Source: http://ukconstitutionallaw.org/tag/data-protection/
Timestamp: 2014-11-27 18:00:56
Document Index: 587516890

Matched Legal Cases: ['CJEU ', 'CJEU ', 'EWCA ', 'UKHL ', 'UKHL ', 'EWCA ']

Data Protection | UK Constitutional Law Association
Tag Archives: Data Protection	by Constitutional Law Group | May 15, 2014 · 1:13 pm	David Erdos: Mind the Gap – The CJEU Google Spain Judgment Profoundly Challenges the Current Realities of Freedom of Expression and Information Online	CROSS-POSTED FROM OPENDEMOCRACY.NET.
(Suggested citation: D. Erdos, ‘Mind the Gap’ Open Democracy (15th May 2014) (available at OpenDemocracy) OR D. Erdos, ‘Mind the Gap – The CJEU Google Spain Judgment Profoundly Challenges the Current Realities of Freedom of Expression and Information Online’ U.K. Const. L. Blog (15th May 2014) (available at http://ukconstitutionallaw.org/).
Filed under Comparative law, European Union, Human rights
Tagged as Court of Justice of the European Union, Data Protection, Facebook, Google, Privacy
by Constitutional Law Group | May 2, 2012 · 4:08 pm	Carol Harlow: Surveillance and the Superstate	For a society as devoted to secrets and privacy as the British are traditionally supposed to be, however, the law possesses surprisingly few protections for the communications of its citizens. True, phone hacking has become a criminal offence under the Regulation of Investigatory Powers Act 2000 and the creation and retention of citizens’ data is now regulated by the Data Protection Act 1998 but there is no right of privacy per se at common law and resort is consequently to a haphazard and fragmentary set of common law rights of action, which protect person, property and dignity in limited situations [See Lord Bingham, ‘Tort and Human Rights’ in P Cane and J Stapleton (eds), The Law of Obligations (Clarendon Press, 1998)].
Government (a.k.a the Crown) has by way of contrast traditionally been highly privileged, benefiting from the existence of a set of wide and loosely defined prerogative powers in the area of security and defence. There has never been a constitutional ‘right to know’ and access to official information was until recently narrowly restricted by draconian Official Secrets Acts, which made it an offence for any Crown servant or agent or anyone in receipt of information from a Crown servant or agent to disclose such information without authority. Although toned down by the Official Secrets Act 1989, which restricts the categories of protected information, the underlying ethos, that information in the possession of government is its private property, has not been dispelled by the first freedom of information legislation, which came into force only in 2005 and is riddled with so many exemptions as to merit the label of ‘sheep in wolf’s clothing’ bestowed on it by Rodney Austin [‘The Freedom of information Act 2000: a sheep in wolf’s clothing?’ in J Jowell and D Oliver (eds), The Changing Constitution (Oxford University Press, 5th edn, 2004)].
In the last two decades, the relationship between state and citizen in the area of information has been complicated by the rapid evolution of information technology, globalization of communications and the multi-level nature of regulation. Many counter-terrorism measures involving surveillance emanate, for example, from the United Nations, while the European Union is starting to play a significant role in access to information and data protection. On the one hand, ICT has facilitated the accumulation and retention in government data banks of vast quantities of information, relevant and irrelevant, about its citizens. Concern over the uses to which such information would be put fuelled opposition to proposals – ultimately defeated – from Tony Blair’s government for citizen identity cards. On the other hand, easy access to the internet and rapid communication via mobile telephones, Skype, social networking sites, twittering and tweeting have worked to the benefit of citizens and rendered government control harder. This point was poignantly illustrated during the ‘Arab Spring’.
Concern, evidenced in the campaign against identity cards, has been growing at national level, over the growing use of modern technology to extend surveillance by public authorities – the proliferation of CCT cameras for crime prevention, centralized and systematic police monitoring of cameras used for traffic control for other purposes, and CCT use by the private sector, where it is barely controlled. The courts have shown themselves relatively unwilling to restrict the use of modern surveillance techniques. In Wood v MPC [2009] EWCA Civ 414, for example, the Court of Appeal rejected a claim that the filming of participants in a trouble-free demonstration and subsequent retention of the photographs was unlawful and amounted to a violation by the police of ECHR Article 8, ruling instead that the practice was a justifiable and proportionate measure for the prevention of crime. After the London riots in 2011, the Metropolitan police pressurized broadcasters to hand over videos and pictures they had taken, threatening a court production order under PACE. The press protested vigorously at the threat to freedom of speech (The Guardian 30 August 2011) but the issue remains unresolved. Similar protests met government proposals – not yet fully particularised – to extend rights of access by public authorities to electronic communications between citizens, stimulating a vigorous political response from the junior partners in the coalition government, (BBC News, 10 April 2012).
Strasbourg, interception and data protection
The interception of communications has brought the United Kingdom up against the Strasbourg Court of Human Rights on several occasions. Indeed, of the long line of cases marks the interest of the Strasbourg Court in interception of communications, data protection and surveillance, several involve the United Kingdom [ECtHR, Factsheet on data protection 2012]. In Malone v United Kingdom (1984) 7 EHRR 14, the issue was telephone tapping by the police, which came to light during Malone’s trial for handling stolen goods. When Malone sought a declaration that the practice was unlawful [Malone v. Commissioner of Police of the Metropolis (No. 2) [1979] 2 All ER 620] Megarry J. ruled (i) that the common law recognised no right of privacy on which to found an action (ii) that no actionable tort had been committed and (iii) that a claim based on Article 8 of the ECHR, which specifically protects the privacy of correspondence, must fail because the ECHR was not (at that time) directly applicable in domestic law. In reaching these conclusions, the judge remarked, however, that he found it ‘impossible to see how English law could be said to satisfy the requirements of the Convention’ and that ‘the subject cried out for legislation’. This did not prevent the British Government from arguing in Strasbourg both that the practice of requiring ministerial authorisation for all telephone tapping was sufficient to satisfy the Convention requirement that interceptions must be ‘in accordance with the law’; and also that the practice of ‘metering’ or recording dialled numbers and the time and duration of calls, fell outside the Convention right. The Government lost on both heads and the Interception of Communications Act 1985 followed.
This legislation is now taken up in the Regulation of Investigatory Powers Act 2000. RIPA’s objectives are wide: it provides for ‘the interception of communications, the acquisition and disclosure of data relating to communications, the carrying out of surveillance, the use of covert human intelligence sources and the acquisition of the means by which electronic data protected by encryption or passwords may be decrypted or accessed’ for purposes of national security or investigation of serious crime by the security services and police. A warrant signed by the Home Secretary is required. RIPA also regulates ‘metering’; it requires records to be kept and made accessible on ministerial request of dialled numbers etc. A monitor in the shape of an Interception of Communications Commissioner is provided. More controversially, RIPA permits a wide range of government agencies, including the Charity Commissioners, Financial Services Authority and local authorities to indulge in similar activities, albeit in limited circumstances. Largely on these grounds, it has been widely criticised as a ‘snoopers’ charter’.
Marginal restrictions on the powers of local authorities are contained in the Protection of Freedoms Bill, currently before Parliament. Unsurprisingly, however, the Home Secretary (Theresa May) did not seize the opportunity afforded by the Bill seriously to curtail the snooping activities of public authorities. Instead, proposals to include in the next Queen’s Speech extensions to RIPA’s ambit have been announced to cover more modern forms of communication, including internet-based email, twittering and tweeting, Blackberries, Skype, mobile phone texting, social networking sites like Facebook and even online games. Proposed new legislation would, it is believed, force internet companies to install hardware enabling GCHQ on behalf of government to examine websites accessed and text messages or email sent. The proposals will in short allow police and intelligence officers to monitor a person’s contacts including websites, although the content of communications will not be accessed. Once again, the records will be available to local councils and other agencies, though in limited circumstances.
In S and Marper v. the United Kingdom [2008] ECHR 1581, the Court ruled on the taking and retention of DNA samples from persons suspected of criminal offences but subsequently acquitted. There is an implicit reproof to the House of Lords, which had ruled to the contrary in R(LS and Marper) v Chief Constable of Yorkshire [2004] UKHL 39, in the ruling that
the blanket and indiscriminate nature of the powers of retention of the fingerprints, cellular samples and DNA profiles of persons suspected but not convicted of offences… fails to strike a fair balance between the competing public and private interests and that… the retention at issue constitutes a disproportionate interference with the applicants’ right to respect for private life and cannot be regarded as necessary in a democratic society.
Necessary changes to bring the law into line with the Strasbourg judgment are also contained in the Protection of Freedoms Bill.
But data processing, retention and protection are no longer a purely domestic matter. They are the subject of a major new initiative under the direction of EU Commissioner, Viviane Reding. This is both a necessary and welcome development in view of the vast data banks that have been built up in the EU from material contributed by member states and often widely accessible to member state authorities and officials. Until the Lisbon Treaty came into force, winding up the ‘Third Pillar’ and bringing justice and home affairs into the ambit of the Community, this was a dark and windowless area of EU law and policy. In the Community pillar, some of the sketchy and piecemeal regulation, such as the Telecommunications Data Protection Directive (Council Directive 97/66 of 15 December 1997) or Data Retention Directive (Directive 2006/24/EC of 15 March 2006), had shown a capacity to bite. In Case C-518/07 Commission v Germany [2010] ECR I-1885, for example, the Commission successfully brought Germany before the Court of Justice because its domestic data supervisory authority was insufficiently independent. But Directive 95/46 on data protection, the generally applicable legislation, contains exceptions in Article 13, which authorises Member States to restrict the scope of the rights and obligations provided in the Directive when ‘such a restriction constitutes a necessary measure to safeguard national security, defence and public security’. Similar exceptions apply to the prevention, investigation, detection and prosecution of criminal offences. The consequence was policy-making marked by a serious democratic deficit and information shortfall, culminating in the highly suspect Prüm Convention, which provided for the establishment of DNA profile databases and allows access to partner countries’ fingerprint databases, which the other contracting parties will be able to check on request not only for the purpose of preventing terrorist attacks and serious criminal activity but also in case of political demonstrations and ‘other mass events’. Similarly controversial was the agreement with the United States on the transfer of passenger name record data (PRN), successfully attacked in the Court of Justice Case C-301/06 Ireland v Council and European Parliament (10 February 2009), but now the subject of a new agreement foisted on a not-entirely willing Parliament (see http://www.statewatch.org/pnrobservatory.htm).
Coupled with the EU Charter of Fundamental Freedoms, the Lisbon Treaty (TFEU Article 16) provides a new basis for, and mandates, EU lawmaking, from which the European Parliament can no longer be excluded. A proposal from the Commission for a legislative text would provide a Europe-wide framework for data protection. This would have a major impact on private generators of electronic data, which would in future have to prove either consent of the data subject to retention or that retention was necessary. A second proposal for a directive covers processing of personal data by law enforcement authorities for purposes of crime prevention, investigation, etc. and ‘the free movement of such data’. The Commission is also reviewing the Data Retention Directive, which requires companies to store communication traffic data for a period of between six months and two years. In fact, some member states and notably Sweden have already implemented this measure.
The European Data Supervisor has, however, expressed ‘serious disappointment’ with the provisions in the law enforcement area [Opinion of the European Data Protection Supervisor on the data protection reform package]. While welcoming the fact that the directive would cover domestic processing, he regrets that the level of data protection in this area would not be increased:
The main weakness of the package as a whole is that it does not remedy the lack of comprehensiveness of the EU data protection rules. It leaves many EU data protection instruments unaffected such as the data protection rules for the EU institutions and bodies, but also all specific instruments adopted in the area of police and judicial cooperation in criminal matters. [para. 443, emphasis mine]
The UK Information Commissioner has expressed similar views. He sees the Commission proposals as less ambitious than the current UK Data Protection Act and hopes that ‘the provisions will be strengthened as negotiations progress’. Clearly, we cannot rely on the European Union to halt the march towards a surveillance state.
Filed under European Union, Human rights
Tagged as Data Protection, European Court of Human RIghts, Official Secrets Act, Regulation of Investigatory Powers Act, Surveillance
by Constitutional Law Group | March 10, 2012 · 2:08 pm	Tom Hickman: Data Over-Protection	When my central heating boiler stopped working the other day I was expecting exorbitant costs, cold nights huddled around a hot water bottle and possibly a few hours holding on the phone to British Gas. I was not expecting an encounter with the Data Protection Act.
It happened when I was arranging an appointment with a gas boiler ‘engineer’. I was asked for my mobile telephone number so that the engineer could call me if he couldn’t find the house. I duly supplied it. At the conclusion of the call I asked the woman from British Gas if she could read my mobile telephone number back to me to check she had written it down right. “I am sorry” she replied “we can’t give out mobile telephone numbers because of data protection”. I pointed out that I had just given the number to her, but no amount of reason would prevail. The most she would do was read back the last three numbers.
This is by no means my only experience of the irrational effects of data protection laws. Many readers of this blog will have similar tales. But such experiences must not be dismissed as lighthearted examples of corporate idiocy. They are symptoms of a genuine underlying problem that can have consequences far more serious than a boiler engineer failing to turn up for an appointment.
The British Government no less than British Gas is apt to invoke data protection as a reason for not supplying information in obviously sensible circumstances. When the All Party Parliamentary Group on Extraordinary Rendition requested data about the transfer of British-captured insurgents from British forces to Afghan authorities and third nations (but not the names of the individuals concerned), as part of a project to review compliance with diplomatic assurances, the Group was met with a refusal based on the Data Protection Act. The refusal was particularly unfortunate given that the request was made to further the interests of the individuals on whose behalf the British government was invoking data protection concerns.
Yet more extraordinary was that until the morning of a hearing before the Upper Tribunal the Ministry of Defence was asserting that disclosure could not be made without the ‘explicit consent’ of each individual detainee or former detainee because the information sought was ‘sensitive personal data’ on the ground that it would be possible to infer the religious beliefs of those captured from the information: they would almost certainly be Muslim.
Then there is the case of Mr Rahmatullah. Mr Rahmatullah was captured by British forces in Iraq and handed-over to the Americans before being unlawfully rendered to Bagram airbase detention facility, where he remains. The legal charity Reprieve sought to identify him after it was discovered a British captured detainee was held at Bagram, in order to commence habeas corpus proceedings in the US. But the UK Government refused to provide his name or details because, in the absence of him having given his consent, it would breach his rights under the Data Protection Act. And so he languished in incommunicado detention. Fortunately his identity was eventually worked-out by a combination of luck and good detective work by Reprieve. [1]
Even when cases do get on foot, data protection can rear its head to make rights enforcement more difficult. It is recurring problem in litigation against both public authorities and companies that disclosable material will be redacted on ‘data protection grounds’. Moreover, in Smith [2008] EWHC 694 (Admin), Collins J depreciated the practice of public authorities in inquest proceedings to “routinely redact” the names of “any person” shown in documents which “makes it very difficult and sometimes impossible for interested parties to make preparations to deal with the evidence of a particular witness or to understand how that witness fits in to the whole picture.” He went on to note that such redaction is “taken to absurd lengths” such as by the redaction of correspondence with the family or their representatives.
The reasons for this state of affairs are more complicated than that the data protection laws are too tightly drawn. The problems also stem from the fact that the law itself is Byzantine.
Lawyers are accustomed to experiencing a sinking feeling when data protection rears its head in a case; and the first strategy is usually to try and find a way of not having to address it. The Data Protection Act is one of the most poorly drafted pieces of legislation on the statute book. It has tied the UK Courts up in knots. The consequence of the House of Lords’ judgment in Common Services Agency v IC [2008] UKHL 47, for example, is that the disclosure of information about individuals under the Freedom of Information Act constitutes processing personal data and is prima facie unlawful even if the documents are redacted so that no individual is identifiable from the information disclosed (the reason for this being that the disclosing public authority could—obviously—identify the persons from the disclosed redacted material by matching it up with the original material, which in fairness to the House of Lord is, literally, what the legislation says).
In the All Party Parliamentary Group on Extraordinary Rendition case ([2011] UKUT 153) the Upper Tribunal simply refused to follow the majority of the House of Lords in Common Services Agency on the basis that it just couldn’t possibly be right and it wasn’t absolutely on point. In a subsequent case, the High Court preferred to give such close scrutiny to the leading speech in the House of Lords that it was found to mean precisely the opposite of what it actually says: R (Dept of Health) v IC [2011] EWHC 1430 (Admin). These cases prompt one to reflect that if our highest Courts cannot make head or tail of the data protection laws then the British Government and British Gas ought perhaps to be more lightly censured.
Another problem is that the exceptions permitting processing of personal data are open-textured so that organizations cannot be sure when they are on the right side of the line. Taken together with the risk of criminal sanctions (which always leads to robust corporate compliance) and one has a recipe for irrationality and over-protection.
Let us not forget that data protection laws are supposed to enhance our human rights. They are presented as bulwarks against the surveillance society, by which I mean the ever-greater ability of companies and governments to monitor and analyse information about us.
Such is the status of data protection that the Lisbon Treaty elevated the right of data protection in the EU to the status of treaty right embedded in the EU Charter of Fundamental Rights and Freedoms.
It is thus a perverse effect of data protection laws that they often have opposite effects: negating freedom of information and reducing accountable government.
The EU Commission is currently re-drafting EU data protection laws with the aim of increasing the protection currently afforded to personal data. The restrictions on lawful processing (including disclosure) will become even more tightly framed.
It is proposed to narrow further Article 7(f) of the Data Protection Directive allowing disclosure where “necessary” for the “legitimate the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed” by removing reference to third parties (such as the All Party Parliamentary Group on Extraordinary Rendition or Reprieve). Restrictions are also proposed to the provision allowing processing in the public interest, which will only be lawful where the controller is exercising functions prescribed in legislation (draft Regulation Article 6(1)(e), (f), (3)). The exception relating to disclosure “necessary” to protection the “vital interests” of the data subject is retained but this has been interpreted very narrowly to mean life and death situations such as use of medical records after a life-threatening accident. It is not given any wider compass in the proposals. The upshot will be that work of human rights groups and human rights lawyers working to protect the interests of data subjects will be made even more difficult.
The Information Commissioner has drawn attention to some of these problems in its initial analysis of the Commission’s proposals (February 2012). The IC has stated that the terms of the draft Regulation may, “stand in the way of processing that is desirable, unobjectionable and helpful to citizens.” And the IC has called for “explicit recognition in the Regulation that processing may take place where it is clearly in the data subject’s interests and does not override his or her fundamental rights and freedoms.” It is to be hoped that such well-founded criticisms will be addressed.
In the current climate of concern about the surveillance society it is important to appreciate that the side effects of the over protection of personal data are not confined to farcical exchanges with public utilities companies: data over-protection can undermine the effective protection of human rights.
[1] http://www.reprieve.org.uk/press/2011_06_22_Fox_Hague_Yunus/. Presently the subject of habeas corpus proceedings: R (Rahmatullah) v SSFCA [2012] EWCA Civ 182 on appeal to the Supreme Court. The detective work is described in a witness statement of Clive Stafford-Smith dated 14/04/10
Tagged as Data Protection, Data Protection Regulation
Recent Posts	Merris Amos: The UK and the European Court of Human Rights
Merris Amos: The UK and the European Court of Human Rights wp.me/p1cVqo-Nl 3 days ago
James Hand and Donal Coffey: Miliband’s senate of the regions and a constitutional convention conundrum wp.me/p1cVqo-Nh 4 days ago
Alexander Horne and Richard Kelly: Prerogative Powers and the Fixed-term Parliaments Act wp.me/p1cVqo-Ne 1 week ago
Conor Gearty: On Fantasy Island: British politics, English judges and the European Convention on Human Rights wp.me/p1cVqo-MZ 2 weeks ago