Not a lot of news from Big Brother Watch today

What are we to make of today’s Big Brother Watch report which claims that local authorities commit 4 data breaches every day?

In the words of TV magician Paul Daniels: “Not a lot.” 

At first glance, it looks impressive. It’s almost 200 pages long. But, and this is a big but, there are only a few pages of analysis – once you get past page 12, a series of annexes contain the responses from each local authority, revealing how minor the vast majority of the reported incidents (occurring between April 2011 and April 2014) actually were.

BBW started work on this report by submitting FOI requests to each local authority in June 2014. Quite why it has taken so to publish the results, bearing in mind that FOI requests should be returned within 20 days, is beyond me.  Although BBW claims to have received a 98% response rate, some 212 authorities either declined to provide information, or claimed that they had experienced no data breaches between 2011 and 2014.

Evidently, the safest place to live these days is Northern Ireland, where 21 of the 25 Northern Irish District Councils did not report a single data breach. 

The report’s recommendations, unfortunately, don’t reflect too deep an understanding of the improvements to information handling procedures that are already currently likely to emerge in the foreseeable future.

BBW calls for “proper punishments for the misuse of personal information,” without acknowledging that (even) magistrates courts are already capable of levying unlimited fines for DPA offences. Instead, BBW joins the chorus for custodial sentences, but it failed to point out whether any of the data breaches featured in the report would have been cases where a jail term, rather than a fine, would have been a more appropriate punishment.

BBW calls for anyone who knowingly commits a data protection breaches to receive a criminal record. Currently, offences are classed as civil offences. BBW is concerned that this raises the potential for an individual to gain further employment that allows them to access personal information, despite the fact they have been punished for committing a data protection offence in a previous job.

Perhaps in a future report, BBW will also advocate sending miscreants to the stocks for a couple of days.

BBW calls for mandatory data protection training for members of staff with access to personal information – but it does not appear to know how many of the reported data breaches had occurred despite the DPA training that was in place.

BBW calls for the mandatory reporting of a breach if it concerns the public – but it failed to mention the breach reporting standards advocated by the GDPR.

BBW calls for standardised reporting systems and approaches to handling a data breach – but it failed to mention the work the ICO has already done in this area to encourage standardised breach reporting.

BBW also echos the ICO’s calls for it to be able to audit local authorities.

But enough of all this negative stuff – the report does some examples of poor data handling practices that will be useful for DPOs to feature in future presentations. They include:

• A CCTV operator watched part of the wedding of a member of the CCTV team.
• An officer wrote down his contact details on what he thought was a scrap of paper but contained personal details of a complainant.
• A care agency left 23 black sacks of paperwork behind after an office move. 100s of clients in several authorities were affected.
• A child report was sent to wrong recipient. The recipient used Facebook to track down correct client and passed report on. The client reported this.
• An advisor recorded incorrect details for noise complaint which resulted in an officer visiting the person being complained about rather than the complainant.

Happy reading.

Source:
http://www.bigbrotherwatch.org.uk/wp-content/uploads/2015/08/A-Breach-of-Trust.pdf

.

How effective is the Telephone Preference Service?

I don't know, either.

The TPS’s website provides individuals with an easy way to register their objection to receiving unsolicited direct marketing calls, but no information on how effective it is at stamping out these practices.

There’s no information on the volume of complaints it receives, and how these are trending over time.

There’s no information on the work it does to investigate these complaints, before handing them to the Information Commissioner’s Office.

There’s no information the disciplinary action it has taken against companies who fail to properly screen their lists.

Well, actually that's not quite right. The "make a complaint" page does explain that  “we are not the body responsible for enforcement and we are unable to take enforcement action against companies complained about.”

So what does it do?

Ah, that’s easy. “Complaints handled by TPS and CTPS are included in a regular report sent to the Information Commissioner's Office (ICO) who are the body responsible for enforcement. This enables them to identify trends in complaints being made and supports their investigation when taking enforcement action deemed necessary by them.”

And that’s it.

No wonder I’m getting sick and tired of reading about the ICO fining organisations that breach the PECR regulations. They appear to be the only body that generates headlines as they try to stop nuisance calls.

It might well be the case that the TPS is just as determined to deter miscreants – but it is evidently doing so in mysterious ways.

If the TPS were a public authority, I expect that the usual suspects would have made FOI requests by now, demanding to know just what it is doing and how effective it thinks it is.

What do we learn from it's website about the “TPS in the news and press releases?” 

Not much, considering that there’s only one link for 2015 - and that's over 4 months old. The next link is almost a year old. The TPS really needs to curate it's website more carefully if it is to avoid accusations that it's press officer, and the service itself, could be more proactive.

Perhaps the TPS really is being proactive. Perhaps it shares a great deal of information with the direct marketing industry, through the Direct Marketing Association.

And if that is the case, why shouldn't it share more information with consumers, too?

So, I’m looking forward to the TPS adding a new Frequently Asked Question on it's website soon: "How effective is the TPS?"

Sources:

https://complaints.tpsonline.org.uk/consumer
http://www.tpsonline.org.uk/tps/contactandpressenquiries.html


.

Why are so many privacy professionals driven to despair?

Why are so many privacy professionals driven to despair?

Don’t worry. It’s not that unusual for privacy professionals to be driven to despair by the demands of their job. It’s just a mindset that most of them go through when business “requirements” and legal “restrictions” continually clash.

As Tom Fletcher, the UK’s former Ambassador to the Lebanon recently put it: “You think you’re reached rock bottom – then you hear a noise from below.”

But there is hope at the end of the tunnel. That mindset can pass, to be replaced with a more productive phase of professional life.

Tom Fletcher recently blogged about the eight stages of his (professional) life. Seduction. Frustration. Exhilaration. Exhaustion. Disaffection. Infatuation. Addiction. Resignation.

He knew them all, often simultaneously.

I’ve known them, too.

The work of a privacy pro isn’t easy, when you’re dealing with clients who have little concept of current data protection requirements, let alone the added complexities that are being contemplated by those that are currently negotiating the compromise text of the General Data Protection Regulation. But why should the negotiators care about complexity? Hardly any of the people currently involved in the tripartite discussions will ever have a job that actually requires them to implement it. Many will simply move on to reaching consensus in other policy areas.

Talking about it is not the same as doing it.

So, and as apparently happens so often with Lebanese politics, the tripartite negotiators can needlessly overcomplicate issues with layers of conspiracy, creative fixes, and intrigue. They can undermine leaders working in the national interest of Member States, rather than the collective interest of the EU. And they can proclaim that there is no substitute for this unrelenting, maddening, political process.

Roll on 2016 when, in a fit of exhaustion, something will be churned out of the EU’s legislative sausage machine, and hordes of consultants can feast for years thereafter. Whatever finally emerges is unlikely to significantly enhance the privacy of the average EU citizen – but it ought to significantly enhance the bank balances of the armies of consultants who will be called upon for guidance as to which elements of the Regulation should be implemented, and how, and which bits can be safely ignored, and why.

But why do I care?

Simply because I care about the implementation costs. When most small and many medium-sized businesses can barely begin to demonstrate compliance with the current rules, my eyes roll when I think of the difficulties that they will face in coming to terms with the new rules.

Of course the larger organisations will do what it takes to remain on the right side of their regulators – assuming, that is, that the regulators have a large enough stick to require compliance. Under-resourced regulators will be left in the unenviable position of being held accountable for not enforcing the new rules. They’ll be blamed for allowing some businesses (and some public sector bodies, no doubt) to get away for years with shockingly poor data handling standards.

Perhaps my current mood will improve when all the privacy pros return from their summer holidays.

I do hope so.

Source:

http://blogs.fco.gov.uk/tomfletcher/2015/07/31/19389/

How to cope:

http://www.samaritans.org

http://www.martinhoskins.com

.

Surveillance after Snowden

Students of surveillance and counter terrorism have another (81 page) report to add to their summer reading list. The Henry Jackson Society has recently published "SurveillanceAfter Snowden: Effective Espionage in an Age of Transparency."

The report, written by Robin Simcox, looks at the ways the actions of Edward Snowden have impacted the US and the UK, particularly with regards to safeguarding national security.  As well as the usual sources (including me), a number of senior intelligence officers from both countries were interviewed, and the usual findings have emerged.

The main findings are that:

• Terrorists and other criminals have benefited from Snowden’s actions. Some have altered their communication methods, while others have taken advantage of new encryption tools.
• There is a fear that hostile states are increasingly deploying GCHQ’s or the NSA’s own cyber strategies against them.
• Despite the Snowden allegations, US and UK intelligence agencies are legally intercepting communications on order to prevent attacks from terrorists, cyber criminals and a host of other state and non-state actors.

To my mind, the key conclusion is that, in future, intelligence agencies must aspire for translucency, not transparency. The report explains that: “States need secrets, for intelligence and military purposes, criminal investigations and a host of other reasons. Yet, they also need public consent in order to operate with credibility. This means agencies must open up further than they have in the past. Yet, it also means civil society accepting that unalloyed transparency is not a positive and that there are good reasons for state secrets.

Despite the damage that Snowden’s actions caused, the public expectation that intelligence agencies should stop terrorist attacks and serious crime remains. Yet, at the same time, there are calls for them to reform and be more transparent in order to rebuild trust. The intelligence agencies are in a particularly unenviable position: asked to be less intrusive; more transparent; and yet, just as effective.”

Quite how the new surveillance legislation, currently being developed by Home Office officials, will meet the tests of necessity, proportionality, public accountability and, most importantly, effectiveness, is an issue that can’t yet be addressed.

I gather that there are still major difficulties to be resolved between policy officials and various communication service providers about the effectiveness of some of the requirements that are being floated by the Home Office / law enforcement community. I’m looking forward with interest to a statement from the Home Secretary along the lines that “all providers have been fully engaged. They all know and are all willing to accept the technical and operational requirements that will be placed upon them.”

Following the Snowden disclosures, a significant gap has emerged between the government and some CSPs, who were outraged at the intelligence agencies’ ability to access their data.

US-based CSPs are now claiming that the UK has no jurisdiction over them and that they are bound by US law. Intelligence officials view the CSPs’ stance as being unreasonable, as other foreign companies wishing to deliver a service in the UK are obliged to comply with UK law. This was partially why the Data Retention and Investigatory Powers Act 2014 was introduced.

CSPs’ use of ubiquitous encryption has also increased exponentially since Snowden’s leaks, meaning that companies are automatically providing encryption for users, rather than the user having to encrypt the data themselves.

Robin Simcox considers that escalation is inevitable, as the NSA and GCHQ step up their efforts to break into these networks.

Politically, the Home Office’s problem is that whatever legislation is passed by the House of Commons, it also has to get through the House of Lords. And the privacy / human rights lobby is much stronger in this parliamentary chamber.

However, just as the Lords bowed to the will of the Government by reviewing the Data Retention & Investigatory Powers Bill in record time last year, perhaps the Peers will give the Government’s new surveillance legislation an easier passage than the Home Office currently fears.      

So, before the new legislation commences its passage through Parliament, I’m looking forward to an indication from the communication service providers that, technically, the proposals are (likely to be) fit for purpose.

But I’m not holding my breath.

Source:

http://henryjacksonsociety.org/wp-content/uploads/2015/06/Surveillance-After-Snowden-16.6.15.pdf

.

ICO ponders its future funding strategy

The ICO’s latest paper on its future funding strategy shows how far its thinking has developed. (Not far.) A paper presented to the ICO’s Audit Board last month reports that it has now established a steering group to produce a short business plan.

Assessing who should register is fraught with difficulty, given the fact that there is no definitive list of businesses and even within established categories, it isn’t always possible to identify how many process data and need to notify. Also, businesses are constantly in flux, changing names, going out of business, merging etc.

Finally, given how few non-registration prosecution cases are mentioned in each ICO Annual Report, perhaps there’s not much of an incentive for those at the dodgy end of the compliance market to register in the first place. 

The new steering group will commission further research to enable the ICO to:

• Better understand the profile of the current register;
• Estimate the number of registerable data controllers (to give the ICO an idea of how large the public register might be if it achieved close to full coverage; and
• Forecast future fee levels based on the expected size of the register.

You might have thought that such research would have been carried out years ago. But there’s nothing like good research to ensure that proper evidence-based decisions are made.

The steering group is also tasked with:

• Establishing a process to review all data controllers leaving the public register;
• Engaging with particular sectors that appear to have a lower level of registration than ought to be the case; and
• Establishing a process to refer miscreants to the ICO’s enforcement team.

Setting the right fees are important, as if the ICO receives more in income than it spends on DP, the balance has to be remitted to the Treasury. Fee income for 2014/15 was £1.2m more than the original forecast. If not spent by the ICO, it's money down the drain.  It's as if a Civil Monetary Penalty had been levied on all UK data controllers – but for no good reason at all.

The paper makes an interesting observation about the percentages of  the number of organisations that need to register that the ICO think will be registered each year: “This needn’t be a global figure. For example it could be 100% for elected representatives, 95% for law firms and a lower figure for general business.”

I’d love to know what percentage of estate agents the ICO estimates might register. Not that high, I suspect.

In the 1950s, TV detector vans (see today’s image) began to appear as part of a Government strategy to encourage people to buy a TV licence. Will we see equivalent “ICO detector vans” patrolling our streets to encourage recalcitrant data controllers to register in a few years time? 

I wonder.

Source:
https://ico.org.uk/media/about-the-ico/minutes-and-papers/1431895/20150608-acmeeting-information-paper-on-registration-fee-strategy.pdf

.

£100 & £500 fees for DP & FOI Tribunal appeals

With little fanfare, and at the start of the summer holiday season, the Ministry of Justice has published its response to an earlier consultation paper on enhanced fees for divorce proceedings, possession claims, general applications in civil proceedings and is now consulting on proposals for further fees.

[Yawn.]

Until you realise that, tucked away in paragraphs 124-127, is the proposal to introduce fees for proceedings in the First-tier Tribunal (General Regulatory Chamber).

This chamber deals with a range of regulatory matters, eg those concerning charities, consumer credit, gambling, transport and appeals from decisions of the Information Commissioner.  Currently the only fee income is generated from appeals in relation to gambling licences.

In 2013-14 the estimated cost of the General Regulatory Chamber was £1.6m. The fee income generated from gambling licence appeals was £11,600. The MoJ plans to increase the Chamber's fee income to £350,000 by levying new fees.

The proposal is to charge a fee of £100 to issue proceedings, which would entitle the claimant to a decision based on a review of the papers. The claimant may alternatively elect for an oral hearing, in which case a further fee of £500 would be payable. Based on current volumes, the MoJ estimates that this proposal would generate a cost recovery percentage of around 17% after remissions.

The fees will also apply to “reference” cases where cases are started in the first-tier Tribunal but have to be referred directly to the Upper Tribunal for a first instance hearing.

What is not known is what impact this will have on justice. When fees for referrals to employment tribunals were introduced, the volume of referrals to the tribunals collapsed. Will this move deter a similar percentage of unhappy DP complainants? Given the extremely low volume of DP cases that are currently referred to the Tribunal, it may be some time before this becomes evident.

I suspect that, given the relatively high number of FOI cases that are referred to the Tribunal, we’ll soon learn what effect the introduction of fees will have here.

Will fees really deter claimants who passionately believe in the strength of their case, but lack the funds to place their £100 / £500 punt? I doubt it. Already I’ve seen one consultant tweeting that he’ll stump up the £100 fee for four cases himself – so if the market wants it, there ought to be a safety valve for complainants who are financially stretched.

But fewer appeals to the Tribunal would mean less work for the ICO (with a consequential impact on staffing levels) and on the demand for highly skilled legal advice from our chums at 11 Kings Bench Walk.

The MoJ is inviting comments on this proposal by the end of the summer holiday season (15 September).

So, take a break from your well-earned summer holiday write to the MoJ if you really feel passionately about the matter.

Source:

https://consult.justice.gov.uk/digital-communications/further-fees-proposal-consultation/supporting_documents/enhancedfeesresponseconsultationonfurtherfees.pdf

.