Big Brother Public Law, Surveillance, and Information Rights 1 Timothy Pitt-Payne QC

Big Brother Public Law, Surveillance, and Information Rights 1 Timothy Pitt-Payne QC 1. Concerns about state surveillance, and about the potential for abuse of modern information technology, go back to the origins of data protection legislation: appropriately enough, the first UK Data Protection Act was passed in 1984. Going further back in time, the mid-20 th century European version of state surveillance (in its fascist or communist incarnations) did not depend on computer technology so much as on a wide network of informers, combined with excellent paper filing systems. 2. In the UK, concerns about state surveillance surfaced once again as a live political issue during the 2005-2010 Labour Government. There were a number of reasons for this. The Information Commissioner, drawing attention to such phenomena as the widespread use of CCTV cameras, asked whether we were sleepwalking into a surveillance society. The 2007 HMRC data debacle drew attention to the volume of information held by central Government, the ease with which it could be stored or transmitted, and the potential for accidental loss and the associated compromising of individual data security. The Government s predilection for creating large databases of personal information (e.g. in relation to child protection or employment monitoring) became increasingly controversial. 3. In the Coalition era which is also the Leveson era the focus of concern has to some extent switched to private sector monitoring and surveillance: blagging, phone hacking, and the other media dark arts. More generally, as Ben Hooper s paper demonstrates, we now regard surveillance as being as much a private sector as a public sector phenomenon. For many people Big Brother now calls to mind, not an Orwellian dystopia, but the consensual surveillance of participants in a reality TV show. 4. Nevertheless, the Snowden revelations have now put public sector surveillance firmly back on the agenda. It is timely therefore to look at the various legal tools available to control the way in which the public sector collects, uses and disseminates personal information. These involve a mix of data protection legislation, the European Convention on Human Rights (including Article 8), and judicial review principles. 5. In a paper of this length I have to be selective, and so I focus on four specific areas: 1 I have drawn in this paper on material written by my colleague Anya Proops for the Panopticon blog I am grateful to her for this material. 1

the use of data protection enforcement in relation to public sector surveillance; the collection and dissemination of information about criminal records, and about associated information (sometimes called soft intelligence ); Article 8 challenges to the use of information for policing purposes; and The legal response to the Snowden revelations. Data protection enforcement and public sector surveillance 6. The remedial structure set up by the Data Protection Act 1998 ( DPA ) includes both regulatory and private sector enforcement. Individuals can go to Court to enforce their subject access rights (DPA section 7) or to claim damages for breach of the DPA (DPA section 13). The Information Commissioner s office ( ICO ) can carry out assessments, serve enforcement notices, and (now) impose monetary penalties for serious breaches of the Act. 7. The power to serve monetary penalty notices is not confined to data security breaches, although so far the vast majority of cases where the ICO has imposed penalties have been on this basis. In principle there is no reason why surveillance, if carried out in serious breach of the DPA (and subject to satisfying the various conditions in DPA section 55A) should not lead to a monetary penalty. 8. What about the power to serve enforcement notices? This is a powerful regulatory tool: it requires data controllers to take specific action, backed by the threat of criminal sanctions for non-compliance. The power has however been sparingly used: in many cases the ICO has preferred to accept (nonstatutory) undertakings from delinquent data controllers, rather than moving to the enforcement stage. 9. Nevertheless, the case of Southampton City Council v ICO EA/2012/0171 illustrates the scope for enforcement notices to be used as a way of controlling public sector surveillance. The case concerned a policy adopted by the Council whereby taxis licensed by the Council were required to carry equipment for the continuous visual and audio recording of what happened inside the vehicle. The records were stored on an encrypted hard drive held in the vehicle itself, and could only be accessed by a small number of designated Council staff. The circumstances in which they would be accessed were limited (primarily, to situations where complaints were made against drivers); if the records were not retrieved and used, they would in due course be overwritten by subsequent recordings. 10. The case raises an interesting issue about the extent to which the recording and storage of information should be seen as giving rise to privacy concerns, regardless of whether anyone actually access and views (or hears) the information in question. 2

11. The Council s policy could have been challenged by way of judicial review. That would have required an individual or group to incur the costs and risks of litigation (including the risk of an adverse costs order if litigation failed). Instead of judicial review, what happened was that the ICO served an enforcement notice under the DPA requiring the Council to abandon its policy. The ICO s concern was directed to the audio element of the recording, which it regarded as particularly intrusive, and to the always on nature of the recording. If the audio recording had been triggered by a panic button, for instance, then the ICO might well have taken a different view. 12. On the Council s appeal against the enforcement notice, the First-tier Tribunal upheld the notice. The Tribunal considered that the breadth of the surveillance carried out under the Council s policy was disproportionate, and in breach of the first data protection principle: the marginal benefit to public safety from the use of always on audio recording did not justify the serious interference with individual privacy. Criminal records and soft intelligence The approach to criminal records information 13. The whole area of criminal records information has been beset by competing policy considerations. There are three different factors in play: the desire of the State to maintain a comprehensive and reliable record of criminal convictions; the public interest in the rehabilitation of ex-offenders; and the desire to protect specific groups (notably children and vulnerable adults) from harm at the hands of those who work with them. 14. The Rehabilitation of Offenders Act 1974 creates a category of spent convictions, which are shielded against disclosure. The default setting under that Act is that prospective employees cannot be asked about their spent convictions, and that a spent conviction is not a proper ground for refusing or terminating employment (though, even 40 years on, the exact legal significance of this remains opaque). However, SI 1975/1023 ( the 1975 Exceptions Order ) creates a wide range of circumstances in which prospective employers are allowed to ask about spent convictions. Over the years, the exceptions have widened in scope, to a point where many have queried whether they fundamentally undermined the policy of the 1974 Act. 15. The Act is problematic in other ways: it has been stigmatised as creating a right to lie for ex-offenders; and there is as yet no effective solution to the widespread online availability of information about spent convictions. 16. The system of CRB disclosures (now known as DBS disclosures) under Part V of the 1997 Act is a further departure from the policy behind the 1974 Act. Prospective employers who are allowed to ask about spent convictions (under the 1975 Exceptions Order) are also able to verify the answers given, by obtaining a standard or enhanced CRB certificate that shows all convictions, whether spent or unspent. In prescribed cases (primarily involving those working with children or vulnerable adults) employers can 3

also obtain access to soft intelligence : additional non-conviction information included at the discretion of the police. This can include, for instance, information about acquittals, or about allegations that had never led to a criminal trial. Disclosure of criminal convictions 17. CRB disclosure of information about past convictions is linked to information held on the Police National Computer (PNC). Under the Police Act 1997 (in its pre-2013 version: see further below), any conviction information held on the PNC would be disclosable by way of standard or enhanced CRB check, however old or minor the conviction might be. 18. One way of mitigating the effect of these provisions would be is if there is some process for removing minor or old convictions from the PNC itself. At one point it appeared that the Data Protection Act 1998 might provide a basis for imposing such a mechanism, but this possibility was dispelled by the decision of the Court of Appeal in Chief Constable of Humberside v Information Commissioner [2009] EWCA Civ 1079. 19. The background to the Humberside case was that the police had adopted an approach whereby convictions would be deleted from the PNC only in very exceptional circumstances. This approach was set out in guidelines issued in 2006. However, in certain circumstances convictions would be stepped down from the PNC (i.e. not made available to non-police users of the PNC). Under the guidelines, where conviction information was stepped down from the PNC it would be treated in the same way as police intelligence (i.e. non-conviction information): so it would potentially be included in an enhanced (but not a standard) disclosure, subject to a relevance test. 20. In five cases (involving old and/or minor criminal convictions) the ICO served enforcement notices on Chief Constables, as the data controllers for their own forces, requiring the deletion of the convictions from the PNC: the material was to be stepped out (deleted altogether), not merely stepped down. The basis of the enforcement action was that the retention of this information contravened the third and fifth data protection principles: the information was excessive by reference to the purposes for which it was held, and/or had been kept for longer than necessary. The Chief Constables appealed unsuccessfully to the Information Tribunal, but on further appeal to the Court of Appeal they succeeded in having the enforcement notices set aside. 21. The Court of Appeal considered that the purposes for which the information was held included the provision, where necessary, of a record of criminal convictions to the courts (for sentencing purposes, or in contexts where evidence about the previous convictions of a defendant or a witness was admissible). It was important that any such record should be as full as possible. Moreover, the police themselves considered that the information was potentially of value for operational policing purposes, and the ICO ought not to second-guess that judgment unless it was irrational. For both reasons, the Information Commissioner was not entitled to hold that the 4

retention of these convictions on the PNC breached the Data Protection Act 1998. 22. The Court of Appeal judgment explained that on a proper understanding of the legislation, stepped down convictions would need to be included in standard or enhanced CRB certificates. Following this case the police suspended the step-down approach in relation to the provision of conviction information to the CRB. Instead they adopted an approach whereby any conviction information retained on the PNC would be provided to the CRB for inclusion in a standard or enhanced CRB disclosure. 23. The next major legal challenge came with the T case, where the remedy sought was a declaration that the CRB disclosure system was incompatible with Article 8 of the Convention. In (T & others) v Chief Constable of Greater Manchester & others [2013] EWCA Civ 25, the Court of Appeal declared that Part V of the 1997 Act was incompatible with Article 8 of the Convention; and that the 1975 Exceptions Order was also incompatible, and hence was ultra vires. 24. In response to the decision the Government made significant changes to the 1997 Act and the 1975 Order, by secondary legislation, with effect from 29 th May 2013. In effect the changes introduce a filtering system, whereby certain convictions and cautions are protected from disclosure under the 1997 Act and cannot be the subject of questioning under the 1975 Order. 25. Nevertheless, an appeal was pursued to the Supreme Court against the Court of Appeal s decision. It was heard in December 2013, and judgment is awaited. The approach to soft intelligence 26. There is a separate set of problems about the disclosure of soft intelligence (non-conviction information) via enhanced CRB disclosures. Most fundamentally, there is a major incursion on the presumption of innocence if allegations that have not led to a conviction (or in many cases even to a trial) are nevertheless disclosed to a prospective employer from police records. In practical terms, from the point of view of the prospective employer the difficulty is that there will often be no good way of evaluating or assessing the material. The employer is in no position to assess the credibility of any allegation, or to form its own view as to what would have happened if the allegation had been tested at trial. Inevitably, the temptation will be simply to reject any candidate who has adverse information on their CRB check. From the individual s point of view, they can find themselves in a most invidious position, whereby they have no means of clearing they name once an allegation has been made, recorded in police records, and 5

included in a CRB check. Although there is a procedure for complaints to the CRB, it is intended to deal with cases of factual error (e.g. where the information included relates to a different person) rather than to challenge the police decision to include the information on the form. 27. There have been various attempts by way of judicial review to challenge police decision-making about whether particular items of non-conviction information should be included in CRB certificates. These have met with mixed success. 28. In X v Chief Constable of the West Midlands Police [2004] EWCA Civ 1068 the Court of Appeal emphasised the wide scope of the police discretion. The question was whether, in the relevant chief officer s opinion, the information might be relevant and ought to be included 2. The Court considered that the exercise of this discretion could be challenged only in very limited circumstances. 29. However, the Supreme Court took a rather different approach in the important case of L v Metropolitan Police Commissioner [2009] UKSC 3. The case emphasises that a decision to disclose non-conviction information is likely to engage the individual s right to respect for private life under article 8. In determining whether any interference is justified, the importance of protecting that right should be balanced against any relevant social need (e.g. considerations of child protection), but with no prior assumption that either privacy rights or child protection must take precedence in all cases 3. In cases of doubt, the applicant should have the opportunity to make representations as to whether the information should be disclosed. The approach taken in the West Midlands case gave insufficient weight to the need to protect the applicant s right to respect for private life. 30. Subsequently the Protection of Freedoms Act 2012 modified the circumstances in which soft intelligence would be made available, tightening the criteria for the exercise of police discretion in favour of disclosure. 31. There have been a number of subsequent cases challenging decisions to disclose soft intelligence in the context of CRB or DBS disclosures. 32. In R (L) v Chief Constable of Cumbria Constabulary [2013] EWHC 869 (Admin), the allegations against the individual (a teacher) never reached the stage of a criminal prosecution. In RK v (1) Chief Constable of South Yorkshire (2) Disclosure and Banning Service [2013] EWHC 1555 (Admin), the individual (again, a teacher) was acquitted following a criminal trial. In both cases, the court held that the inclusion in the relevant enhanced disclosure of information relating to the allegations was unlawful, as constituting an unjustified interference with the teacher s Article 8 rights. A key feature of both of these judgments is that, in the Court s view, the police had acted unlawfully by effectively suggesting that the allegations had been well-founded, despite the lack of any criminal conviction. 33. Does that mean that it will always be unlawful to disclose information about criminal allegations where those allegations have not culminated in a conviction? The recent judgment of the High Court in the case of R(AR) v 2 See Police Act 1997 section 115(7), as it stood at the time of the West Midlands case. 3 See judgment at 45, 81-82 6

Chief Constable of Greater Manchester Police & Secretary of State for the Home Department (Case No: CO/13845/2012) indicates that the answer to that question is no. 34. In AR, an individual who had previously worked as a taxi driver had been accused of raping a particular passenger. He had been acquitted following a criminal trial taking place in January 2011. In March 2012, the CRB issued an enhanced certificate in connection with an application made by AR for a licence as a private-hire driver. The certificate made reference to the allegation of rape as against AR. It also confirmed that he had been acquitted following a trial before the Crown Court. AR sought a judicial review in connection with that certificate on the basis that it breached his Article 8 right to privacy. The High Court held that the certificate was unimpeachable, since: (a) the certificate was itself a fairly balanced document; (b) this was a case where the Chief Constable had properly recognised that, whilst the allegations against AR had not been proved to the criminal standard, there was sufficient evidence to suggest that they may yet be well founded; and (c) it was reasonable and proportionate to include the allegations in the certificate given the risk posed to vulnerable passengers if AR had in fact committed the crimes alleged against him. 35. The court also rejected arguments to the effect that the police s retention of the data was unlawful under Article 8 and, further, that the police had acted unlawfully by not consulting AR prior to including the information in the ECRC. So far as data retention was concerned, the court held that the police had legitimate reasons for retaining the data both because it may be relevant if further allegations were made against AR and also because other matters could arise involving the complainant. On the procedural challenge relating to the lack of consultation, the court held that this was not well founded both because AR had had an opportunity to put his case in the context of an earlier comparable ECRC and because the police had in any event anticipated all the substantive arguments AR might have wanted to make. Article 8 and the use of information for policing purposes 36. In Catt v ACPO and others; T v Commissioner of Police of the Metropolis and another [2013] EWCA Civ 192, the Court of Appeal considered two appeals regarding the powers of the police to collect and retain personal information about members of the public. Both cases turned on the application of Article 8 of the Convention; in both, the Court held that there had been an interference with the Article 8(1) right to respect for private life, and that the interference was not justified under Article 8(2). 37. The first appeal concerned Mr. John Catt, described in the judgment of the Court as someone who over a long lifetime has been an ardent and frequent protestor against what he sees as a variety of forms of injustice. He had attended public demonstrations organised by Smash EDO, a group campaigning against a weapons manufacturer operating on the outskirts of Brighton. Some of the core supporters of Smash EDO were prone to violence and criminal behaviour, but Mr. Catt had not been convicted of 7

criminal conduct of any kind in connection with any demonstration that he had attended. Personal information about Mr. Catt was held on the National Domestic Extremism Database, mostly consisting of reports by police officers attending Smash EDO demonstrations. Mr. Catt had not been the specific target of observations, but was referred to incidentally in descriptions of what the police at the scene had observed. It appeared that this information was to be retained indefinitely. 38. In judicial review proceedings, Mr. Catt contended that the continued retention of this information about him constituted an unjustified interference with his Article 8 rights. His claim was rejected by the Divisional Court. 39. The second appellant, referred to as Ms T, was served with a police warning letter following an allegation that she had directed a single homophobic insult against the friend of a neighbour. She denied the allegation; in judicial review proceedings based on an alleged infringement of her Article 8 rights, she sought an order that the police should destroy their copy of the warning letter and remove from their records all references to the decision to serve it. Again, her claim failed at first instance. Before the appeal hearing the police reviewed the information and decided to expunge it, but the Court of Appeal nevertheless heard and determined the appeal because of the importance of the issues raised. 40. The judgment in Catt begins with a survey of recent developments in relation to Article 8. This part of the judgment is likely to become an important reference point in any future cases about the retention and use of police information. 41. As to the circumstances in which there would be an interference with the Article 8(1) right, the Court began by referring to the observation of Lord Nicholls in Campbell v MGN Ltd [2004] UKHL 22, that the touchstone of private life is whether in respect of the disclosed facts the person in question had a reasonable expectation of privacy. However, recent cases showed that the position was more complex. Even information of a public nature could become private over the course of time, as memories faded. Moreover, the storage and use of personal information gathered from open sources could nevertheless involve an interference with private life. 42. In relation to justification under Article 8(2), the Court reiterated the three well-known requirements that the conduct in question must be in accordance with the law; carried out in pursuit of a legitimate aim; and proportionate to the aim sought to be achieved. The issue of legitimate aim did not cause any difficulty in the present cases: the police were acting to prevent disorder and crime, and protect the rights and freedoms of others. In cases about the collection and retention of personal information about private individuals, the issues of legality and proportionality were closely related. As to proportionality, the overriding principle was that there should be a fair balance between the personal interest of the claimant in maintaining respect for his public life, and the pursuit of a legitimate aim in the interests of the public at large. The Court needed to pay careful attention to the nature of the information in question, the circumstances in which it could be obtained, the ways in which it could be processed and by whom, the period of retention, and the arrangements for its destruction. 8

43. Applying these principles to Mr. Catt s case, the first issue was whether there was any interference with his right under Article 8(1). The Divisional Court had held that there was not: none of those attending the Smash EDO demonstrations can have had a reasonable expectation of privacy, since it was of the essence of such activity that it was of a public nature. The Court of Appeal took a different approach, focusing on the collection and retention of data about Mr. Catt rather than on the public nature of his activities at the demonstrations themselves. The processing and retention of even publicly available information could constitute a interference with Article 8 rights, especially when the information was subjected to systematic processing and entered on a database that was searchable by reference to specific individuals. 44. Turning to the issue of justification under Article 8(2), the Court focused on the issue of proportionality. It accepted that the police needed to obtain a better understanding of how Smash EDO was organised, so as to anticipate its future conduct and tactics. However, the Court did not consider that the information held about Mr. Catt was of sufficient value to justify its retention. It commented that the police appeared to be recording the names of any persons they could identify at Smash EDO demonstrations, regardless of the nature of their participation. The retention of Mr. Catt s information on the database was therefore an unjustified interference with his Article 8 rights, and hence was unlawful. 45. As to the second case, that of Ms T, the Court held that the action of the police in issuing the warning letter did not in itself amount to an interference with her Article 8(1) rights, but that the retention in police records of a copy of the letter, and information describing the circumstances in which it had been issued, did constitute an interference. While the retention of this information for a short period was justified, it was hard to see how retention for more than a year or so could be of any value. If the information had not been destroyed before the appeal hearing, then its continued retention woud have been disproportionate. 46. The message from both cases is that, even where events take place in public, the recording and retention of information about them can interfere with the right to respect for private life. The Court is especially concerned with the sitation where information is retained indefinitely on databases where it is searchable by reference to individual names. In relation to justification, the cases suggest that the Court will scrutinise closely both the precise nature of the information retained, and its value for policing purposes. The analysis in Catt will be an essential starting- O Tempora! O mores! Snowden and beyond 47. In June 2013 the existence of an extensive intelligence gathering programme operated by the US National Security Agency ( NSA ) was revealed in the press, following disclosures made by Edward Snowden, a former NSA systems administrator. Subsequently, a number of claimants including Privacy International brought claims in the Investigatory Powers Tribunal 9

( IPT ) relating to alleged co-operation by the UK authorities in the NSA s surveillance programme. 48. Privacy International has chosen to make its pleadings available online, and the document gives an invaluable insight into the legal issues to which mass state surveillance gives rise, and the bases of challenge that are available. The challenge comprises two grounds: A challenge to the conduct of UK authorities in obtaining from the NSA information obtained by intercepting the communications of non-us nationals as they pass through fibre optic cables and electronic infrastructure in the US. A separate challenge to the conduct of those authorities in themselves intercepting electronic data on fibre optic cables leaving the UK, and the sharing of that data with US authorities. 49. In relation to the first ground of challenge, the argument is that none of the controls in the Regulation of Investigatory Powers Act 2000 ( RIPA ) will apply where communications are intercepted in the US and then information is passed to US authorities. However, the receipt of this information by the UK authorities is said to involve an interference with Convention rights under both Article 8 and Article 10. The absence of a sufficiently clear legal regime governing that inference means that it cannot be justified under Article 8(2) or 10(2), since: (i) it cannot be said to be prescribed by law ; and (ii) the absence of a sufficiently clear legal regime makes it unclear whether the interference is necessary in a democractic society or pursues a legitimate aim. 50. As to the second ground, this relates to an operation known as Tempora under which GCHQ has allegedly intercepted fibre optic cables landing in the UK. This has apparently been authorised by warrants issued pursuant to RIPA section 8(4). What is argued for Privacy International is that the blanket and disproportionate nature of the data collection means that it involves a violation of (inter alia) Article 8 of the Convention. Timothy Pitt-Payne QC March 2014 10