PI calls for review of UK privacy regulator following series of failed judgements

23/04/2009

Privacy International today attacked the UK Information Commissioner's handling of its complaint against Google Street View and called for a 'root and branch' overhaul of the Commissioner's Office by Parliament. The call follows a ten-year succession of failed attempts by Privacy International to encourage the Commissioner to uphold the principles and the spirit of the Data Protection Act and to discard much of the pragmatic reasoning that we believe is undermining privacy rights in Britain.

In its press release today the Information Commission spelled out what Privacy International had long suspected: that the Regulator had taken the decision to abandon principled protections in favour of commercial and technological popularity. ,The Commissioner argues that this is a reasonable stance for a regulator since we are now in the age of "Twitter, Facebook, and Blogs" and cannot turn back the "digital clock". The arbitrary manner in which this position has been taken, in our view, establishes incontrovertibly that the Information Commissioner's Office is not fit for purpose as the guardian of UK privacy rights.

This situation has been brewing over many years. All of Privacy International's complaints to the Information Commissioner's Office (ICO) over the past two years have failed or have been indefinitely suspended. Important issues such as genetic testing, Automated Number Plate Recognition Systems by the police, and fingerprinting in schools and airports have either been overruled or have been subjected to opaque processes that result in the matters being indefinitely shelved. While this appalling disregard for openness and process is a worrying trend across the global regulatory landscape, as an international watchdog we can attest that we have not witnessed degradation to the extent demonstrated by the UK ICO.

While it is true that Privacy International often brings difficult and complex cases to the ICO, it is equally true that the tone of the responses is increasingly defensive and political in nature. We fear that the Commissioner is content to uphold fringe cases of occasional security abuses while allowing new technologies and technologies to cut a vast swathe through privacy. For instance, in their statement today, the ICO stated that "it is not in the public interest to turn the digital clock back. In a world where many people tweet, facebook and blog it is important to take a common sense approach […]."

The ICO has thus made it an official policy to not stand in the way of business interests. This dysfunction extends far beyond the protection of commercial interests. We are left to answer the unsettling question of what deals have been cut in the backroom with the UK Government in the name of this newfound pragmatism.

Privacy International believes that alongside the problem of rampant pragmatism within the ICO, the Office lacks appropriate technological awareness. We believe the Office urgently needs to establish a Technical Advisory Board to help it understand the true scale of threats from new technologies. The ICO clearly does not even understand social networking, as can be seen from the above quotation.

Of equal urgency is the matter of process. If the ICO is to determine public interest and pragmatic reasoning it should publish guidelines to these determinations. It must also demonstrate a greater regard to openness in its dealings with government and commercial organisations.

The Street View case

The Commissioner recently overruled a complaint by Privacy International which argued that Google should have instituted stronger privacy protections and that it should have pursued full notice and consent for its activities. The Commissioner responded on 30th March arguing that Street View did not breach the Data Protection Act and that the service should proceed unhindered.

In response to Privacy International's concerns that the core principles of data protection were being gradually eroded the Commissioner argued that the ruling was based largely on a "pragmatic" approach to privacy.

I would take issue with your view that the ICO has put people at risk of intrusion by taking a pragmatic approach to regulation. We are pragmatic about giving guidance on and enforcing the Act and we would not apologise for that.

Privacy International had disputed parts of the Commissioner's legal analysis, and Privacy International's Director Simon Davies states that "we believe the Commissioner's stance is far too pragmatic in nature and which lack the rigour that is necessary to protect Britain from the encroachment of the surveillance society."

"The Information Commissioner has clearly decided that pragmatism and commercial interest should triumph over principle. This is a dangerous trend and one that is clearly responsible for Britain's appalling surveillance culture. For a regulatory body in any domain to take such an approach would be an abdication of its responsibility; for the statement to be so blatant about their disregard is unforgiveable."

The Commissioner issued a press release on the ruling on 23rd April that reinforced this pragmatic reasoning:

In the same way there is no law against anyone taking pictures of people in the street as long as the person using the camera is not harassing people. Google Street View does not contravene the Data Protection Act and, in any case, it is not in the public interest to turn the digital clock back.

Privacy International condemned this press release as "scurrilous and misleading".

In it, the Commissioner alleges that Privacy international had called for Street View to be shut down. This is incorrect.

Privacy International never based its complaint on a claim that the system should be permanently removed.

The press release said:

The ICO has confirmed to Privacy International that the removal of an entire service of this type would be disproportionate to the relatively small risk of privacy detriment.

The actual complaint asserted:

We accept that these facts constitute a very complex legal challenge but we are confident that the Street View system must be regarded as operating outside the law until such time as these matters are resolved. We urge you to require Google to remove all images until we have achieved clarity on the application of the Data Protection Act and further clarification of the true impact of Google's technology on the rights of individuals.

The overruling of Privacy International's complaint on the basis of commercial interest and the damaging misrepresentation in the Commissioner's press release indicate a systemic dysfunction in the Commissioner's office. Mr Davies continued: "Clearly the Commissioner's Office has lost its way. Any pretence to having an ethical compass for privacy protection has disappeared long ago. It is time for a thorough overhaul of the regulator and his operations. This breach of public faith cannot continue."

"We have all witnessed the global fallout from regulatory failures, even when it is limited to a single jurisdiction. We cannot allow this to happen in the global information economy.

"We challenge the incoming Commissioner to find the courage to defend the legal principle of privacy and thus restore public trust in his office."

Related:
UK Information Commissioner rules against PI in favour of Google Street View
PI files complaint about Google Street View