Equality and Human Rights Commission says information privacy laws flawed

15 August 2011

The Equality and Human Rights Commission is today publishing a report that shows current privacy law is failing to stop breaches of personal data privacy and is not keeping pace with the rapid growth in personal data collection.

In response to the research findings the Commission wants the government to bring in changes that will better protect personal information.

The report shows that the way government and its agencies collect, use and store personal data is deeply flawed. They may be unaware that they are breaking the law as the complexity of the legal framework means their obligations are unclear.

It also finds that it is difficult for people to know what information is held on them, by which government agency or private sector body, or how it is being used. For example, as there is currently no law regulating the use of CCTV cameras it would be very difficult for someone to find which organisations hold footage of them.

It can be hard to check the accuracy of personal data held, to hold anyone to account for errors in the data or its misuse and to challenge decisions made about someone on the basis of that information. Calling any public or private organisation to account is made more difficult because people often may not know what their rights are or know when a breach of those rights has occurred...

In response to the report’s findings, the Commission is making three recommendations to government:

• streamline the current legislation on information privacy so that it is easier for organisations to understand their responsibilities and simpler for citizens to know and use their rights.  


• ensure that public bodies and others have to properly justify why they need someone’s personal data and for what purpose. Any requirement to use personal data for any purpose other than for which it was collected should go through a vetting process. Organisations should ensure they comply with the current data protection and RIPA regimes, in addition to the Human Rights Act.   


• all public bodies should carefully consider the impact on information privacy of any new policy or practice and ensure that all requests for personal data are justified and proportionate.

Full press release here and Protecting Information Privacy report here. 

DoH complies with High Court ruling on definition of personal data in abortion statistics case

The Department of Health has decided not to appeal the recent High Court ruling on the definition of personal data in Department of Health v IC [2011] EWHC 1430 and has disclosed the disputed statistics on the number of late of abortions carried out in England and Wales.

Following the Department's appeal to the High Court, Mr Justice Cranston held that the Tribunal had been entitled to find, from the evidence before it, that the proposed disclosure was of fully anonymised data, which would not identify or (in combination with other information) lead to the identification of any of the individuals concerned.

The key part of the judgement considered the meaning of a disputed passage in Lord Hope's judgement in the House of Lords ruling on Common Services Agency v Scottish Information Commissioner [2008] UKHL 47. This was the request for childhood leukemia statistics by census ward in Dumfries and Galloway.

Mr Justice Cranston found that:

• Lord Hope had recognised that the CSA could itself always identify the children involved from the original information which it held

• it did not follow that statistics derived from that data, if disclosed in a fully anonymised form would still be personal data. This is a point on which, he found, all members of the House of Lords demonstrated 'a shared understanding'.

• the House of Lords decision to refer the issue back to the SIC in that case was not to determine whether the process of barndardisation would transform the data into data that would no longer be personal data in the hands of CSA itself. (This is what the Tribunal had found in its ruling in the abortion statistics case.) The process of barnardisation (by which low numbers were randomly increased or decreased by 1 or left as they were) was not capable of doing this, since Lord Hope had expressly recognised that the CSA would still hold data identifying the children concerned. The point of the referring the case back to SIC was to determine whether bardnadisation could prevent the public from identifying any of the children involved.

•the Tribunal had made an error of law. It should have found that disclosure of fully anonymised abortion statistics to the public did not involve a disclosure of personal data, even though the Department of Health, the data controller, could still identify each of the women involved.

• any other conclusion would be 'divorced from reality'. The argument that the data remained personal data, even if disclosed to the public in fully anonymised form, because the data controller could identify those involved, would lead to the conclusion that to reveal that 100,000 women had an abortion in a particular year would be to disclose personal data about every one of them, which "is not a sensible result" and would seriouslty inhibit the publication of medical statistics.

See also:
Department of Health statement 5 July 2011

Kenneth Clarke data protection speech

Ministry of Justice
26 May 2011

Europe is in danger of making the wrong choices on new data protection rules, Secretary of State for Justice Kenneth Clarke said.

Speaking at the British Chamber of Commerce in Belgium, Mr Clarke reiterated the UK Government's commitment to restoring civil liberties, citing the Government's achievements in scrapping ID cards, and working to end the misuse of anti-terrorism stop and search powers.

He stressed that collecting data in the interests of national security must not come at the expense of UK citizens' basic freedoms, particularly the right not to have their personal data treated carelessly or even fall into the wrong hands.

The Justice Secretary also warned, however, that collecting data sensibly and sharing it safely across borders is a crucial part of efforts to tackle international crime and protect our security, and is entirely consistent with ensuring strong standards of data protection.

The EU is currently reviewing its data protection rules and Mr Clarke's speech made clear the Government's belief that it must be up to all Member States to decide the details of when to use and share data to keep their citizens safe – particularly in detecting crime and preventing terrorism. He also warned Member States of the dangers of unnecessarily prescriptive rules in this area.

Kenneth Clarke said: 'Imposing an inflexible, detailed data protection regime on the whole of the EU, regardless of the peculiarities of different cultures and legal systems, carries with it serious risks.

But he added: 'I am optimistic that there's a common sense solution on this. Our experience in the UK is that security, freedom and privacy are possible.'

While in Brussels, the Justice Secretary also met UK Members of the European Parliament and discussed data protection issues.

The speech is available to download in full here.
See also comment by Chris Pounder on the Amberhawk blog.

ICO seminar on privacy and anonymous data

ICO news release
30 March 2011

Being anonymous ‘an ever increasing challenge’ in 2011, says Information Commissioner

Advances in the internet, the scale of personal information that is collected by public bodies and businesses, and the pressure to share data in the name of efficiency, make being anonymous in 2011 ‘an ever increasing challenge’ Information Commissioner, Christopher Graham, will say today at a seminar the ICO is hosting on anonymisation.

Leading academics and experts from the public sector and business will gather at the Wellcome Trust in London today to consider different perspectives and approaches to anonymisation – the process of removing personal identifiers from information. Speaking alongside the Information Commissioner are Paul Ohm from the University of Colorado, Mark Elliot from the University of Manchester as well as representatives from the Cabinet Office and the Office of National Statistics.

The ICO will publish a report in the coming weeks that will summarise the seminar’s key discussion points as well as setting out next steps.

Full press release here.

MoJ calls for evidence on data protection legislative framework

The Ministry of Justice has today (6/7/10) published a Call for Evidence on how the European Data Protection Directive 95/46/EC and the Data Protection Act 1998 are working.

The Government has issued a Call for Evidence on current data protection law to help inform the UK’s position on negotiations for a new EU data protection instrument, which are expected to start in early 2011.

The Call for Evidence lasts for three months and is due to close on 6 October 2010.

At the same time as launching this Call for Evidence, the Government has published a provisional post implementation review impact assessment of the Data Protection Act 1998, on which we would also welcome comments. This impact assessment complements the Call for Evidence and publication of a full impact assessment is planned for the end of 2010.

Please note that the Call for Evidence is not a formal consultation, but an evidence gathering exercise.

The document states that evidence is particularly sought on the following issues:

• A. definitions;
• B. data subjects’ rights;
• C. obligations of data controllers;
• D. powers and penalties of the Information Commissioner;
• E. the principles-based approach
• F. exemptions under the DPA; and
• G. international transfers.

http://www.justice.gov.uk/consultations/call-for-evidence-060710.htm

Home Affairs Committee evidence on work of the Information Commissioner's Office

An uncorrected transcript of the evidence given by the Information Commissioner, Christopher Graham, and Assistant Commissioner, Jonathan Bamford, to the Home Affairs Committee on 9 March 2010 has been published.

Q4 Mr Winnick: Thank you very much indeed. In January of this year The Times noted that your office has limited resources, no powers to speed up the freedom of information process and that the Office is limited by not having the final say in freedom of information appeals. Do you recognise these constraints? Do you think they are unfair, or do you think the comments were unfair?

Mr Graham: I do not believe all I read in the newspapers. I would comment that all public authorities have limited resources. We are unusual in that there is some buoyancy in our resources, at least on the data protection side, because of the introduction of a tiered notification fee. The largest concerns now pay £500 instead of £35 and that is giving us more money to spend on the data protection side of the business. On the freedom of information side of the business we have had a spectacularly productive year. We are closing outstanding cases, getting through the backlog, and this is despite the fact that there is a great public appetite for using the Freedom of Information Act - good. It does mean that applications to the ICO are up by more than 20%, but case closures are up by more than 40%. This is not an organisation that is suffering from restraint. On powers, next month we see greatly strengthened powers on the data protection side - the introduction of civil monetary penalties, the ability to audit government departments without consent. There is an awful lot going on at the ICO.
...
Mr Graham: I am going to ask Jonathan to comment on the data protection side in a minute, but the great challenge when I took on the role of Information Commissioner at the end of June last year was to tackle the backlog in freedom of information cases, and this we are doing. This is a week of tremendous activity because we are determined to clear some of the old cases before the end of our performance year and I am confident that in our annual report we will be able to tell a very good story of the speeding up. Freedom of information cases, if they come to us, which is on appeal, are almost certainly going to be difficult and intractable, but what we have succeeded in doing over the past few months is to send a message to public authorities that we are on their case, and so there is no question of just refusing information because you think it will take the ICO a long time to get round to it. If we were in a vicious circle, we are now in a positive cycle where the public authorities realise that the ICO is very alert and they had better get on with it and that is having a very beneficial effect.

The Commissioner was also asked about the Private Members' Bill introduced by David Maclean MP, which sought to exempt Parliament from the scope of the FOI Act and create a new exemption for MPs' communications with public authorities, by David Winnick MP who was one of the MPs who tried to block the Bill in the Commons:

Q9 Mr Winnick: Mr Graham, Parliament makes its own rules and the electorate will decide, as always, accordingly, but if Parliament had gone ahead and exempted itself from the freedom of information legislation, which at one stage was a possibility - there was a Private Members' Bill - what do you think the effect would have been generally in the media and on the public?

Mr Graham: That is a very hypothetical question.

Q10 Mr Winnick: It is bound to be, is it not?

Mr Graham: The controversy was before my time. If we are going to re-run history, I suppose the great might-have-been is what would have happened if Parliament had been inclined to go with my predecessor's steer and had published the expenses under more general headings. This, of course, was before we knew about flipping of second homes, so the regime might not have lasted very long, but it was Parliament's determination to challenge the ruling of the Information Commissioner and to challenge the ruling of the Information Tribunal and take it to the highest court in the land, and the highest court in the land, as you know, turned round and said, "Publish the lot", which was more than the Information Commissioner had requested. If you say, therefore, "How would it have gone?", I think you would have drawn the wrath of the public upon yourself if you had exempted yourselves. I think it would have been better if, in not exempting yourselves, you had realised that this was real and the law that applied to everybody else also applied to Parliament, but it is easy to be wise after the event.

Mr Winnick: Wisdom, fortunately, prevailed and you know what happened.

 Read the transcript in full here.