The RIPA Hokey-Cokey

“What don’t we want?” 

“RIPA”

“What do we need?” 

“A RIPA review to fight RIPA abuse”

As the temperature soars this summer, the usual suspects are making the usual noises about the way law enforcement bodies acquire private communications data. 

On the one hand, something must be done about the current RIPA regime, as the legislation really does need updating to make it more easily cover today’s communications technologies.  Thirteen years is a very long time in terms of technological innovation, and the legislation, passed by Parliament back in 2000, was rather technology specific. 

But on the other hand, there is some disagreement over what should replace it. Parliamentarians who have had the usual briefings will be aware of a range of measures that could be introduced relatively quickly to improve the way the current process operates, without needing to concern themselves too much about re defining the range of categories of communications information that ought to fall within the remit of RIPA.

Many pressure groups are concerned that a revised RIPA will give Parliament the opportunity to extend the range to data types to cover many not currently on the radar. However, such a review might also give Parliamentarians the opportunity to narrow the range of data types that are currently available. A couple of pressure groups just appear want to kill RIPA completely, without offering suggestions as to what ought replace it.

I expect the pleas for further investigations into the rules around accessing private communications will continue, especially since Parliament’s Intelligence and Security Committee has just confirmed that it was unable to find any evidence of rule breaking when reviewing the way GCHQ acted in seeking information from the US Prism programme.

I’m sure that some will have deep suspicions of an establishment cover-up – and will disregard the view that, actually, the Brits involved in such operations do behave frightfully well.

The cynic in me suggests that “issues” like this are just what special interest groups within the privacy community need anyway – as it’s a great way to engage with supporters and fly the flag for personal freedoms, etc. Especially when the foe, aka the Home Office, does not appear to respond to the critics. Anyway, in a crisis, it’s more likely that said supporters will donate much needed campaign funds. So I expect many commentators to call this a “crisis” for some time to come.

But many campaigners do hold genuine concerns about the adequacy of the existing safeguards, and refuse to accept that a lack of disciplinary action by the Surveillance Commissioner and the Information Commissioner and the Interception of Communications Commissioner is purely due to a lack of poor behaviour by law enforcers. 

So, where ought we go from here?

Well, I doubt that a review will really change the opinion of those who have their hearts and minds set against the State needing to access private information for law enforcement purposes. Although relatively few in number, they are capable of creating a significant media splash.

Perhaps the Home Office will counter with more examples of occasions when official access to communications data was both necessary and helpful. Perhaps more opinion formers will publish articles supporting the concept of state intrusion into people’s private lives. Perhaps another wholly unwelcome terrorist spectacular (which could have been prevented had our boys in blue acted faster) will change the public debate. 

Or perhaps new voices will emerge, such as those of the current Interception of Communications Commissioner, engaging more frequently on public platforms to convince the doubters of the robustness of his oversight powers. Perhaps the public need to be assured (if they are that bothered in the first place) by the sound of new players on the scene.

I do hope some new voices will emerge.  

Just as I hope that Parliament will shortly do something rather than do nothing, to address the communications capability “gap” that was evidently so important when the Home Office laid its case for action before Parliament last year.

If there really is a significant gap, then when is it going to be filled?

Source:

http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/10184964/Britains-spies-did-not-use-secret-US-snooping-programme-watchdog-finds.html

Image credit:

http://www.guardian.co.uk/uk/the-northerner/2013/mar/08/conservatives-edjacobs-eastleigh-north-edballs-davidcameron

.

Chasing the pseudonymous data tail

Some chump has come up with a brilliant wheeze to take our minds off the fact that, even after all these years, there is no universally agreeable view on the meaning of “personal data”. When does an item of information become “personal data”, and thus subject to the full rigour of the Data Protection Act? Or the Data Protection Directive? Or, even, the proposed General Data Protection Regulation? For, if it is not “personal data”, then the Act / Directive / Regulation does not apply, and a business can treat it just as it would treat any other type of business information.

The wheeze is brilliant in its simplicity – rather than worry about the definition of “personal data”, let’s create another data category, and commence earnest discussions on what elements of data protection legislation be applied to that, instead. Where the connection with an identified (or identifiable) person is weak or slight, the rules could be relaxed.

So, the high priests of data protection have been convening to determine whether different laws ought to apply to a different type of information. To make this different type as obscure as possible, it’s been given the name “pseudonymous”. Aficionados of data protection adore this sort of stuff – they just love dealing with terms that are hard to pronounce, spell and define.

A recent meeting of said aficionados in Central London considered whether a definition of pseudonymous data should be included in the proposed Regulation. And, if so, what it should include.

It goes without saying that after earnest debate, consensus was there none. Not only is it a difficult concept to grasp, any definition really needs to be considered in the context of the entire instrument – which naturally did not currently exist, nor were betting men prepared to countenance might exist in the foreseeable future.  

I don’t think that anyone was prepared to rubbish the concept of pseudonomisation – after all, anything that makes it easier for an individual to protect their privacy should be welcomed. But do such terms really need to be mentioned in legislation? And if they are mentioned, what incentives are on offer to encourage data controllers to adopt pseudonymous techniques?

The discussion continued. But what should happen when data can be readily depesudonymised? (yawn)

And the questions kept coming. Should it be possible to deny individuals their subject access rights would continue to apply to pseudonymous data? Or apply data portability or the ‘right to be forgotten’ to pseudonymous data? (deeper yawn)

I’m sure that all this stuff needs to be debated, earnestly and with great rigour. But not on a hot sunny day.

Even our chums at the ICO have revised their views on whether to support a definition of pseudonymous data. They were keener on the concept than they are today. Given the difficulties in defining the difference between personal data and pseudonymous data, there’s not a lot of point referring to it in the proposed Regulation. Hurrah. It’s always pleasing to note when the ICO supports a risk-based approach to issues such as these.  

Image credit:

http://blog.revealedsingularity.net/category/tuesday-tetrapod/page/3

.

Labour: Liberty, Security - and the (new ) Comms Data Bill

If you had gone down to the Royal Festival Hall today you would have had a bit of a surprise. The Rt Hon Yvette Cooper, Shadow Home Secretary, was on hand to explain how keen the Labour Party has become to work constructively with the Conservatives in the Coalition Government to ensure that a revised Communications Data Bill manages to be considered by Parliament in the not too distant future. Yes, there will be measures that the Liberal Democrats (and many other members of the House of Lords) will resist (and defeat), but a lot of non-controversial proposals - as outlined in the Joint Parliamentary Committee’s report on the Government’s first attempt to draft a revised RIPA proposal - ought to sail through.

We must have proper checks and balances in play. And a system of regulation which reflects that the internet has made us think in different ways about data we generate when using the web. We need to review what now comprises our most sensitive personal information. Official access to the more sensitive elements  - which shed light on the most intimate aspects of our lives - must be carefully considered before such access is authorised. Official contacts with activists, perhaps carried out covertly, will require the most careful scrutiny before such applications and operations are approved. Interception Commissioners must have their roles changed to ensure that they play a much more engaging role with the general public. If the Government thinks that it is not appropriate for anything other than a vague parliamentary debate about the maintenance of “capabilities”, then it should think again.  Where is the Intelligence Surveillance Commissioner when the press are baying for senior heads to interview? Your guess is as good as mine.

So, should Labour win the next General  election,  it’s possible that that some very interesting changes will be considered in the oversight of the suits – the select group of Commissioners whose responsibility lies in regulating various areas of the UK's surveillance infrastructure. Too many of their reviews are currently paper based. New commissioners will be primed to speak to the media on a much wider range of surveillance issues. These days, there are so many different angles to stories that even I’m being drawn into making public comments for the media on cybercrime and RIPA these days. Watch out Radio 4 and Newsnight. I’m heading their way, soon.  What Yvette is suggesting was that a far more fundamental review of surveillance commissioning should  occur. Now, where did we put all those papers for the creation of an Inspectorate General?

Yvette was kind enough to mention the Communication Data Bill a number of times in her speech. This stuff is important to her – and she is determined that the conversations currently underway between Home Office officials and the favoured CSPs won’t form the only consultation model in town. Conversations should also be taking place with representatives of civil society. Home Office officials should continue to talk to the Open Rights Group, Privacy International, Liberty, and No2ID. Such officials will need to cast away their suits and ties, and grow beards and and start dressing much more casually to ingratiate themselves with  Demos and other think tanks, to understand what other types of "real people" feel about this stuff . 

It was a good speech. Yvette knows how to take a text that has been written for her and turn it into an engaging review of these broad topics. She probably saw me (as did her speechwriter) nodding quite vigorously as she went through what a revised Communications Data Bill  is likely to contain, given its drubbing at its first outing. Then I had a few quiet words with her after the event to discuss next steps, etc.

So if you see Yvette and Theresa May enjoying discussions over a posh burger some time in the summer, you may know what its all about.

I do enjoy working in this particular policy area. And I don't care which side I influence, so long as I nudge all responsible stakeholders in the direction of the sensible and pragmatic policies they really ought to be implementing, not just considering.

.

Should the Regulation fail ...

During the recent launch of the ICO’s Annual Report, conversation among some of the invited guests turned to the future of the General Data Protection Regulation. Would it (or anything like it) be passed before the next set of elections to the European Parliament took place? 

I wondered whether I should craft a lament in the event of its demise. 

So this little ditty has been penned in honour of all those dedicated folk in Petty France (and elsewhere) who have worked so hard to ensure that we have arrived at the stage that we currently are at.  

And it is to wish them all the best as they labour on, ensuring that everyone arrives safely at the next stage of what is a long and complex journey.

Hey ho, summer in the city
Johnny B is sitting pretty
But isn't it a pity
That the sunshine is followed by thunder
Thoughts turn to the Regulation going under
And is it any wonder
When so many people simply can’t agree

Tom seems to spend his whole life running
With people who would be
The death of you and me
And he can feel those DAPIX storm clouds
Sucking up his soul

Hey ho, life is getting faster
No one has the answer
We try to face each day now in a new way
'Cause everything’s a puzzle

Let's talk it out together, you and me
For at least a year we'd be free
Free to spend our working lives running
From people who would be
The death of you and me
'Cause we can feel those DAPIX storm clouds
Sucking up our souls

Needn’t flee the EC
Finally to be free
Free to spend our whole lives not hiding
From people who would be
The death of you and me
No need to feel those DAPIX storm clouds 
Sucking up our souls

I'm watching Mandy on my laptop
Won’t she ever stop
I see another Regulation dawning
It's rising over me, with its brutality
Already I can feel those DAPIX storm clouds
Sucking up my soul

Source:

With thanks to Noel Gallagher, who penned the lyrics to “The death of you and me.” Any reference to living individuals currently associated with the DAPIX process is, just in case I meet any of them tomorrow, naturally entirely reverential.

Image credit:

http://www.noelgallagher.com/#news/noel-gallaghers-high-flying-birds-to-release-first-single

.

What’s the public sector got to worry about next?

A senior local authority executive(not from Hackney, who’s town hall appears in today’s image) has recently realised that data protection is important and, as he was in charge of it, he had asked a friend of mine to develop a presentation on what he ought to be thinking about. So, my friend set about creating a short list of the main data protection issues that face the public sector over the next year. I was asked to review the list. 

It included:

• preparing for the new EU Data Protection Regulation (assuming it is ratified soon); 
• data sharing and anonymisation of data;
• improving proactive disclosure under FoI (given that the ICO is developing the publication schemes);  and
• addressing data security issues in relation to Bring Your Own Device, home working,  and cyber-crime.

It was a good start. What could I add?

Well, if you’ve just got ten minutes facetime with a senior bod, there’s not a lot of point going into  a great deal of detail. The trick is to use a couple of soundbites as hooks to engage the senior executive to the extent that they actually ask for a paper which develops the issues that are of concern. 

Given the current level of uncertainty about whether there will be an EU Data Protection Regulation (let alone what might be in it), I suggested that he need not spend too much time on this issue. 

In an ideal world, and if our sterling squad of national data protection negotiators  from their offices in Petty France have their way, the UK will be faced with legal requirements that public authorities will actually be able to afford to implement. Hurrah! Our ace team of brilliant officials over at the Ministry of Justice will present the compliance bill to their chums at the Department of Communities and Local Government, who will be so overjoyed at the (low) cost to local authorities that the Chief MoJ Negotiator will be carried shoulder high from Petty France to Westminster Bridge, where he will be tossed into the River Thames to celebrate his success.

In a less than ideal world, where an EU measure is passed and where the a compliance bill is unacceptably high, I predict that a baying mob of the same officials will drag the Chief MoJ Negotiator from Petty France to Westminster Bridge, where he will be tossed into the Thames, anyway.

Returning to the topic in hand, I suggested that my chum add a couple of new points to spice up his presentation.

First, I suggested he mention how hard it will continue to be to design and implement an information governance / compliance programme when the public sector is undergoing so much change. It’s awfully diffcult, for example, to carry out privacy impact assessments when local authorities are so busy working out new models of joint service provision. Who knows who will be doing what and with what safeguards? When new institutions are created to take over the role of established organisations (particularly in the health sector) who will know in advance  what data sharing agreements may need to cease or be re-written? Crucially, if certain members of staff are under notice of possible redundancy, it’s not at all clear how the appropriate data sharing agreements can be drafted before the new institutions have to assume their responsibilities, because the relevant people aren't in place.

Second, I suggested he mention the difficulties of managing these issues effectively when local authority budgets are so tight. Who has the resources to carry out (or commission) decent privacy impact assessments, for example, especially when so few people outside the data protection community have ever heard of them, let alone (inside the community) know how to do one?

Third, and before the senior executive loses concentration completely, I suggested he should end the presentation by asking who should be accountable for the decisions that might need to be taken which result in the public authority being incapable of demonstrating that it has taken appropriate measures to safeguard personal data.  And how should this senior executive liaise with the ICO's enforcement team when reporting data breaches that occurred because they would not sign off the funding that was required to build and maintain the measures and systems that would have better safeguarded personal data.

If that doesn’t prompt the executive to request a more detailed paper on the relevant issues, then I’m not sure what might.

.

The Regulation: Money starts to talk

Last night’s meeting of the Crouch End Chapter of the Institute for Data Protection ended with a bit of an argument. Who was going to pay for those who couldn’t afford their own bar bill? 

Funnily enough, that’s just what appears to be happening in Europe right now with the draft General Data Protection Regulation. 

While the public focus has been on the goings on at the European Parliament, with MEPs on the LIBE Committee face sifting through  a bewildering array of thousands of amendments to what is already a complicated document, developments over in the DAPIX corner have largely escaped much attention.

Yet it’s the DAPIX corner that is the really important corner. 

Here, an alternative draft is being worked on by Government officials from each of the Member States, in full knowledge that Member States are data controllers in their own right, and so whatever is agreed has to be capable of being afforded by the Member States. This is where an entirely different tone to the Regulation is being adopted. This draft is much less prescriptive in nature, much more focused on preventing harm to individuals, and much more likely to see the light of day than the European Parliament’s version. 

The irony is that, while over in the European Parliament, it’s big business and the multinational data controllers that are being blamed for promoting amendments that water down the impossibly high standards originally proposed by the European Commission, over in the DAPIX corner even more radical attempts are being made to create a workable legal instrument, but those proposing the amendments are not facing anything like the same levels of public criticism. 

But the current (leaked) DAPIX version also needs a tremendous amount of work before the Governments of the Member States can reach agreement on it. The 225 pages contain over 500 scrutiny reservations, and with the best will in the world, given that the summer holiday season is upon us, can anyone really envisage agreement on it by the end of the year?  

   

So what are we likely to face towards the end of the year?

If things go well, we are likely to see a situation develop in which two powerful institutions (the European Parliament and the Council of Ministers) create two very different texts, and a form of trench warfare begins. Both sides have deeply held views. Neither wants to give way.  Budgetary constraints mean that the Governments, as data controllers in their own right, simply can’t afford to  pay for the measures proposed by the European Parliament. 

As the deadline for the 2014 European  elections looms, the Council of Ministers make one final offer.

“Take it or leave it.”

The European Parliament then has to choose. Does it back down, and accept the DAPIX version in its entirety, or does it stand firm and lose the opportunity for any reform for a few years?

One view is that if things go “well”, the European Parliament will back down and the DAPIX version will get implemented. Evidently, the European Parliament has been known to back when under pressure. If things go “less well”, no agreement will be reached before the elections, and the legislative caravan will recommence (with freshly elected politicians in the European Parliament taking a closer look at the DAPIX version) in 2014-15.

In his Privacy Surgeon blog on 24 June, Simon Davis rather theatrically announced that he would never again travel to the USA given recent American “bullying, intimidation and hypocrisy,” particularly over its treatment of Edward Snowden.  In his view: “The US has a noble history of civil liberties protection – tragically vandalised by successive recent administrations that now too often exert a corrupted centre of gravity across the planet.”

Might Simon get so upset at the antics of the Council of Ministers in developing a workable legal instrument on data protection that he will announce that, much as he loves it, he would never again travel to the EU.  

Where could he go?

Perhaps the transit zone of Moscow’s Sheremetyevo airport should prepare itself for another long-stayer.

Source:

http://www.statewatch.org/news/2013/jun/eu-council-dp-regulation-revised-11013-13.pdf

http://www.privacysurgeon.org/blog/incision/why-i-will-never-again-set-foot-inside-the-united-states/

.