Examination of Witnesses (Question Numbers
1800-1819)
MR CHRISTOPHER
GRAHAM AND
MR DAVID
CLANCY
2 SEPTEMBER 2009
Q1800 Chairman: But it was not just
restricted to Gordon Taylor, this was information covering a large
number of individuals.
Mr Clancy: It would have been
because obviously that would have been an exhibit for the court
so it would contain more information.
Mr Graham: Again, I am obliged
to assist those people who feel that under the special purposes
that provide certain protection for journalism, literature and
the arts, if the processing of information under those special
purposes has in some way gone wrong and been abused, the Information
Commissioner is charged with assisting citizens who are asserting
their rights. I do not know but it may be that some of the wider
information that appeared in the Guardian on Monday came from
that source. That is purely conjecture; I do not know that. It
certainly did not come directly from the Information Commissioner's
Office.
Q1801 Chairman: Not officially anyway.
Mr Graham: I just think not. I
cannot prove a negative.
Q1802 Chairman: Mr Davies is in the
room but I do not imagine he is going to tell us. The very large
number of names which the Guardian printed who have been subject
to inquiries by Mr Whittamore's company, it did look as if that
information came from somebody who had seen the ledgers.
Mr Graham: Well, it would if it
had come from the Office.
Q1803 Chairman: But you do not think
necessarily it did?
Mr Graham: It did not come from
us, Chairman.
Q1804 Chairman: The names that appeared
in the Guardian on Monday all relate to activities which took
place 15 years ago, or sometimes more, and yet to quite a number
of those names it came as a surprise that they were featured in
Mr Whittamore's ledgers. Can you tell us why did your Office when
you obtained the ledgers not tell the people who appeared in those
ledgers that they had been subject to possibly illegal inquiries?
Mr Graham: I think if I can just
step back a bit. Any regulator has to make decisions about how
it approaches a breach of the legislation that it uncovers. There
were, I read in the Guardian, I have not counted them myself,
17,000 invoices or purchase orders for personal information on
people in whom the press were interested. The only evidence we
had was the ledgers and the invoices. The press, of course, would
have the defence under the Data Protection Act that they were
pursuing a story in the public interest. My predecessor had to
make the judgement whether you throw the whole resources of the
organisation into going through 17,000 pieces of evidence in order
to assess the nature of a story and to work out whether the Ziggy
Stardust in the ledger is the Ziggy Stardust you might need to
alert. The decision was taken "no, we are going to approach
this by trying to end the unlawful dealing in personal confidential
information at source, we are going to go for closing down these
operations and we are going to report formally to Parliament."
It was the first formal report that the Information Commissioner
had given to Parliament under the legislation. We are going to
say, "This is going on and it is going to go on until there
is a real penalty in the Data Protection Act for this sort of
thing". So my predecessor reported in What Price Privacy?
the need for a custodial sentence and, indeed, this Committee
agreed with him. In a case you may have seen yesterday in Nottingham
Magistrates' Court, the District Judge regretted that he was only
able to fine an individual who had been guilty of a pretty blatant
breach of the Data Protection Act £100 plus costs, and he
remarked that people would find it surprising that that is all
he could do under legislation. The priority was to sound the alarm,
to warn the industry, to talk to the PCC, to urge the provision
of a custodial penalty, which is kind of half there, and perhaps
more on that later when we get to the discussion, and what to
do about the individuals concerned. I think with the benefit of
hindsight what we might have done was to do what we did with the
blacklist for the construction industry, the so-called Consulting
Association, and Mr Kerr, who my colleague, Mr Clancy, ran to
justice, where we closed down the business but we also, in making
that very public, said, "If anyone has concerns that they
may have been blacklisted and denied employment because their
name is unfairly included in this register then get in touch with
us and we will let you know what we have got". David, you
are dealing with a few of those applications now, are you not?
Mr Clancy: There are over 120
individuals who subsequently obtained their information and a
number of those individuals are now bringing claims before the
courts in relation to their consideration that they were blacklisted
from the construction industry. I think if you compare the two
we have got very favourable support from the press in relation
to the consulting association, but with What Price Privacy?
it was a situation where turkeys do not vote for Christmas!
Mr Graham: Could I just add, Chairman,
as you have said, the information that was publicised in the Guardian
on Monday dealt with some very old information. The ledgers that
I have seen include invoices from 1999. If we collected these
in 2002 there is old information there and the whole point is
the journalists were trying to get a contact number to ring for
a quote at the end of an investigation or whatever they were going
to do, so the supposition was that the individuals would already
have been contacted, so they would kind of know that their ex-directory
number had gone AWOL. I think though we would all agree now that
we are a bit more experienced in this and we are tackling some
pretty dodgy customers that in What Price Privacy Now?
when we listed the various newspaper organisations and said that
305 journalists had been at this, we should also have said, "If
anyone is concerned that there may be information or wants to
know how it was obtained they should contact the Information Commissioner's
Office and we will process that inquiry as we are doing with the
construction industry".
Q1805 Chairman: To say the onus is
on individuals to ask you whether or not they appear in this ledger,
and thanks to your Office I have seen the ledger, as you know,
and there are hundreds of names, obviously there are some who
are unsurprising, leading celebrities, sportsmen and politicians,
but the vast majority are people who are comparatively unknown.
How would they know that they appeared there? How would they know
to ask the question?
Mr Graham: Obviously we would
have to work out what we would do, but how would I know what I
could tell those individuals about what I had or how could I show
it to them without showing a lot of other people's personal information?
Those ledgers, Chairman, as you have seen, are full of ex-directory
phone numbers, mobile phone numbers, lists of friends and family
and so on. It is an appalling situation. That is why Richard Thomas,
my predecessor, was right to sound the alarm to Parliament and
to say to the industry, "This is going on and it has got
to stop. There must be that custodial sentence". We seem
to have got into the Alice in Wonderland situation where
we are shooting the messenger. It was the Information Commissioner's
Office who highlighted this whole thing; we are the good guys
in this, Chairman.
Q1806 Chairman: I am sure my colleagues
may wish to return to this but, whilst I finish the questions
I have, you did not tell all the individuals and the other thing
you did not do was you did not initiate prosecutions of any of
the journalists named, you restricted prosecution to Mr Whittamore.
Why were journalists not prosecuted when there was clear evidence
that they had been knowingly commissioning illegal acts?
Mr Clancy: I think the difficulty
would be the offence relates to "knowingly or recklessly
obtaining personal information". We had in the region of
400 journalists and, to be fair to those journalists, if we were
to conduct an investigation we would have to investigate all 400
and satisfy the court beyond all reasonable doubt that journalist
knew that information was unlawfully obtained. If it was an ex-directory
telephone number, some of those numbers could have been obtained
by ringing round friends or other people that they may know and,
therefore, an ex-directory telephone number may have been obtained
legitimately, we could not say for sure, so there would have had
to have been 400 intensive investigations carried out by the Commissioner's
Office within the resources that we have got. That would mean
that the Commissioner possibly could not carry out his other functions
under the Act. A decision was made to go down the route of, "Let's
bring this into the public arena, change the public's opinion
of what's going on", and hopefully change the law so that
the possibility of a custodial sentence hanging over people committing
these offences would be a sufficient deterrent and protect people
in the future.
Mr Graham: In the meantime, of
course, you say the journalists were commissioning an illegal
act; but we do not know that was the case because there is the
defence of public interest and sometimes journalists have to do
pretty underhand things to get stories that are manifestly in
the public interest. The classic example, of course, is the Guardian
and the `cod fax' that got the evidence that put Jonathan Aitken
in prison. If that had been in pursuit of some pop star's sex
life everyone would have condemned it, but as it was they said,
"Well, there's the public interest". We did not even
know what the stories were, never mind what the defence was. So
I as the Information Commissioner had to decide, given the vast
range of duties that I have for freedom of information as well
as data protection, where do I deploy my resources. Do I put the
whole organisation on to investigating 17,000 individual pieces
of paper to work out what the story was, to work out whether or
not it was in the public interest, and to range against some pretty
well fee-ed lawyers on the other side? Or do I say to the industry,
"Put your money where your mouth is. You talk about self-regulation,
do it" and then get on with a few other little issues, like
the construction industry database, like the Revenue and Customs
losing everybody's child benefit records, like concern about CCTV
cameras, databases and so on, never mind the Freedom of Information
Act? There is a lot to do. It would not have been good regulation
for the Information Commissioner's Office to prioritise this particular
bit of the jumble. That is only the journalists' bit of the jumble,
we are concerned with the whole trade in personal information
which is about many other issues, as David can tell you.
Q1807 Chairman: You say that therefore
you took the decision to tell the industry to put their house
in order and asked for strengthened penalties, but in that case
why did you not say to individual newspapers, "These are
journalists employed by you who feature in the ledger and you
might like to ask them why and to justify the inquiries they made"?
Mr Graham: We started off by a
general call to the industry which, indeed, was heeded to some
extent in that the Editors' Code Committee eventually amended
clause 10 of the Code, made it much tougher, and we have done
a lot of work with the PCC in training editors. We have done a
couple of seminars, one in London and one in Scotland, to make
sure that journalists understand that this is serious. I saw a
copy of the Editors' Code Handbook the other day and it
makes it very clear that you mix with the Data Protection Act
at your peril and you had better have a very solid public interest
story very well documented, in order to do that. Chairman, the
interesting question is why did not any of those titles that were
listed in What Price Privacy Now? contact the Information
Commissioner's Office and say, "This is terrible, 45 of our
journalists apparently have been doing this thing which we utterly
condemn, tell us who they are", and we then might have been
able to talk turkey. Interestingly, of 305 journalists, and we
listed the total in the document, we have not had a single inquiry
from a journalist saying, "Am I on that list? Was I doing
something wrong?"
Mr Clancy: That is correct.
Q1808 Chairman: So you published
the table listing titles and numbers of journalists and you had
no response from the industry seeking further information at all?
Mr Graham: No. I have seen a number
of sessions of evidence to this Committee where the answer to
some of your more probing questions is, "Ask the Information
Commissioner, the Information Commissioner will know", but
nobody has actually asked the Information Commissioner.
Chairman: Thank you.
Q1809 Paul Farrelly: Thank you very
much, Chairman. I just wanted to come back to what happened after
the Motorman inquiry. We have discussed the fact that people were
not routinely informed that they had been the victim, be they
ordinary people in the street or public figures, of blagging or
an illegal use of databases. One example is I spoke to Peter Kilfoyle
following the Guardian article and Peter is quite happy for me
to say that he is "incandescent with rage"—those
were his words—that the Information Commissioner six years
on had not told him that in this case, I understand, it was the
Daily Mail that used the DVLA illegally to get his constituency
home address for whatever reason from his licence plate number.
Peter was angry that six years on you had not informed him even
though he was a minister attached to the Cabinet Office at the
time and there were, therefore, security implications and that
he had to learn these details from a Guardian journalist over
the telephone.
Mr Graham: You ask what we did
after the Motorman investigation and the answer is with the Crown
Prosecution Service we launched prosecutions against those who
were involved in the trade. We then ran up against the very disappointing
result of the very weak powers and the very weak penalties that
exist in the Data Protection Act and, because of a technicality,
it was even weaker than the rather pathetic financial penalties
in the Act and everyone just got off with a conditional discharge.
When we are invited to take further action you have got to see
it against the context of a regulator that is trying to do the
decent thing and has got seriously knocked back. I have already
said that our experience with the construction industry database
is that if we had our time over again we would do it a different
way. Peter Kilfoyle's name would have sprung out. There were a
lot of names of ordinary individuals that would not have rung
any bells. I would have had to put a very large number of people
trawling through those 17,000 pieces of paper. Even if it had
been in the name of bringing some prosecutions against journalists
we faced the prospect of them getting no more than a conditional
discharge. The responsible thing to do was to report to Parliament
to say, "Let us have this custodial sentence". I am
very sorry if people feel let down by the ICO but against that
I would say there was some very good investigatory work by David
Clancy and his colleagues which has blown open this trade, which
is still going on. The issue should not be whether the Guardian
hates News International, it should be whether Parliament will
now activate the custodial sentence that is there in abeyance
in the Criminal Justice and Immigration Act and take that custodial
sentence from behind the bar in the Last Chance Saloon, where
it is sitting at the moment, and say, "You're going to jail
if you carry on doing this". For dealers in personal information,
that is the key decision.
Q1810 Paul Farrelly: Your position
is very clear on that, as might be expected. If people approach
you now and ask whether they featured in your Motorman files,
will you let them have the records?
Mr Graham: We will look at each
individual case. Obviously it has got to be somebody with proper
standing; we are not going to have this as a way of investigative
journalists running the story on a little bit further, it has
got to be a proper process. Just as we are doing with the construction
workers, we would certainly deal with these people. Please bear
in mind that one of the invoices I have seen is from 1999 and
it is inconceivable that somebody seeking someone's ex-directory
phone number in 1999 has not used the number to check out the
story, so the individual knows that their private number has been
made public.
Q1811 Paul Farrelly: That is not
necessarily the case and I want to come on to that. That is a
leap that you cannot make, Mr Graham.
Mr Clancy: Can I just say that
at this moment in time a number of individuals have sought access
to that information that is contained within the Motorman database
and that access is being processed within our Office.
Q1812 Paul Farrelly: Just let me
be clear. If Peter Kilfoyle, to name one example, comes to you
now and says, "I would like to see how and where my name
features in the catalogue of activity in the Motorman files",
will you release that information to him?
Mr Graham: Yes, I would have to
do that. I am just looking to see the particular section in the
Act that charges me with doing that. I think it is section 13.[1]
Q1813 Paul Farrelly: Can I repeat the
question in terms of what happened during and after Motorman.
What about the organisations that were penetrated and their security
procedures subverted. The whole catalogue that Nick Davies named
in his latest article on Monday, did you go to each of those organisations
to give them instances of how, where and when their databases
had been penetrated so that they could improve their own security
procedures in the future?
Mr Clancy: We approached a number
of organisations obviously because we obtained witness statements
from those organisations and they thoroughly assisted us with
our inquiries. I think it is fair to say, again, we would not
go through the entire ledgers and contact every particular organisation
because we end up with very intrusive investigations in relation
to individuals, "Who is Peter Kilfoyle? Whose car is that
the registration number of?" We start obtaining his personal
information for our purposes and then more and more people get
their hands on this personal information that should be protected.
We identified with the organisations, the banks, the telecoms
companies, et cetera, that there were problems with this.
We have worked actively with some of those companies in looking
at security issues and it is an ongoing thing. I think it is fair
to say that most organisations that process personal information
nowadays, whether it be telecoms companies, banks, or building
societies, are, to a degree, insecure and will be attacked and
be constantly coming under attack by private investigators and
people who obtain information to sell on to insurance companies,
solicitors firms and organised crime gangs for witness intervention
purposes, et cetera, so there is a massive trade out there.
In fact, you can go on to the internet today, the website www.freelancesecurity.com,
and you will see private investigators advertising there to say,
"I want to obtain a person's bank account information",
and people will bid for that information, "I can get that
for $2,000 or £2,000 within 10 days" because the trade
is still there.
Mr Watson: Could you repeat that address?
Mr Clancy: It is www.freelancesecurity.com.
It is a non-UK-based website, but some UK Private Investigators
(PI) will bid for jobs on that website.
Q1814 Paul Farrelly: You mentioned
witness statements and that just begs the question in my mind:
were any journalists arrested following the Motorman inquiry and
as a result of the parallel police actions, to your knowledge?
Mr Clancy: Other than for data
protection purposes, there is no power of arrest under our legislation.
Q1815 Paul Farrelly: But that is
not the question.
Mr Clancy: But the police may
have actually arrested people in relation to the conspiracy case.
Q1816 Paul Farrelly: Do you know
of any instances?
Mr Johnson: I am not aware of
any arrests.
Q1817 Paul Farrelly: I am told there
were three arrests.
Mr Clancy: I am not aware of those
personally.
Q1818 Paul Farrelly: So, as far as
you know, no journalists were arrested?
Mr Clancy: As far as I know, I
am not aware of any arrests.
Q1819 Paul Farrelly: There are two
reasons why we have asked you here today and it is because there
are two things that are new now. Firstly, there are the two revelations
in Nick Davies' two lengthy articles that give the public new
details beyond what they already knew from your tables and in
your What Price Privacy Now? document so that people can
now judge whether the law was being broken from the information
that was requested and the means by which it was accessed. Secondly,
you are here because what else is new is that you were ordered
by the court to provide documents in relation to the civil action
brought by Gordon Taylor. Can you tell us what documents you were
asked to provide in the Taylor case and how they may have been
helpful to the Taylor case in relation to either the specific
charges that were involved in the Goodman affair or to establish
a pattern of behaviour at News International?
Mr Graham: I do not know whether
David is going to be able to help with that, but, just before
we try to answer that question, I am interested in the suggestion
of `new' information.
1 Witness correction: It is actually Section
53. Back
|
