Select Committee on Home Affairs Written Evidence


Memorandum submitted by Liberty


  Liberty (The National Council for Civil Liberties) is one of the UK's leading civil liberties and human rights organisations. Liberty works to promote human rights and protect civil liberties through a combination of test case litigation, lobbying, campaigning and research.


  Liberty provides policy responses to Government consultations on all issues which have implications for human rights and civil liberties. We also submit evidence to Select Committees, Inquiries and other policy fora, and undertake independent, funded research.

  Liberty's policy papers are available at


  1.  In November 2006 the Information Commissioner Richard Thomas said "Two years ago I warned that we were in danger of sleepwalking into a surveillance society. Today I fear that we are in fact waking up to a surveillance society that is already all around us. His words came at the time A Report on the Surveillance Society[168] was published. Liberty agrees with the assessment made by the Information Commissioner. We also accept that surveillance is an unavoidable, and often justified, aspect of life in the early 21st century. However, the extent to which every person in the UK is subjected to surveillance, has increased disproportionately to any justifying social need or benefit. We are pleased that the Home Affairs Committee is calling for evidence at this time. However, a word limit of 2,500 precludes any detailed examination of an extremely complex subject. Liberty will be publishing a substantive work on surveillance and privacy over the summer which will cover in far greater detail some of the issues touched on here.

  2.  It is useful to clarify what types of activity might be considered "surveillance". "Mass informational surveillance" relates to the retention and dissemination of database information. This would cover databases such as the National Identity Register (NIR), created by the Identity Card Act 2006 (IDCA) and the children's index set up by the Children Act 2004. "Mass Visual Surveillance" relates to the use of CCTV cameras. "Targeted Surveillance" refers to the use of intrusive powers such as communication interception by means of the framework created under the Regulation of Investigatory Powers Act 2000 (RIPA). The central distinction between these types of surveillance is that targeted surveillance is commonly used as part of an intelligence led investigation into illegal or unlawful activity. Mass visual and informational surveillance does not take place in anticipation of a specific investigation into impropriety but will often be claimed to have some crime detection or (in the case of CCTV) crime prevention purpose. Information is retained and disseminated in anticipation of being of use for investigation. Mass informational surveillance will also take place for purpose unrelated to investigation such as assisting access to public services. Mass and targeted surveillance techniques have usually been distinct. However, in the last few years this distinction has been blurred by increasing use of "data matching" and "data mining" processes. These techniques are based on the use of automated processes which analyse or match seemingly innocuous data in order to throw up anomalies or inconsistencies. When used in relation to information about people this is more commonly known as `profiling'. The blurring of distinction arises from the fact that there is no human or intelligence led initiation of suspicion. Human investigation will follow after initial matching or mining. Finally, the retention of DNA retained on the National DNA Database (NDNAD) is arguably surveillance. It is, however, distinct from mass informational surveillance in that it is "data" that (at present) serves a specific single purpose which cannot be applied elsewhere. We will make brief observations on all these forms of surveillance along with appropriate conclusions and recommendations.


  3.  Proliferation of CCTV might attract more observation and comment. However, the increase in informational database use has arguably been the more profound societal shift in the last decade. Access to and use of mass informational databases is part and parcel of everyday life, whether it is almost instant information provision via an internet search engine or identifying a postal address by way of a postcode and house number. Mass informational database use is increasingly being used as a tool of government though programmes such as the compulsory NIR or the children's index. The children's index is intended to assist child protection by allowing different services the ability to enter and access details of children onto the index, including anything that might constitute a "cause for concern".

  4.  Liberty's views on the undesirability and likely ineffectiveness of the NIR are well documented and we do not intend to repeat these here. There are, however, several points that can be made about the IDCA that are relevant to consideration of the surveillance society. The reserved powers scattered throughout the bill allow scope for the range of uses and purposes of the NIR, and those who can have access to it to be increased. If the NIR comes into existence then it is likely to make logistical, financial and political sense to increase the purposes it serves. If, for example, the NIR had been in operation at the time of Ian Huntley's conviction for the Soham murders, the mood of public outrage was such that there would have been political pressure to place details of convictions or "soft" non conviction police intelligence onto NIR entries.[169] The experience of the previous World War II identity cards suggests that extra purposes would be found as that scheme saw an increase in uses from three to 39 in 11 years. A further point worth making is that as the identity cards scheme is rolled out, the NIR will also allow a detailed audit trail of individual activities to be drawn on each entry by virtue of the entries permitted by paragraph 9 of Schedule 1 IDCA. If private sector agencies such as banks gain access to NIR as a means of verifying identification, the detail on this audit trial will increase.

  5.  While Liberty does not believe that there is any justification for the NIR, we do not take a similar position in relation to others mass informational databases. For example, we accept that the children's index was created to protect children. We did take issue with the bill when it was passing though parliament. The policy driver for information sharing powers was the tragic death of Victoria Climbié. The implication was that social workers in her case were somehow prevented from sharing information. Information sharing powers were available and Victoria's death was more a result of a catalogue of mistakes and that those responsible for her care lacked training, resources and guidance. Liberty also felt that the proposals were so broad and poorly framed as to raise significant concerns over the privacy of children and families. We believed the index might also undermine child protection. So much information would be gathered that children genuinely at risk might be overlooked as a consequence of "not seeing the woods for the trees". However, we do believe that the children's index, if limited in scope and effectively regulated, could prove to have genuine child protection benefits. The application of Human Rights principles of necessity, proportionality and legitimate purpose could ensure that only appropriate information is entered into the index and only those who have proper justification would have access. Effective oversight of the ICO would also be essential for proper operation. As previously stated, there is not the space to provide more detail in this document; Liberty's forthcoming work on privacy gives more detail on this subject. However, the example of the children's index encapsulates Liberty's approach to mass informational surveillance. Used effectively, it can be of public benefit. Used excessively, it infringes privacy and can be counterproductive. Human rights principles and effective regulation can provide a framework for striking a balance. Unfortunately, comments made by the Primae Minister earlier this year indicate that the prevailing attitude in government is that mass public sector information sharing is, by its nature, desirable.


  6.  The proliferation of CCTV in the UK is well documented. Hardly a week passes without new newspaper reports of CCTV technology advances. Whether these new generation systems will prove to be of greater use in combating crime remains unproven. Many improvements seem little more than gimmicks. Liberty believes that CCTV has some limited crime detection use, but negligible crime prevention use. At most, it can play a part in a holistic approach to combating crime.

  7.  Liberty has two principal areas of concern over the use of CCTV. Firstly, it remains effectively unregulated. The legislation that can[170] apply to CCTV is the Data Protection Act 1998 (DPA). However the DPA is not intended to provide a comprehensive framework for CCTV regulation. The data protection principles in the DPA cater for the processing, retention and dissemination of data. They do not provide any detail on, for example, the need to justify location for cameras, details on notification of location, good practice on handling footage and so on. Good guidance does exist for the use of both private and public sector systems[171] but these are effectively voluntary and unenforceable.

  7.   Our second principal concern is that even the limited applicability of the DPA only relates to a small number of CCTV cameras. The case of Durant[172] in 2004 has resulted in many systems not being subject to the DPA. The basic position is that CCTV is only covered by the DPA if it can be shown that a system is targeted on an identifiable subject. Clearly many systems, especially those set up by public authorities, do not target individuals and would not be governed by the DPA. As a consequence, CCTV in the UK remains largely unregulated.

  8.  In March 2007 the Council of Europe Venice Commission published an opinion on video surveillance in public places and the protection of Human Rights.[173] It laid out the Venice Commission's views on the data protection and human rights requirements of legislation and good practice governing the use of CCTV. Its conclusions serve as a useful reminder of the societal impact of CCTV upon a country where it has become ubiquitous. "Video surveillance of public areas by public authorities or law enforcement agencies can constitute an undeniable threat to fundamental rights such as the right to privacy... and his/her right to benefit from specific protection regarding personal data collected by such surveillance... it is recommended that specific regulations should be enacted at both international and national level in order to cover the specific issue of video surveillance by public authorities of public areas as a limitation of the right to privacy.[174]


  8.  The use of intrusive surveillance is governed by the Regulation of Investigatory Powers Act 2000 (RIPA). This call for evidence does not mention RIPA. However, given that the most invasive surveillance uses RIPA powers, we will make a few observations. There can be no argument against the proportionate use of surveillance powers by the state particularly when involving investigations into serious crime and threats to national security. The use of RIPA has increased considerably since it was passed. To an extent, this might be justified by increased concerns over national security. However the sheer scale of RIPA use is staggering. In February 2007 the Interception of Communication Commissioner, Sir Swinton Thomas, reported that over 439, 000 requests for communications traffic data were made in the period 1 January 2005 to 31 March 2006.[175] A total of 2,243 intercept warrants were issued in the same 15 month period.[176] The scale of surveillance can be attributed to several factors. The scope of those able to use RIPA powers is wide with a huge range of public bodies having access to them. RIPA orders published as secondary legislation set out those bodies with access to RIPA powers. However, they receive scant parliamentary time and are, in any event, unamendable. RIPA powers are often self authorising with lower level communications data powers being authorised internally and even the highest level interception powers only requiring the authority of a government minister. This can be contrasted with the USA where historically, there has always been independent judicial authorisation at the heart of the US surveillance process. Any surveillance warrant against a US citizen needs to be granted by a court. Meanwhile, interceptions of Communications to the US originating from overseas need authorisation from a special Foreign Intelligence Surveillance Court. After the September 11 bombings, attempts by President Bush to introduce a limited scheme of executive authorisation of warrants (ie similar to the UK's) was deemed unconstitutional by the US Federal Court.


  9.  The UK retains five times as many of its population on the NDNAD as any other country. In recent years the grounds for taking and permanently retaining DNA has expanded from those who are convicted of offences, to the current position of retention on arrest for any recordable offence. There is discretion for the police to remove a sample but this seems only to be exercised in exceptional circumstances. There are indications that the grounds for retention may soon be increased again to cover arrest for non recordable offences.[177] Liberty believes that the continued rolling out of the database will eventually result in a "tipping point", whereby a large enough proportion of the population are on the register to justify the case for compulsory entry for all on the NDNAD. We believe that if this is the intention then the case for compulsory retention should be made now. Liberty accepts that there is a need for a limited database of those convicted for certain offences (generally involving violence or sexual assault). However DNA is irrelevant in most criminal cases and the vast majority of entries on the register will be of no use in solving crimes. It is very difficult to have a debate on the NDNAD as discussion usually takes place following the DNA assisted conviction of a person for a gruesome historical crime. It is difficult to weigh the "light effect, wide impact"[178]effect of DNA retention on the population as a whole in the context of this type of case. Again there is not space here to discuss these issues in detail but it is worth noting that the impact of roll out has had a hugely disproportionate impact upon certain demographics, particularly Afro Caribbean males. It has also resulted in the permanent retention of thousands of young people under 16 with no criminal conviction or caution. Balanced against this is an admission from the Government that there is no evidence that taking of DNA from those who have not been convicted has helped crime detection.[179] Furthermore, although there has been a massive extension of the NDNAD over the last three to four years, the rate of crime detection using the Database has stayed at about 0.35% of all recorded crime. If extending the size of the NDNAD had been successful one would expect this proportion to have increased.


  10.  As mentioned in the introduction, data mining and data matching techniques are increasingly being used for crime detention. The Serious Crime Bill before Parliament formalises data matching practices in relation to fraud. A recent Home Office White Paper[180] gave details of plans to increase the use of data mining techniques. These practices are a consequence of increased technological sophistication coupled with vast quantities of data held on mass informational databases, making traditional human lead intelligence policing more difficult. As well as raising significant issues of proportionality and legitimate purpose, there are several specific points that the Committee might consider. Of particular significance and central to Liberty's analysis of the surveillance society is that data matching and data mining practices have outstripped data protection legislation. The DPA is nearly 10 years old. The European directive upon which the DPA is based, dates from 1995.[181] The regime created by the act and its accompanying principles might have provided an adequate framework at a time when processing more usually involved the processing of small amounts of data. However, the DPA is not equipped to cope with mass data processing exercises. For example, the second data protection directive permits data processing only for one or more specified purposes. However, all that is required, is for these purposes to be notified to the Information Commissioners Office (ICO). This would allow mass processing from multiple purposes, just so long as the ICO is notified. Notification is essentially an administrative matter. The ICO has no ability to refuse notification and what limited enforcement powers exist, can apply only once processing has already taken place.

  11.  As mentioned earlier, data matching and mining processes applied to people can be called profiling. Following the terrorist bombings in July 2005 and the alleged aeroplane hijackings in August 2006, there were calls from a variety of sources to adopt profiling on public transport and for flight passengers. So far, we are pleased to see that there have been no moves in this direction. However, we are concerned that the growth of mass informational databases might make moves towards profiling difficult to resist. The National Identity register is a good example of how this might occur. After the July 2005 attacks, the former Home Secretary, Charles Clarke, publicly accepted that ID cards and the NIR would not have prevented the attacks. This makes sense as it is safe to assume that British intelligence and policing agencies have gathered information on anyone that they believe could constitute a risk to national security. The reality is that anyone who does give reason for concern would become subject to a level of targeted surveillance that would collate information going way beyond what would be contained on the NIR. It is not feasible that the NIR entry would add to that possessed by the Security Services. This leads to a worrying possibility; in order to be of any use whatsoever in combating terrorism, the NIR must contain more information. This would need to be of a type that would separate those who present no, or minimal, risk to national security from those who might pose a serious risk. In other words, to be of any use in combating terrorism, data contained on the NIR must be increased in order to allow some degree of profiling and categorisation.


  12.  Space considerations preclude anything other than a brief summary of the steps Liberty believes are appropriate to protect privacy against unwarranted surveillance. If the Committee is taking oral evidence we would welcome the opportunity to discuss our observations and conclusions in greater detail. Liberty believes the legislative and regulatory framework has failed to keep place with surveillance. The HRA offers recourse to individual action which is of limited use in combating mass data processing. As explained above, the DPA is out of date. New data protection legislation is needed to reflect changes in data processing techniques and to properly regulate CCTV. The ICO needs better resourcing and more proactive powers to properly police surveillance. The ICO should also be heavily involved in the drawing up of guidance and good practice in information access and dissemination. The role of Parliament needs to be enhanced by ensuring individual Commissioners[182] report to parliament rather than to ministers. As details of information access and sharing are typically reserved for secondary legislation, Parliament should be more readily given the power to amend regulation.[183] Privacy impact statements should be introduced to accompany bills. More independent judicial authorisation of interception powers under RIPA are necessary, as is greater oversight and control of communications data access. There should be no further roll out of DNA retention powers. Meanwhile, a presumption in favour of sample destruction should be introduced for those not charged or convicted. These measures will re-introduce proportionality and accountability to surveillance. They require political will but would help counter growing public unease about the extent of the surveillance society.

April 2007

168 2006.pdf Back

169   As it was the Bichard Inquiry into the killings made the commendable suggestion that a positive vetting process be introduced. Back

170   But which often does not. See paragraph 7. Back

171   See for example the guidance issued by the Information Commissioners Office in 2000 for operators of CCTV systems and "A Watching Brief_A Code of Practice for CCTV" aimed at public sector users of systems published by the Local Government Information Unit in 1996. Back

172   Durant v Financial Services Authority [2004] FSR28, CA. Back

173 Back

174   Ibid paragraphs 79-81. Back

175   "Communications data" are records (but not the contents) of communication traffic such as mobile phone calls and email records. According to the report for 2005-06 there were 439,054 requests Back

176   "Intercept warrants" allow interception of communications so that the contents of communications can be recorded. Back

177   See the recent Home Office consultation "Modernising Police Powers: Review of the police and Criminal Evidence Act (PACE) 1984 at paragraph 3.33 The absence of the ability to take fingerprints etc in relation to all offences may be considered to undermine the value and purpose of having the ability to confirm or disprove identification and, importantly, to make checks on a searchable database aimed at detecting existing and future offending and protecting the public. There have been notable successes particularly through the use of the DNA database in bringing offenders to justice". Back

178   "Light impact, wide effect" measures are ones which have a relatively small impact upon an individual but which have a considerable cumulative effect upon society. Back

179   Home Office Minister Joan Ryan 9 October 2006 "As far as we are aware, there is no definitive data available on whether persons arrested but not proceeded against are more likely to offend than the population at large." HC Deb, Col 491W. Back

180   New Powers Against Organised and Financial Crime. Back

181   Directive 95/46/EC. Back

182   The Interception of Communication Commissioner, The Surveillance Commissioner and the National Identity Scheme Commissioner. Back

183   As has happened in the ID card act in relation to the Information that can be recorded I the NIR. Back

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2008
Prepared 8 June 2008