Searching for the Surveillance Camera Commissioner

Did you know that Britain has a Parliamentary Under Secretary of State for Criminal Information?

I didn’t either – until I glanced at a recent Home Office note which announced that Lord Taylor of Holbeach has recently laid a written statement in the House of Lords about the regulatory framework for surveillance camera systems and a code of practice.

I came across this politician as I was searching for more information about our new Surveillance Camera Commissioner. And I was surprised that the Government’s own website contains significantly more information about Lord Taylor than about Andrew Rennison.

Given that Andrew Rennison’s appointment as the Surveillance Camera Commissioner was announced on 13 September 2012, I thought that by now his staff might have created a website explaining just who he was and what he does.

Nine months later, we are still awaiting the launch of this website. Or if it exists, it is not indexed very well.

Does it matter? 

Well, given the public interest in issues relating to surveillance, you might have thought that his office would have given the Commissioner a more visible presence on the internet. 

Is he a very busy Commissioner? Other than occasionally reviewing the Code of Practice for Surveillance Camera Systems, he’s probably got more than enough on his hands with his other job – that of Forensic Science Regulator. A website containing news about that side of his business life is up and running. 

But what should we expect from someone whose surveillance responsibilities can be measured in terms of a budget of £500,000?  Well, at least a basic website.  Perhaps not a wizzy one, chock full of interesting details of life as a Surveillance Camera Commissioner, or an analysis of how the British public view these technologies, compared with other EU citizens. But, perhaps, one containing advice about the relevant operational, technical, quality management and occupational competency standards which are available for a system operator. And, indeed, what his thoughts on Google Glass might be. But something, surely. 

If you fancy following him on Twitter, look out for his muses on @fsrscc. His last tweet was on 23 April though – so I don’t think this is his favoured method of communication. I can’t say I blame him. I don’t tweet either. Presumably, his 115 followers think that 16 tweets this year is sufficient news about his activities. 

Interestingly, he has no enforcement or inspection powers. Instead, he is required to encourage compliance with the Code of Practice by considering: “how best to ensure that relevant authorities are aware of their duty to have regard for the Code and how best to encourage its voluntary adoption by other operators of surveillance camera systems.”

Evidently, the Surveillance Commissioner and the Information Commissioner will be expected to play a role in taking appropriate action against those who flout the usual standards. Will this concept of “enforcement by another regulator” be effective? We will only know in the fullness of time. 

Anyway, what can I do to ensure that the data protection community gets to know him a little better? I can start by inviting him to a forthcoming meeting of the Data Protection Forum and the National Association of Data protection Officers, to give him a public platform where the most pressing issues on his agenda can be explored by professionals who are keen to understand just what it is that concerns him. 

Once I unearth his contact details, that is.


Sources:
www.gov.uk
https://www.gov.uk/government/organisations/forensic-science-regulator
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/204775/Surveillance_Camera_Code_of_Practice_WEB.pdf

Image credit:
http://stanwiedeman.files.wordpress.com/2011/07/security-cameras.jpg

.

The European Commission’s chaotic cookie compliance culture

Journalists always like to hammer the odd nail into the European Commission’s data protection credibility coffin. This week, we learn from a “Euroactiv Exclusive” the extent to which the European Commission is ignoring the cookie requirements and is evidently tracking users of its websites.

Journalists have discovered that “the European Commission’s homepage sets cookies to store information on surveys – which are not essential to the operation of its website – and technically they should warn about keeping the data.” Also: “users browsing the Commission’s EURES homepage are tracked by Google Analytics without warnings, in clear breach of the current data protection rules.”  

European Data Protection Supervisor Peter Hustinx is evidently aware of the problem and his officials are currently preparing new guidelines for the EU institutions about tracking and cookies on websites. Quite why his officials have not managed to update their guidance before now is not clear. 

The direction of travel on cookies has been very clear since November 2009, when an obscure MEP inserted the cookie rules into a telecommunications package that was implemented in the UK by means of the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011, [SI 2011 No 1208]. If the cookie rules were devised to deal with the legacy of the great Phorn debacle, (and I won’t trouble readers with a learned explanation on the merits of that initiative), then it means that a mighty sledgehammer was created to crack a pretty small nut. 

Leaving that aside, is 4 years enough notice for the European Commission to implement its own rules? 

Evidently not.

Still, if Dave Evans, the ICO’s former cookie captain has any spare time on his hands as he leaves the ICO and joins Swiss Re as their new Data Protection Officer, perhaps he might be available to explain to these Commission bods what needs to be done to comply with European laws.
  

Does it really matter that the Commission's institutions can’t fully comply with European laws?

In one sense, their failure to treat the cookie requirements seriously sends a strong message to the data protection community. If privacy officers need leadership on the cookie question, they had better not look in their direction.

The trouble is, however, that these institutions should not have the luxury of choosing which laws to implement. Yes, the cookie laws are silly, so there’s not a lot of harm done by not implementing them. 

But, if the Commission (and its associated institutions) can’t be bothered to fully implement the current laws, then why should the Commissioners be accorded much credibility when they announce that the current Data Protection Directive needs urgent overhaul and it is really important that there should be agreement on a new legal instrument by 2014? 

The more important task for Peter Hustinx is to reassert his credibility among journalists as an effective regulator, when the European institutions he is supposed to supervise treat issues like cookie compliance with this degree of reverence.

Source:

http://www.euractiv.com/infosociety/eu-tracks-line-users-warning-rul-news-528626?utm_source=EurActiv%20Newsletter&utm_campaign=7087cc1023-newsletter_daily_update&utm_medium=email&utm_term=0_bab5f0ea4e-7087cc1023-245671226

.

ICO’s former cookie captain heads for the Gherkin

Yes, that man in black, he who tried so hard to make sense of the cumbersome cookie rules that appeared to arrive out of absolutely nowhere from the European Parliament a few years ago, has announced his imminent departure from Wilmslow.

Hurrah. After 10 years at the ICO, Dave Evans is moving on, to become Swiss Re's Data Protection Officer. 

In an email to his chums on what he terms "the fabulously (and ironically) indiscreet data protection grapevine," Dave remarks that: "What I will miss most about my current role - apart from my ICO colleagues and the daily opportunity to laugh at Wilmslow's more comically extravagant retail outlets of course - is the variety of people I meet when doing the "liaison" part of my job."

Well, let me reassure him. Even though he won't be able to laugh so frequently at Wilmslow's more extravagant retail outlets, at least he'll get a salary that means he'll be able to afford much more of the stuff they sell. And, while Dave might not quite get the opportunity to remain in touch with the huge range of campaigners, geeks and nerds who live off (and frequently take issue with) every ICO utterance, he will find that there is a wide network of data protection professionals in and around the City of London that readily welcomes former ICO staffers.

Dave will soon be joining that close knit group of people who have served their time at Wilmslow and are now trying to make of it all in the City. Indeed, he may well find himself occasionally sharing the same lift with another former ICO staffer, Richard Thomas, as the Gherkin hosts the offices of Hunton & Williams as well as Swiss Re.

Perhaps, as the forthcoming ICO budget cuts start to bite, and the steady trickle of ICO leavers turns into a stream, it won't be long before the ICO finds that it has to issue its own Code of Behaviour for former ICO employees, to ensure that Wilmslow's greatest secrets remain "up-north". Or, will we soon be reading outrageous tales from some Wilmslow whistleblower about past goings-on that will shake the very foundations of the institution we so admire?

I doubt it. 

But, as Dave so rightly points out, the UK does enjoy a fabulously (and ironically) indiscreet data protetion grapevine!

.

Data Protection Professionals and the Honours List

Although eminent people have been practising and promoting data protection principles in the UK for some 30 years, can anyone think of a single person who has been awarded an honour for their services to data protection and whose working life has not included a stint at the ICO?

Has anyone outside Wilmslow ever been considered worthy enough even to qualify for an MBE (or the less prestigious award, the BEM)?

I couldn’t think of anyone, either.

Perhaps data protection is still on the list of unmentionable activities that automatically exclude the practitioner from any form of official recognition. 

Or perhaps, in the next list, we’ll be able to celebrate one of our own getting a gong from HRH. 

Surely, after waiting patiently for 30 years, the profession can’t be ignored for that much longer. 

“Oh, but it can,” I sense a few bods whisper. 

“Oh yes it can.” 

.

Dancing the PIA Tango

Privacy Impact Assessments. Don’t you just love them?

I’ve been trying some different privacy assessment methodologies recently, as I’ve been trying to work out for myself just what I want to get out of the exercise. If those writing the Regulation have their way, an awful lot more of them will be getting done.  But just like the phrase “privacy by design”, a PIA is a term that could mean any manner of things.

Is it just a way of ensuring that whatever initiative I’m assessing is actually legal?

Or is it a way of ensuring that the initiative I’m assessing is actually acceptable from a corporate reputational view? Or that the individual will like it?

Try as I might, the guidance on the ICO’s website isn’t that easy to remain engaged with. And I’m not sure that the ICO’s focus is necessarily where I want to focus my assessments.

In a nutshell, the ICO’s guidance helps me consider whether the initiative is legal, in that it makes me ask myself (and answer) a heap of questions about precisely how each of the Data Protection Principles are engaged, without directly asking me to consider the amount of harm that might be caused to an individual if the initiative were to encounter any sort of breach.

Instead of following the ICO’s methodology (which, thank goodness, it will be changing shortly), I’m trying out an alternative approach, which places much more emphasis on privacy risks from the individual’s perspective. Yes, of course it also assesses the risks associated with non compliance with the DPA and other privacy laws, but by looking at things from the perspective of the person who will complain when something goes wrong, the likelihood of them suffering harm as a result of the initiative becomes more obvious. 

This methodology is being pioneered by the mighty Chris Pounder, of Amberhawk fame. As I’ve played around with his method, the potential legal snags and harms that may be suffered by an individual have been easier to spot. His method is also easier for businesses to use. Project mangers (or others with specific knowledge of the initiative) explain what they are doing, and provide factual information on a form. The form that the project managers see don’t contain inaccessible data protection jargon, but the interviewees will need a bit of help filling in the answers, as the forms ideally need to be tailored to the specific circumstances of each initiative.  Then, the Data Protection Officer can apply their own knowledge and experience to make the relevant impact assessment, and to highlight ways in which risks could be reduced, if they were deemed to be unacceptably high.    

None of this stuff is necessarily easy for the untrained DPO, especially when it is evident that the client is not too sure what it is that they need to do to achieve their goal, but they just want to ensure that whatever they are doing  is lawful.  There’s not a lot of point in commencing a Privacy Impact Assessment on an initiative which basically states that a company wants to maximise the value of its customer and marketing database.  It helps when the client has a reasonable idea as to how it will maximise the value, and who it will work with to exploit the value of the information it has, and what other partners it will work with to augment its own data with other types of data that are commercially available. 

For those that are sufficiently interested, Chris Pounder will be teaching another group of people how to dance his PIA Tango in London on Tuesday 9 July. If I were you, I would seriously consider going along.

Credit:

http://www.amberhawk.com/

Image credit:

http://lovebeingretired.com/2013/01/01/5-ways-boomers-can-feel-sexy-and-keep-passion-alive/dancing-couple-2/

.

No titillating titbits about the Regulation this time

Despite the promise of a bit of nudity, the session on “Naked Citizens! The General Data Protection Regulation and why you should care about it” at yesterday’s Open Rights Group conference in Central London attracted a pretty small audience.  

The day’s proceedings (in the lecture theatre at the Institute of Engineering and Technology, next door to the Savoy Hotel) started with promising numbers in the audience. Some 350 people were due to attend for all or part of the day. Well over 200 people attended the initial keynote speech, then half of them drifted away just before the commencement of the second session, on the “Snoopers Charter – What’s the situation now?” Unfortunately, the audience halved again as Anna Fielder from Privacy International, David Smith from the ICO and Kasey Chappelle from Vodafone took their places on the stage for a general reprise on what most privacy professionals already know.

And this was a pity, for what happened next was a vivid demonstration of what happens when a Panel Chairman is inadequately briefed about what the speakers are likely to say, and how long they are likely to speak for. 

Anna and David kept their opening remarks short. Anna spoke for a few minutes on the main sticking points of the current negotiations on the Regulation. David spoke for a little longer, explaining that there was no absolute certainty that the measure would be agreed next year, as the European Parliamentary elections in 2014 require agreement by Spring 2014 if there is to be sufficient Parliamentary time for it to go through all the relevant stages. The ICO was in favour of the introduction of sensible regulation, not red tape, and was mindful that a balance had to be struck between privacy and other rights. Interesting. This is not language I’ve heard coming from the European Commission for some time. The Commission have spoken in terms of privacy as a fundamental right, but not one that necessarily needs to be balanced with other rights.  What else did he have to say? Well, David was marginally optimistic that agreement would be reached, and that there is more that is good than is bad with the current draft.

Then it was Kasey’s turn – and she went on for a significantly longer time than had been taken by the others. She was the only speaker to use Power Point slides, and I can only assume that the Chairman knew what she was likely to say, and how long it would take her to say it. We, in the audience, were not in on the secret. And from what I saw, at no stage did the Chairman try to interrupt her.

In her view (which I increasingly agree with), privacy is not seen as a differentiator but as a matter of legal compliance -  and an environment of more prescriptive rules will result in an environment increasingly dominated by lawyers. The trouble with lawyers is that they are often instructed to advise on explaining the minimum that needs to be done to ensure that the client stays out of trouble. Stuff the consumer experience, or a more holistic approach to privacy – what company directors are primarily concerned with is reducing their liabilities. 

Notwithstanding this rather bleak premise, Kasey explained in some detail how Vodafone upheld its own privacy commitments (which create a culture of privacy across the company) with a Privacy Risk Management System (with standard global risk control commitments) and a Critical Privacy Risk Register (a formal management and global policy governance of the most critical risks facing the company and the communications industry). All good corporate stuff, but it wasn’t about the Regulation - and that was what I had come to hear about.

With almost ten minutes of the session left to run, Kasey wound up and I braced myself to see the naked citizens. Alas, none were to be found, and I was left with the sense of frustration that Anna and David must have felt, perhaps hoping for a longer debate on the actual Regulation itself. Had David known that he would devote some 5 hours travelling time for the privilege of addressing 100 people for just over 10 minutes, he might have decided to have offered the speaking slot to another oik at the ICO, so he could spend his Saturday mowing his lawn.

Note:

Other sessions were run concurrently, discussing a host of other hot topics, with many delegates keen to focus on issues that were on the front pages of many national newspapers yesterday. I won’t touch on those issues in this blog – other than to report that Tim Wu, a technology historian, began his keynote speech by announcing (in a rather hysterical manner, I thought) that, looking at the papers, we are in a state of absolute crisis, and it is therefore absolutely essential that a strong and effective digital rights movement continues to exist.

Image Note:

Do not be concerned. Conference delegates were advised that their images might captured if they sat in particular sections of the audience.

.

Back from my break

Normal service will resume shortly.