Examination of Witnesses (Questions 780
- 799)
TUESDAY 15 JUNE 2004
DR CHRIS
POUNDER AND
MS CLAIRE
MCNAB
Q780 David Winnick: Have you had
a response?
Dr Pounder: No.
Q781 David Winnick: I do not suppose
you are the only one. I dare say the Home Office is not in a position
to respond to all organisations but I am not their spokesperson.
You suggest, Dr Pounder, that the register should not contain
audit trails of ID card use that can be accessed, in secret, by
the security services and the police in order to identify the
services used by citizens, but I suppose the question is, bearing
in mind the acute terrorist threat that I assume you accept is
always present now, why should the security services in a democracy
not have that information?
Dr Pounder: I have no difficulty
with the concept of an audit trail but in the original consultation
document, Entitlement Cards and Identity Fraud, the Government
at the end said: "It is most unlikely the entitlement information
relating to specific services will be held on a central register."
It then went on to say back in question 3.29 of this entitlement
document: "However, the Government would want to see a full
debate and want to seek views as to the safeguards on access to
the register, for example whether access to the database in these
circumstances should be governed by warrant applied on a case-by-case
basis." The point I am making is the data sharing agenda
was not in the consultation document and the access by the security
services to an audit trail was not in the consultation document
and the protection of privacy measures mentioned in the consultation
have disappeared.
Q782 David Winnick: Even though it
was not, I am putting it very bluntly, Dr Pounder, to be the devil's
advocate, it would be argued that we are faced, as you have more
or less accepted, by an acute terrorist threat. Should the security
services regard it as a weapon and the Home Office consultation
document include such information if it is in the overall national
interest?
Dr Pounder: If access is necessary
for safeguarding natural security I have no difficulty with that
concept. But the sense I get is that the Government are `piggy-backing'
on the back of certain elements of public acceptability of an
ID card a comprehensive data sharing agenda which has not been
fully subjected to public scrutiny, consultation and debate.
Q783 David Winnick: I think that
is putting it very clearly and obviously the Committee will note
your views on that. Dr Pounder, you are concerned that subsection
9 of Schedule 1 opens the door for unrecorded access by the authorities—in
a sense it links up to my previous questions—to information
on the register. You would like to see this amended?
Dr Pounder: I think the "may"
has to be a "must" if you are going to go down the agenda
of having an audit trail. If you look at the Data Protection Act
and the police and security services can have access to data subject
to a test of prejudice, for instance, the prevention and detection
of crime, prosecution, apprehension of offenders or necessary
for safeguarding national security. In the ID Card Bill we have
this phrase "in connection with" so I would like to
see that tightened up on the lines of the Data Protection Act.
Q784 David Winnick: My colleagues
will have quite a number of questions to you but you talked about
the government piggy-backing on various problems—to put
words into your mouth, I suppose—using the ID card as an
excuse to bring such a concept around. Do you have any objections
in principle, with all the reservations that you obviously have,
to having an identity card?
Dr Pounder: So long as it is with
a database that minimises the subject to proper scrutiny I do
not think I personally would have any difficulty.
David Winnick: Thank you very much. Mrs
Curtis-Thomas?
Q785 Mrs Curtis-Thomas: Dr Pounder,
you have called for a new right of privacy, possibly enshrined
in the Sixth Principle of the Data Protection Act, but you also
recommend consultation before this is implemented. In the meantime
what changes would you like to see in the Bill that is before
us?
Dr Pounder: In relation to scrutiny
if you are looking for a regulatory system that is going to provide
checks and balances I would like to see checks and balances reported
to Parliament, in particular the ID Card Commissioner. However,
I do venture to suggest that in relation to statutory instruments,
certainly of this particular nature, Parliament itself could be
a bit more rigorous in the scrutiny of such legislation. At the
moment we have the Joint Committee on Delegated Powers, which
basically says that powers sought by Ministers will be wide and
the Select Committee on Statutory Instruments which basically
says that the instrument itself is either lawful or not. It would
be useful in strengthening the position of the protection of the
individual if Parliament could in fact strengthen its scrutiny
in relation to statutory instruments. I understand that Sir Nicholas
Winterton is looking at that in the Procedure Committee.
Q786 Mrs Curtis-Thomas: So if you
had that there is no need for the Privacy Bill then, that addresses
it?
Dr Pounder: No, I think the privacy
amendment is necessary in the meantime. Looking at the way Parliament
covers statutory instruments is important.
Q787 Mrs Curtis-Thomas: That would
not suffice in the long term?
Dr Pounder: That would not suffice,
not in the long term. There is a structural problem when dealing
with privacy. Privacy goes across all government departments and
what you find is that the Minister for Children says, "We
will take this slice of privacy and then we will get the Children's
Bill in," and the ID card minister says, "We will get
the ID Card Bill going effectively," and nobody is looking
at the privacy in a sense which essentially goes across the board.
Each minister has their own departmental brief. Quite clearly
if I am responsible for the police and security services, if I
were Home Secretary, then their concerns would have my uppermost
attention as to making sure that I delivered what they wanted
to do their job effectively. There is no, looking at privacy in
general across the board. That essentially is the structural weakness
in privacy protection because as soon as Ministers announce statutory
regulations or use statutory powers in relation to the use of
personal data the protection in the Data Protection Act largely
disappears.
Q788 Mrs Curtis-Thomas: Okay. You
argue in your submission that the ID scheme would be, in effect,
exempted from the Data Protection Act. In your view, is it necessary
to have a complete redraft of the purposes of the Bill, as set
out in clause 1, or could there be a simpler fix such as our doing
an explicit mention of the primacy of the Data Protection Act?
Dr Pounder: I do not think that
works. If we could look at the experience of the Community Charge
as this illustrates the issue. In Scotland, the Community Charge
from back in the 1980s was contained in a statutory instrument
and that required individuals to provide certain personal information.
In the English version of the Community Charge you did not have
that statutory regulation so when English CCROs used the Scottish
forms they were in breach of the Data Protection Act in relation
to the collection of excessive information. The reason why the
Scottish provision was basically okay data protection-wise was
because there was statutory provision. The reason why I am talking
about the Sixth Principle is that the main impact on regulation
or statutory provision is in relation to the first five principles.
If you amend the Sixth principle to require public authorities
to process personal data in accordance with respecting the private
life of individuals, ie the Article 8 requirement in human rights
terms, then what you give the Information Commissioner is leverage
and enforcement powers in relation to the question of proportionality.
Q789 David Winnick: We had the Information
Commissioner here last week, as you may know. He was very frank
on certain points. You may wish to read his evidence.
Dr Pounder: He expressed the same
concerns that I have. I think "unprecedented" was the
word he used to describe the scheme, if I remember rightly.
Q790 David Winnick: You must have
been in touch with him.
Dr Pounder: Not to discuss my
evidence.
Q791 Mrs Curtis-Thomas: You argue
that the only data needed to support an identity/entitlement card
scheme are a photograph and the name, national identity number
and the biometric details of the individual, but surely the aim
of the ID card scheme is not just to identify individuals but
to identify them for specific purposes which is why local authorities,
for example, need addresses. Does not your purist approach undermine
the basic purposes of this scheme?
Dr Pounder: If you take the Government's
consultation document it says it is to establish identity and
entitlement for services—that is what the Government says—but
you do not need an address to establish entitlement for services
you just need to know who you are, whether you are resident in
the UK and whether you are paying your taxes.
Q792 Mrs Curtis-Thomas: I would argue
that you do need somebody's address otherwise how do you establish
the fact of residence in the UK?
Dr Pounder: You would need somebody's
address if you are going to deliver services to that address.
Q793 Mrs Curtis-Thomas: Yes you do,
do you not, such as social services, for instance, you would need
an address?
Dr Pounder: If you were going
to deliver services to that address but that is different from
establishing identity and entitlement to services. Entitlement
to services: if you want service X are you eligible? Delivery
of service may require the address and this is what the data sharing
agenda is about. Data sharing is about delivery of services, not
the entitlement to services. In entitlement to services and establishing
identity I think is a bit narrower.
Q794 Mrs Curtis-Thomas: And it would
be restricted to what?
Dr Pounder: I am not recommending
it is restricted to anything. What the Government's consultation
documents say is that we propose a system which is limited to
checking identity entitlement. That is what the Government has
put to the British public. When you look at the Bill, it is a
different Bill; it is all about data sharing in order to pursue
service delivery. That is the issue. The question I would ask
of you, and this might be a useful recommendation to make, is
that if the Government wants earnestly a data sharing linkage
agenda they should put a public consultation document out. After
all, ID cards are going to be five, six or seven years down the
road, so there is time to do this. The other important thing is
you have had witnesses who have said, "Look, we need the
specification of the system fully declared before we go."
You need to know the extent of the data sharing and linkages before
you create the systems, I suspect. That is all I am saying.
Q795 Mrs Curtis-Thomas: Yes, so we
have got other cards. In fact, we visited Sweden and Germany to
talk to them about their identity card scheme and how it works
and they did not have any problem there and no complaints about
people giving their addresses. Why not there then?
Dr Pounder: Sweden is a difficult
situation because basically tax records are public documents and
I think there are significant cultural differences there. However,
with the German system, all I can say is I have tried to get some
information for the Committee but I have been unsuccessful. The
only bit I have got is these two lines on the web site and what
it says is: "Does the Bundesdruckerei have a central archive
containing personal data?" "Answer: No, data protection
regulations prohibit the centralised storage of personal data.
Such data may only be stored locally at citizens' registration
offices. Once a document is completed at the Bundesdruckerei [the
central one] all personal data is deleted or destroyed."
So I think you are comparing different things when you compare
what the Government proposes with what the Swedes and Germans
do.
Q796 Mrs Curtis-Thomas: I am just
trying to remember what were on those cards and I cannot. Right,
thank you very much, Dr Pounder. Ms McNab, these questions are
for you. You are concerned by the possibility that the physical
characteristics recorded on the register may go wider than biometric
information. Why does this pose particular hazards for trans people
and what safeguards would you like to see in the Bill?
Ms McNab: Thank you for the question.
There are several ways of approaching this one. The first question
is what physical and/or biometric information may be recorded.
As I understand it, if we were to take one concept of biometric
information as something which may or may not be physically visible
which can be used to uniquely identify a person, some such information
may be gender specific in its nature. For example, I think we
could all understand that DNA information, if that were to be
the proposed technology, can be readily used to identify the physical
sex of the person concerned. For trans people that obviously poses
a particular hazard in that we do not necessarily have chromosomes
which match the sex in which we live our lives, so there becomes
an immediate risk to breach of privacy if that information comes
out. The technologies which the Government is looking at at the
moment, I understand, are focused on finger printing, facial profiling
and iris scanning with, as I understand it, facial profiling not
a strong candidate at the moment. The question that we look at
in that comes down to two points. The first is whether the raw
information that is stored is disclosed. As I understand it, the
intention is that information should not be disclosed, that the
verification mechanism will rely upon the person conducting the
assessment to relay: "We have found this; does this match
with what you have stored?" While that protects against release
of information that is held on the central data if the verification
mechanism is working properly the information does therefore in
some form end up in the possession of the person who is requesting
the check, so there is a question of the security of the information
at that point. One is creating a situation where sensitive information
may be held as part of the verification mechanism. We then encounter
a further problem of what happens when these validation procedures
are used. I have no expertise in this area but from what I have
been able to determine from talking to those who have and from
discussions with the Home Office and reading elsewhere we cannot
expect validation procedures to offer a binary yes/no answer.
They will offer rankings of probability, in so far as I understand
the situation, so they will say, for example, that the finger
print that they have tested offers a 99.9% certainty that the
person presenting is indeed Claire McNab, but we may in some of
these technologies be dealing with very complex situations of
these machines being deployed quite widely. There will have to
be a balance in their usage between the degree of certainty required
to create an exact match and the degree of certainty acceptable
to avoid creating a whole lot of false negatives. If we are looking
at a situation where, for example, a significant number of these
tests might be revealing an answer of, say, a 90% probability
or a 50% probability, something significantly down from 100%,
then we are looking at a situation where there would need to be
further matching of the data done. I can see various ways in which
that could go. I think the most likely situation is going to be
something akin to the sort of process that happens in the processing
of credit cards where when there are grounds for suspicion you
ask for a special code authorisation and various further questions
are asked. If we are trans people this becomes particularly hazardous
because we are dealing with a situation where the primary reason
for the enquiry at that point is that the physiological matching
has not worked. There is a problem here about the physiology of
the person presenting. The sorts of questions that you might otherwise
be asked, if you were trying to receive verification of checks
on me, and I was sitting in front of you, is whether this is a
woman sitting in front of you. Faced with those checks in that
situation I can see that it might be possible you would say, "I
think so, probably, but . . ." and one is in a situation
where the fact of whatever incongruencies there might be in somebody's
gender presentation starts to be problematised as one of the aspects
of the verification.
Q797 Mrs Curtis-Thomas: If I read
you correctly, the biometrics as they stand, the proposals as
they stand are not a significant problem to trans people, although
DNA matching might be, and you lack confidence in the verification
procedure because you have anticipated that there may be a situation
where the verification requires further questioning and that could
compromise your privacy and trans people might have to declare
their gender. Is that it?
Ms McNab: It is except that I
would qualify the first bit a little further in that I know very
little and there seems to be little available on the details of
how iris profiling and the other technologies being examined at
this stage would work in terms of gender markers within them.
We have very little information on that.
Q798 Mrs Curtis-Thomas: If you had
reassurances about that that would help enormously?
Ms McNab: It would help enormously,
but I think we need to consider the possibility that there may
be future technologies deployed in the biometrics sphere and to
ensure that there is similar scrutiny of those as they arise in
future.
Q799 Mrs Curtis-Thomas: Alright.
Finally from me, you want ID cards to record gender by social
role rather than by legal status. It sounds like an absolute minefield
to me. What language would you like to see in the Bill to record
this desire?
Ms McNab: I think simply saying
social gender would be the most acceptable thing. This may sound
like a bizarre legal concept to those who have not had the misfortune
to familiarise themselves with the way the law is working in this
area already, but driving licences and passports have been for
several decades now issued to trans people in accordance with
the gender in which they live their lives, subject to a minimal
verification processes of essentially self-declaration with some
medical support.
| 
