Analysis of the Government's response to Surveillance: Citizens and the State - Constitution Committee Contents

Analysis of the Government's response to Surveillance: Citizens and the State

1.  On 6 February we published a report, Surveillance: Citizens and the State[1]. The Government response was published as a Command Paper on 13 May (Cm 7616). In this report we analyse the Government's response.

2.  Although we welcome the Government's acceptance of a number of the recommendations of the Report of the House of Lords Select Committee on the Constitution, Surveillance: Citizens and the State, HL 18, Session 2008-09, we are disappointed that the Government's response does not fully appreciate the danger posed by surveillance to privacy and the relationship between individuals and the state. We regret that the Government have not agreed to a number of important recommendations which sought to assist the executive in promoting the responsible and proper use of data processing, including data sharing, together with other modes of surveillance.

3.  Whilst we acknowledge the Government's assurances that consultations are now in train to improve Government practice in this field, we believe that their response relies too heavily upon the possible outcome of the consultations. While it is reasonable for the Government to wait for the results of the consultations before beginning the detailed process of reform, their response fails to address many of the general concerns raised.

4.  The Government have paid insufficient attention to a number of fundamental points and criticisms made in the Report. The response reiterates the need to balance privacy with security and other objectives, and to ensure that the principles of necessity and proportionality are adhered to, without sufficiently indicating how this can be achieved. We believe that the Government have underestimated the degree to which public concern about surveillance and data processing is concerned with the propriety of collecting personal information on a vast scale, as contrasted with whether such data is subsequently handled safely and securely. In our view, data security is only one issue to be considered when deciding whether surveillance and data processing schemes should be developed or expanded.

5.  In their Introduction, the Government equate 'rights' of different kinds (privacy, more effective delivery of public services, and protection from crime and terrorism), but do not pay sufficient attention to the relationship between them, and how that relationship should impact upon policy formation.

6.  The Government refer to Privacy Impact Assessment (PIA) in their responses to the Committee's recommendations at paragraphs 452, 453, 455, 460, 484, 485, 489, and 495. While we firmly support PIA, we note that it is almost entirely untried in the British public sector and is therefore not entrenched in the policy process. Versions of PIA differ in terms of the stringency of their requirements. In the light of this, any suggestion that PIA is a panacea for the issues that we raise must be treated with caution, in particular where further details of the nature of the PIA to be undertaken in each case, and how and by whom it will be evaluated, have not been provided.

7.  Our recommendation involving PIA (at paragraph 460) called for mandating, through an amendment to the Data Protection Act 1998, "independent, publicly available, full and detailed" PIAs, with independent scrutiny undertaken by the Information Commissioner and others. We are disappointed that the Government do not support a legislative approach, preferring a weaker approach under the auspices of the Data Handling Report. Whilst the Government note that departments are encouraged to publish their PIAs, they recite reasons why departments might demur. We believe that departments should have to declare and explain their refusal to publish, and that the Information Commissioner should be empowered to require publication where he finds the reasons for refusal unconvincing.

8.  The Government's response does not recognise how PIA implementation is designed to work. Whilst the Government underline that the Data Handling Report now makes the conduct of a PIA mandatory, their response to the recommendation at paragraph 455 states that "Departments are encouraged to consider undertaking a [PIA] in the early stages of policy development" (our emphasis). PIA should be undertaken before it is too late and expensive to build privacy safeguards into the development of policy and the infrastructures and technologies to execute it. The Data Handling Report, whose recommendations on mandatory PIA the Government have accepted, makes this point. We look to the Government to ensure that the necessary instructions are given to Departments and those responsible for putting the Data Handling Report into effect.

9.  The Government's response to the recommendation at paragraph 453, concerning ways to establish the likely effect of new surveillance measures on public trust is inadequate. The Information Commissioner's Office (ICO) and NGOs, among others should have a useful role. The Government's statement that the ICO raises questions on planned policies is covered in the recommendation at paragraph 455.

10.  The response to the recommendation at paragraph 454 does not specify how or whether the Government will expand the ICO's remit in respect of monitoring the effects of surveillance and data collection on Article 8 rights under the ECHR. Nor does it comment on how the ICO's remit should be realigned in light of the role played by other Commissioners and watchdog bodies. Whilst the Government undertake to continue to monitor the effectiveness of the various Commissioners in reflecting public concerns and human rights, they do not say how this will be done or whether they will publish their findings.

11.  Our recommendation at paragraph 455 regretted that the ICO was often not consulted about policies and legislation with privacy implications, a frequent omission to which the ICO have often drawn attention. The Government's responses to the recommendation at paragraph 453 and 461 do not address the issue. The Government's assertion that Departments are best placed to initiate consultations with ICO about possible data protection implications of legislation or policies is inadequate. Factual information about consultations held with ICO should be placed in an Annex to the Explanatory Notes.

12.  We regret that the recommendation at paragraph 456, asking Government to reconsider giving ICO the power to inspect private sector organisations without consent, has not been immediately accepted. We believe that this leaves an anomalous gap in the application of the Data Protection Act 1998 which will become more apparent as changes occur in the ways in which the government carries out public-service functions involving transfers of personal data across organisational boundaries. The Government state that it is possible for private and third-sector data controllers to be inspected (with notice) if the Secretary of State considers that they are exercising functions of a public nature or under contract to a public authority. The Government should show when this has occurred. The Secretary of State's powers of intercession in the inspection process should be justified. We are encouraged by the Government's willingness to listen to arguments for granting the power which we recommended.

13.  We welcome the Government's response to the recommendation at paragraph 457, indicating that the ICO's new power to levy fines will soon be brought into effect.

14.  We welcome the Government's commitment to encourage greater flexibility in the inspection work carried out by the Interception of Communications Commissioner and the Chief Surveillance Commissioner, as recommended at paragraph 458. We would welcome further information as to how they will engage with public authorities to ensure that they have appropriate guidance. The Government point to the availability of the Investigatory Powers Tribunal, anticipating our recommendation at paragraph 459, but—given our criticism of the underuse and obscurity of the Tribunal—this provides little reassurance. We look for positive results from the Government's undertaking to urge the Tribunal to raise its public profile.

15.  The Government do not explain why they reject our recommendation of a review of the law governing consent to the use of personal data, in the recommendation at paragraph 462. The ICO's forthcoming code of practice does not meet the need for a review of an area of concern in many parts of the public and private sectors.

16.  The Government's response to the recommendation at paragraph 463, together with part of their response to the recommendation at paragraph 487, does not specify the tangible measures of support which they intend to give the ICO in raising public awareness of information processing and surveillance.

17.  The recommendations at paragraphs 464 and 466, on the retention of DNA data, have now been opened to public consultation in a document published on 7 May 2009. We welcome the Government's moves in the direction of complying with the European Court's decision in S & Marper, and in particularly, their intention to destroy DNA samples, profiles of children under the age of 10, and the DNA of volunteers, which was the subject of our recommendation at paragraph 466. We await further details on the question of retention. We note the Government's response to the recommendation at paragraph 465, concerning a universal DNA database.

18.  The Government have not accepted the recommendation at paragraph 467 for a statutory basis for the National DNA Database (NDNAD), although their proposal, in the public consultation now being conducted, for changes in the NDNAD's regulatory structure and accountability procedures could go some way towards overcoming the problems that we thought a new statute would resolve. We hope that these proposals will help promote a clearer, more rationalised, and less disproportionate regime for DNA.

19.  We note that the Government have already commissioned an independent appraisal of the evidence about the effectiveness of CCTV, which we called for in the recommendation at paragraph 468. This review is soon to be distributed to police forces, and is already available on the Internet. We urge the Government to ensure that the review is made available more widely so that it can inform a genuine debate on the subject.

20.  We are disappointed that the Government have not accepted our call for a statutory regime for CCTV, set out in the recommendation at paragraph 469. Although we acknowledge that some steps are being taken within the framework of the National CCTV Strategy to improve the governance and operation of CCTV, we remain convinced that accountability and responsiveness to public concerns and complaints require a statutory regime for governing the Strategy, oversight by Commissioners, and the establishment of the promised national body.

21.  The Government's reference to the Data Handling Report is a welcome recognition of the problems addressed in the recommendation at paragraph 470 concerning the encryption of data. We wait to see whether stronger controls prove to be necessary. The recommendation at paragraph 482 is also about encryption, and we are encouraged by the Government's indication of the measures to be taken under the aegis of the Data Handling Report. However, it is not clear what, if any, sanctions might be applied for failure to comply with the mandatory minimum measures that are to be incumbent on departments. Nor is it clear what will be the regime to ensure that suppliers comply with the stated measures. We believe that the encryption standards described by the Government are likely to be robust.

22.  The response to the recommendation at paragraph 471, which called for a review of administrative procedures in the Regulation of Investigatory Powers Act 2000 (RIPA), refers to proposals in current legislation before Parliament. We will comment upon these proposals in the course of our legislative scrutiny. The Government have stated that there will be revised codes of practice which will provide clearer statutory guidance. This also forms part of their response to the recommendation at paragraph 481. We believe that the way in which the codes of practice are implemented, including more effective training and understanding of the important principles of necessity and proportionality, is an important consideration. We wait to see whether forthcoming reports by the Commissioners concerned (and in others from the field of law enforcement) show that the new codes are effective.

23.  The recommendation at paragraph 472 urged that the Government consultation on RIPA powers should consider the appropriateness of their use by local authorities, The Government have not accepted our proposal that offences carrying custodial sentences of less than two years should not involve the use of investigatory powers under RIPA by local authorities, but have emphasised the revised code of practice mentioned above, as well as better guidance, training and accountability. We await the results of the current consultation, and any subsequent Government action, involving the question of the seniority of authorisation officials.

24.  Our recommendation at paragraph 473 called for improvement in the co-ordination of the inspection regimes of the different Commissioners empowered under RIPA. We are concerned that the Government's response does not sufficiently addresses the concerns to which we drew attention in our report. The Government's suggestion of more resources for inspections, and for other benefits should be made and adopted with firm intent

25.  We are disappointed that the Government have not accepted our recommendation at paragraph 474, for powers of surveillance and data processing to be set out in primary legislation. We do not believe that it is sufficient for 'basic principles' to be stated in primary legislation, with important details left to secondary legislation.

26.  The Government have not accepted our recommendation at paragraph 475 that a new Joint Committee on surveillance and data powers be established for post-legislative scrutiny. We believe that existing scrutiny arrangements are inadequate in the light of the expansion of surveillance and data processing. Whilst the Government have said that they 'expect' departments to monitor the impact of their policies, we believe that this should be a requirement placed upon departments.

27.  The response to the recommendation at paragraph 476, which called for the Government to exercise better leadership over the implementation of ECHR Article 8, emphasises their production of guidance texts. We are concerned that this does not guarantee sufficient follow-up to ascertain whether the guidance is understood and put into practice by relevant authorities. We acknowledge that new codes of practice and other measures are in hand, but reiterate our concern about their possible insufficiency. We do not believe that the Government's response adequately addresses our recommendation that legal aid should be available for Article 8 claims.

28.  The Government's response to the recommendation at paragraph 477, on judicial oversight for surveillance, transparency and compensation, reiterates their satisfaction with the current "balance" and refers complainants to the IPT. We do not believe that this response goes far enough. We agree that transparency may compromise investigations, but the Government's wish for 'certainty' in this matter does not take account of the possible benefits of greater transparency. We suggest that the question of increasing transparency be subject to a proper risk analysis.

29.  The recommendation at paragraph 478 on citizen-oriented identification systems raises issues of individual control over identification and authentication data, and of minimising the collection and use of identifiable personal. These issues are insufficiently addressed by the Government

30.  We are disappointed that the Government have not accepted our recommendation at paragraph 479, with which the Joint Committee on Human Rights concurs, for more prominent leadership to be exerted by the data protection minister.

31.  Whilst the Government do not disagree with our recommendation at paragraph 480 about the changes in organisational culture and related changes urged by the Data Sharing Review, we observe that the Government have not referred to our recommendation regarding the reporting of progress to Parliament.

32.  We welcome the publication of the Manual of Protective security, as the Committee urged in the recommendation at paragraph 483.

33.  In relation to the response to our recommendation at paragraph 484, it is too soon to judge how effective the National Identity Scheme Commissioner will be, how rigorous the regulation of the use of information from the National Identity Register will be in practice, and whether the CCTV code of practice will be an acceptable alternative to stronger regulatory measures. We note that a statutory code of practice will cover the sharing of personal data.

34.  With regard to our recommendation at paragraph 485 for a review of procurement processes to include privacy-enhancing technologies and privacy-design solutions in new systems, we welcome the Government's general approach but think that they have not fully understood our argument. The issue is only partially that of information security in the strict sense, but also of more comprehensive design features that the procurement process should require to be built into systems in order to limit the collection of data and provide other relevant privacy safeguards in keeping with data protection principles. We again urge the Government to take a broader approach to this matter.

35.  We are disappointed with the Government's response to our recommendation at paragraph 486 concerning improvements in the investigation of public opinion about surveillance and data processing. We urge the Government to go further to address the concerns that we expressed.

36.  We believe that the response to the recommendation at paragraph 487 about the public understanding of surveillance processes and their risks and benefits is inadequate. Publication of guidance on websites and the work of the ICO are necessary but not sufficient provisions. We note the discrepancy with the response to the recommendation at paragraph 463 in terms of the Government's commitment to "work with" the ICO, albeit in ways that are not indicated. We call on the Government to engage with the issues of surveillance and privacy in a proactive manner.

37.  We do not believe that the responses to the recommendations at paragraphs 488 and 490 on public consultations and new ways of engaging with the public sufficiently reflect the Government's responsibilities. We urge the Government to explore the Committee's recommendations further.

38.  We have similar concerns about the response to the recommendation at paragraph 489 concerning the Information Charter, and are concerned at the lack of any reference to reporting to Parliament on the workings of the scheme.

39.  We are disappointed at the lack of detail contained in the response to the recommendation at paragraph 491 for the involvement of NGOs. We do however note the Government's commitment to keep the matter under review.

40.  We are encouraged by the response to the recommendation at paragraph 492, in which the Committee recommended scrutiny by Parliamentary committees of the Government's report on their progress with better data handling.

41.  We agree that the work of the Merits of Statutory Instruments Committee, which formed the substance of the recommendation at paragraph 493, is a matter for Parliament.

42.  We are disappointed that the Government have not accepted our recommendation at paragraph 494 for a Joint Committee on the surveillance and data powers of the state, with the ability to draw upon research. Whilst we note the Government's argument that existing Committees might work together on these matters, we believe that a dedicated Joint Committee would be a more effective instrument for bringing together expertise for the purposes of scrutiny and investigation.

43.  The response to our recommendation at paragraph 495 for testing new policies against the criterion of their effect on privacy refers to the new requirements for PIA. We agree that these are appropriate.

1   2nd Report of 2008-09, HL Paper 18 Back

previous page contents

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2009