their Streetview service. If people really are keen to prevent the publication of images of buildings, then why they didn’t they make a similar amount of fuss a few years ago, when images of those same buildings were uploaded onto the internet from another angle - from above, rather than from ground level – thanks to Google Satellite.

Also, I'm not sure about Wayne Rooney's image rights. When you make so much money thrusting yourself in the public eye, do you really have the right to retain those rights for all purposes? One blogger recently queried how “one of the ugliest men in the world” (his description, not mine) could actually make any money out of their image rights, but I guess he had missed the point.

.

The Commission’s cunning plan officially unveiled

On 5th October I blogged about the European Commission’s cunning plan, as it was in its (then) draft form, to revise the Data Protection Directive. On 26th October I blogged that Statewatch had published this draft on their website, and mentioned that it was out of date as the actual plan had just been tweaked.

The latest draft version has been officially pubished, for comment, today.

So, what are the significant changes that have been made to the version that we’ve obviously been pouring over since 26th October (or before)?

Well, not many, but there are a couple of reasonably significant tweaks, which indicate the general direction of travel that the Commission is taking. It looks as though a new translator has run their finger through the text, as some passages have simply been reworded without any there being any material changes to the original meaning. Some of the language is easier to understand through. It must be a more experienced translator!

Here are the principal changes to the version that Statewatch kindly published:

1. The Commission has added a new, more business friendly, objective to the review of the rules. As well as taking into account the impact of new technologies on individuals' rights and freedoms, it will also take account of the objective of ensuring the free circulation of personal data within the internal market.

2. References to minors have been replaced by references to children.

3. Strengthened rules on data deletion will take account of the legitimate purposes for which they are needed rather than the purposes for which they were collected. This recognises the problems some organisations find themselves in when they are required to keep information for, say, surveillance purposes, even though there is no business need for its retention.

4. The concept of data portability (being able to transfer, say, pictures of friends from one social networking site to another without hindrance) is now to be permitted subject to restrictions based on technical feasibility.

5. On consent, the Commission has abandoned references to ensuring a more harmonised implementation of current rules but it has retained its task of clarifying and strengthening the rules.

6. The previous reference to minors has been dropped a an example of another type of data that could be considered as sensitive data.

7. The latest text explains that The Commission will examine the means to achieve further harmonisation of data protection rules at EU level. And it drops its earlier reason which was In order to ensure a true level playing field for all data controllers who operate in different Member States. Presumably this is because it now realises that harmonisation of rules is in the interests of individuals, as well as data controllers.

8. The latest text includes a greatly expanded section on how data controllers’ responsibility could be enhanced. It refers to
a. making the appointment of an independent Data Protection Officer mandatory and harmonising the rules related to their tasks and competences, while reflecting on the appropriate threshold to avoid undue administrative burdens, particularly on small and micro-enterprises;
b. including in the legal framework an obligation for data controllers to carry out a data protection impact assessment in specific cases, for instance, when sensitive data are being processed, or when the type of processing otherwise involves specific risks, in particular when using specific technologies, mechanisms or procedures, including profiling or video surveillance;
c. further promoting the use of PETs and the possibilities for the concrete implementation of the concept of ‘Privacy by Design’.

9. New text is added on the application of the new rules to the area of law enforcement, including an undertaking to assess the need to align, in the long term, the existing various sector specific rules adopted at EU level for police and judicial co-operation in criminal matters in specific instruments, with the new general legal data protection framework. While this is a welcome step in the right direction, we have to take acount of the fact that some elements of policing in Member States has been "privatised", so it would not be fair to provide special dispensations only to people who wear police uniforms. And I am still not sure how we square the competing demands of information that is required for national security and serious crime purposes with the natural desire that some others will have to use that same information to deal with law enforcement breaches (and other misdeeds) of a much less significant nature.

10. Finally, the new text expands the previous commitment to review the role of the National Data Protection authorities. The Commission will examine:
a. how to strengthen, clarify and harmonise the status and the powers of the national Data Protection Authorities in the new legal framework, including the full implementation of the concept of ‘complete independence’;
b. ways to improve the cooperation and coordination between Data Protection Authorities;
c. how to ensure a more consistent application of EU data protection rules across the internal market. This may include strengthening the role of national data protection supervisors, better coordinating their work via the Article 29 Working Party (which should become a more transparent body), and/or creating a mechanism for ensuring consistency in the internal market under the authority of the European Commission.
I'm sure we would support any measure that helps these authorities become more credible institutions.

So, we now have a couple of months to review these proposals and send comments back to the European Commission. It’s not quite a 3 month consultation period (which is what we are used to in the UK when a Government Department asks us for our views). Instead it’s a 2 ½ month period with the Christmas holidays thrown in for good measure. Still, we Brits should be on a roll. After being all fired up to respond to the Ministry of Justice’s recent questionnaire on this subject, we ought to know what to say about this lot!


sources:
http://ec.europa.eu/justice/news/consulting_public/0006/com_2010_609_en.pdf
http://www.statewatch.org/news/2010/oct/eu-com-draft-communication-data-protection.pdf

.

The ICO‘s “regulatory action” against Google

The Information Commissioner has today written to Google to outline the regulatory action it intends to take because Google’s Streetview vehicles scooped up more than they bargained for when harvesting geographical information about the location of various Wi-Fi networks.

Let’s first look at the evidence the Commissioner has – as of course we are all in favour of evidence-based regulation.

The ICO's initial assessment, earlier in May of this year, following a visit by some of its officials to Google’s offices, was that, from the sample of payload date available for inspection, “the data was fragmentary and was unlikely to constitute personal data.” It’s now read new evidence, provided by Alan Eustace, Senior VP, Engineering and Research. On the 22nd October 2010 Alan posted new information about the collection of payload data on the Official Google Blog, following a detailed examination of the payload data on the discs: “Since then a number of external regulators have inspected the data as part of their investigations (seven of which have now been concluded). It’s clear from those inspections that whilst most of the data is fragmentary, in some instances entire emails and URLs were captured, as well as passwords.”

Perhaps the fragmentary data was obtained while the vehicles were on the move, and the larger packets were gobbled up when heavier traffic slowed their pace.

But this admission has been enough for the Commissioner to assume that since the British Streetview vehicles were being driven in the same way, using the same software as those whose discs which were inspected by the foreign regulators then, “in some instances it is possible that entire emails and URLs were captured, as well as passwords. It is my view that the collection of this information is a serious breach of the first data protection principle.”

So, no proof of a breach of the UK Data Protection Act exists, because the UK evidence has not been comprehensively examined. But, Google has been invited to sign an undertaking that it will do a lot of things it has already announced that it would do. Perhaps Google made those announcements as it suspected what actions the Commissioner's Office was likely to ask it to do anyway.

It seems like a good outcome for all concerned to me.

This is what Google has been asked to do:

• To continue and update orientation programs designed to provide Google employees with training on Google’s privacy principles and the requirements of UK data protection law;
• To institute a policy that requires Google employees to be trained on Google’s code of conduct, which includes sections on privacy and the protection of user data and the legal requirements applying to the protection of personal data in the UK;
• To enhance the core training for engineers and other important groups with a particular focus on the responsible collection, use and handling of data;
• To institute a security awareness program for Google employees, which will include clear guidance on both security and privacy;
• To institute a policy that requires engineering project leaders to maintain a privacy design document for each initiative they are working on, and a policy that such document should (a) record how user data is handled and (b) be reviewed regularly by managers; and
• To delete the UK payload data it collected, to the extent that Google has no other outstanding legal obligation to retain such data.

The only new undertaking, I think, is this one:

• Within nine months from the date of the undertakings to facilitate a consensual audit by the ICO of the above internal privacy and security practices.

I wonder how furious the provisional wing of the privacy mob are going to be if they conclude that Google’s been let off too lightly? But, as I’ve previously opined, it’s really hard to conclude that Google deliberately set out to do bad stuff, so they don’t deserve to be pilloried anyway.

Today’s letter to Google from the Information Commissioner can be found at:
http://www.ico.gov.uk/~/media/documents/library/Corporate/Notices/google_inc_gsv_letter_03112010.ashx


.

Woven into the stuff of other men’s lives

This inscription appears on a bench which stands in Addison’s Walk, Magdalen College, Oxford. I saw it yesterday. The bench was donated to the college to commemorate Humphrey Slade, a former student at the College who subsequently served as the first Speaker of the Kenyan National Assembly. Just behind the bench lies a property formerly occupied by CS Lewis, author of the Narnian Chronicles. Other notable College members include Edward Gibbon (of whom I blogged last Sunday), John Betjeman, Lord Denning, and Oscar Wilde.

It’s a powerful statement: that the contribution made to society by a single person is such that their “stuff” is woven into other men’s minds. And to a significant extent, that’s what some readers of this blog may also be trying to do. As we strive to regulate, perhaps to ensure the greatest good for the greatest number, or to ensure that basic principles are observed no matter how awful might be the consequences for some, I suspect that we, too, are striving to create “stuff” that becomes part of everyday life.

It’s taken from a longer passage, crafted some 2500 years ago:

The whole Earth is the Sepulchre of famous men; and their story is not graven only on Stone over their native earth, but lives on far away, without visible symbol, woven into the stuff of other men's lives.

The saying is attributed to Pericles, a Greek statesman who lived between 495BC and 429BC. It’s hard to describe his politics in terms of social cohesion though. According to Wikipedia, he proposed a decree that permitted the poor to watch theatrical plays without paying, with the state covering the cost of their admission. With other decrees he lowered the property requirement for certain public appointments and bestowed generous wages on all citizens who served as jurymen in the supreme court of Athens. His most controversial measure, however, was a law of 451 BC limiting Athenian citizenship to those of Athenian parentage on both sides. I can think of other politicians who espoused such citizenship policies, but none who also proposed free entry for the poor into the nation’s theatres.

I suspect that those of us involved in data protection regulation would seek to ensure that our standards recognised the reality of global data flows, and that they would not embrace a “fortress Europe” approach. But I can’t imagine too many of us advocating the compulsory means testing of Subject Access Fees, to provide the poor with a right to free access to their personal information.

What also struck me during my recent visit to Magdalen College were the two plaques “In honour of those members of Magdalen College in the Second World War.” Carved in these two plaques are the names of 122 people, together with the units (or capacities) in which they served.

Most poignantly, the second plaque includes the inscription “And from Germany, H Frhr von Waldthausen Wcht.” The college was sufficiently courageous to commemorate all of its former members, not just those who were on the winning side. I found this to be a wonderful gesture. For me it showed that the college was brave enough to note that this German student’s “stuff” was also woven into other men’s lives, and that it was deserving of the same amount of respect and recognition as was the “stuff” of his companions at the College.


.

Happy Birthday to my blog: 1 year old today

Rather than write about something new, I thought I might take this opportunity to assess what I actually have written about over the past year.

A few issues have really taken my attention this year – they relate to communications data retention, the Regulation of Investigatory Powers Act, surveillance, data breaches, fines and penalties when data controllers get it wrong, likely changes to data protection regulation, and of course, our old (and current) favourite, Google. I expect these matters will continue to occupy my thoughts, but I hope that they won’t be the only things that I’ll be writing about.

But that’s not all – reviewing my output over this period, I see that my mind has been drawn to a very wide range of other data protection issues. These have included the likely impact of the Digital Economy Act, notions of consent, how internet content is regulated, the Human Rights Convention, the Article 29 Working Party, training & raising awareness, as well as a host of other matters.

To try to put my output into some context I’ve created a birthday present to myself – an index of the significant blogs, which I’ve divided into 36 categories. I don’t see myself creating hyperlinks to each entry. This is enough of a guide, for the time being.

Anyway, I’ve appended it below, just in case anyone else is interested.

Applications for Mobile Devices: 10/03/2010
Article 29 Working Party: 01/08/2010, 09/08/2010, 11/08/2010, 28/10/2010
Behavioural Advertising: 06/01/2010, 13/06/2010, 21/06/2010, 22/06/2010, 26/06/2010, 29/06/2010, 23/10/2010
Big Brother Watch: 23/01/2010, 17/04/2010, 02/06/2010, 12/06/2010, 18/09/2010
Blogging rules: 13/11/2009, 25/08/2010
Communications Data Retention: 11/11/2009, 13/11/2009, 09/01/2010, 28/01/2010, 07/02/2010, 30/04/2010, 07/05/2010, 09/05/2010, 12/05/2010, 12/07/2010, 17/07/2010, 21/10/2010, 26/10/2010
Consent: 03/11/2009, 15/03/2010, 02/04/2010
Data Breaches: 07/11/2009, 28/03/2010, 01/05/2010, 05/06/2010, 15/07/2010, 13/10/2010, 19/10/2010
Data Directive - Revisions: 05/07/2010, 23/07/2010, 03/08/2010, 23/08/2010, 05/10/2010, 26/10/2010, 31/10/10
DEA / Peer to Peer file sharing: 05/11/2009, 02/02/2010, 06/04/2010, 07/04/2010, 13/10/2010
Demos: 22/03/2010
Facebook: 22/08/2010, 16/10/2010
Fining Powers & other penalties : 14/11/2009, 21/11/2009, 19/11/2009, 11/02/2010, 13/02/2010, 05/03/2010, 28/03/2010, 18/06/2010, 02/08/2010, 07/08/2010, 08/08/2010, 18/08/2010, 24/08/2010
Gen Election 2010 & Govt Policy: 17/04/2010, 20/04/2010, 08/05/2010, 13/05/2010, 19/09/2010
Global standards: 05/12/2009, 09/07/2010, 31/10/10
Google: 05/11/2009, 03/05/2010, 02/06/2010, 24/10/2010, 25/10/2010, 29/10/2010
Hoax 999 calls: 30/01/2010
Human Rights Convention: 28/01/2010
Identity Management: 24/01/2010, 20/02/2010, 01/11/2010
International Data Flows: 21/03/2010, 27/07/2010
International Data Protection Day: 29/01/2010
ICO staff & Annual Reports: 13/12/2009, 23/03/2010, 14/07/2010, 19/08/2010
Liberal Democratic Party: 16/07/2010
Location Based Services: 22/08/2010, 04/10/2010
Marketing: 11/03/2010
Privacy By Design: 10/07/2010
Registration Requirements: 07/03/2010
Privacy Policies: 13/03/2010
Personal Information Promise: 17/01/2010
Regulating Internet Content: 25/01/2010, 05/02/2010, 08/05/2010
RIPA: 26/01/2010, 19/02/2010, 28/02/2010, 27/03/2010, 14/04/2010, 19/06/2010, 20/06/2010, 30/07/2010, 08/08/2010, 26/08/2010
RFID Tags: 14/02/2010, 11/08/2010
Sharing Information: 29/03/2010
Statutory Instruments: 04/11/2009
Stockholm Programme: 12/02/2010
Training & Awareness: 28/11/2009, 15/02/2010, 19/03/2010, 20/03/2010, 17/08/2010

.