Surveillance: Citizens and the State - Constitution Committee Contents

Examination of Witnesses (Questions 520-539)

Professor David Feldman

2 APRIL 2008

  Q520  Chairman: Do you think that the constraints under Article 8 on proportionality and, indeed, necessity are adequate?

  Professor Feldman: I think the answer to that is that it depends, my Lords. Article 8 imposes what are essentially the requirements for justification of interference with respect to private life, family life, the home and correspondence broadly defined, very broadly defined. It requires, first, that there should be a legal basis for the interference in positive law, as much as Article 8, paragraph 2(b) says in accordance with the law, and that means it must comply with the requirements for provision of positive law regulating and authorising the activity. That was held by the European Court of Human Rights to be lacking in the Malone case when the Malone case reached Strasbourg. Then it requires that the interfering authority must show that the interference serves a legitimate aim, and that is not too difficult a job to meet. Lastly, as you say, it requires it to be shown to be necessary in a democratic society, which includes a proportionality requirement. That can be a substantial burden on a justifying agency, but whether it is a really robust protection depends on how effectively the reviewing body applies the proportionality test and also how carefully the body which has to authorise the interference in the first place applies it. If it works well, it can be a very effective protection indeed, and my impression, for example, is that the Information Commissioner and the Information Tribunal under the Data Protection Act 1998 make very good use of proportionality tests and are very effective. If one were to adopt, as some people say that courts ought sometimes to adopt, a more deferential view to the question of proportionality and treat with considerable respect the view of the original decision-maker as to whether the interference was justified and proportionate, that would be a much less useful protection.

  Q521  Baroness Quin: I wanted to follow up something you said in your first reply when you talked about the Queen in Parliament being able to press anything and, therefore, a kind of self-regulation being appropriate. I do not know whether I picked it up right, but was there a concern that self-regulation is perhaps less effective than it was and, if that is true, what is the cause of it? Is it media pressure, or events to deal with terrorism, or what?

  Professor Feldman: I think it is considerably less effective than it used to be, and the best evidence for that is to be found in the number of powers which have been granted by Parliament for surveillance activities and for exchange of personal data between agencies with remarkably little in the way of substantive criteria attached for deciding when such exchange should be permitted and how the regulatory scheme should be given effect, where there is a regulatory scheme. To some extent that was undoubtedly the result of concerns about terrorism, but I do not think it is only terrorism. It was happening way back in the eighties and nineties. We had Northern Ireland related terrorism, but it was before what we now think of as international terrorism became a major concern, and it is a combination of security concerns with concerns about certain types of crime, particularly financial crime, serious fraud, tax and social security crime and, more generally, a desire to ensure that people are providing information that the state needs, or thinks it needs, for whatever purposes seem good to the agency, rather than starting from the proposition that people are entitled to keep their business to themselves and that very special and immediate justification is needed to interfere. In a sense (and this may be over dramatising it slightly) one might say that we have moved from the position that we were in when I was a student of law some 35 or more years ago where we were told that, as a matter of constitutional law, we were all subjects of the Crown, not citizens of the state, and yet we were left to a very large extent on our own and not interfered with, to a point where we are now told the whole time that we are citizens, and yet the implication of that seems to focus on our responsibilities to the state and we are treated, as it were, as a resource for the state and as a source of useful information and even in some cases—for example, the plans for the identity card—we are made to pay for the privilege, and that seems to me to be somewhat paradoxical. It is a change of attitude on the part of our rulers to us which is, I think, a reflection of a sea change in the nature of our relationship with the state.

  Chairman: Thank you very much.

  Q522  Viscount Bledisloe: I have two questions about Malone. First of all, has it been judicially or text-bookly commented on and, if so, favourably or unfavourably, and, secondly, I fully understand that individuals are allowed to do anything they are not forbidden to do, but I thought that state authorities, and so on, were only allowed to do what they are authorised to do by statute and if they could not find the express power to do it they could not do it?

  Professor Feldman: Yes. To take the first point, there have been unfavourable comments on the general approach adopted by Vice-Chancellor Megarry, to be found in quite a large body of literature, and, of course, it was a view that Vice-Chancellor Megarry himself adopted with a certain amount of reluctance because he foresaw that it was going to run straight into the Rule of Law type of requirements of the European Convention, but there is no shortage of critical literature. The general approach, however, has not changed particularly, and the reason for that is that the Vice-Chancellor was hampered by the fact that in this country, at least until the passage of the Human Rights Act 1998, there was no source of what one might describe as a right to privacy in the law of any of the jurisdictions of the United Kingdom. So, the question that he asked himself was, "Have the police done anything unlawful by interfering with the telephone messages and communications of the plaintiff?", and the answer was, "No", because it involved no trespass to property, in the circumstances no breach of confidence, and there was also no right to privacy that could stand on its own. So he said there was nothing unlawful about what they were doing: there is no positive authority for them to do it, but they do not need that because the constable is just a citizen in uniform, or a subject in uniform. That was the basis of the Malone case.

  Q523  Viscount Bledisloe: It was treated as the act of an individual rather than as the act of a statutory authority?

  Professor Feldman: Yes. It would be true also, I think, of a secretary of state or anyone else operating in a dual capacity. My Lord Chairman, there was a second question which I do not know whether Viscount Bledisloe might like me to answer. I cannot remember what it was though!

  Q524  Viscount Bledisloe: I think you almost answered it. My question was: is there not a difference when this is a body set up by statute or by the state as opposed to an individual?

  Professor Feldman: Yes, it is true that if it is established by statute and it has only statutory powers, then those probably are the only statutory powers that it has, although there is a view that even statutory bodies can exercise certain common law freedoms. For example, most statutory bodies can hold property and in relation to their property holding they exercise ordinary property rights, subject to perhaps the opportunity to conduct judicial review, on public law principles, of the use that is made of the property. But in principle I think I think there a distinction between purely statutory bodies and others.

  Q525  Lord Rowlands: In some of the written evidence we have received one our witnesses makes a very powerful point that there is no over-arching principle, it is built up piece-meal. I think at the beginning of your answer you started identifying possibly one of these principles, the issue of liberty. What about the right to know? The citizen has a right to know what information is being held by agencies. How far is that currently enshrined?

  Professor Feldman: It is quite extensively enshrined in our law in a number of different forms and from a number of different sources. Most obviously, there is the Data Protection Act 1998, and in principle that covers all personal information held by anyone in a form which allows it to be processed so as to identify individuals and applies to all personal information, and there is a heightened regime in respect of certain types of information the Act calls "sensitive personal information". The impetus for that came from a number of sources, both concern about control of sensitive information within the UK and also a European Community Data Protection Directive—I think it was 95/46—and the 1998 Act was enacted as a response to our obligations under the Data Protection Directive. The Data Protection Directive itself refers to, and is a practical manifestation of, the principles set out in the European Convention on Human Rights, particularly Article 8 (the right to respect for private life, and so on) that we have already discussed, and Article 8 of the Convention, as interpreted by the European Court of Human Rights, has now for a long time included quite extensive requirements for states to take action to control the use that can be made of personal information. The way in which these principles work is that there are several different points in the information gathering and use cycle at which obligations to the data subject (as the person who is the subject of the information is called) can arise. First of all, at the point of gathering the information, the Data Protection Act does not, on the whole, say much about gathering.

  Q526  Lord Rowlands: So you can gather it without permission, without consent?

  Professor Feldman: Yes. The Data Protection Act kicks in particularly once people hold personal data, because it controls obligations in relation to the security of storage of data, the period for which it can be held, the purposes for which it can be processed and the ways in which it can be processed, the circumstances in which it can be disclosed to others and the rights of the data subject in relation to the information, and they include, generally speaking, rights, for example, to find out what information is held by a particular agency, a right to ensure that it is accurate, a right to ensure that it is only processed for the legitimate purposes for which it is being held and that disclosure meets the sort of criteria that are set out in Article 8 of the European Convention, and there is a regulatory regime which is pretty effective, on the whole, at coping with that. The difficulty with it is that there are limitations on the circumstances and the extent of the obligations to the data subject where information is held—for example, for crime prevention and crime detection purposes—and right the way through the provisions there are exceptions that say that certain of the rights of the data subject and the data protection principles do not apply or do not apply with their full force if the applying of them would seriously prejudice the ability of the agency to do its proper job.

  Q527  Baroness O'Cathain: Professor Feldman, you gave all those instances about the rights to whom the information can be disclosed. Is there any right for people to sell the data? For example, an enormous number of marketing groups actually go and buy data from state agencies as well as from everywhere else, and I do not think that the ordinary man or woman in the street has really got any idea of the extent of this, but is that covered by these rights that they can actually sell it, a state agency can sell the data that they hold on individuals for a considerable price, if they want to?

  Professor Feldman: In principle the general answer is that there is no right to sell data unless the data subject has agreed to that use of the data. It is hard to imagine a situation in which the sale of data could fall within one of the legitimate justifying purposes under either the Data Protection Act or the European Convention, Article 8. There are, however, a number of isolated statutory situations in which the sale of data may be authorised. For example, I think, although I do not have this at my fingertips, there was a statutory provision that allowed doctors to sell certain medical data to drug companies for research purposes, but that is always an exception to the general principle.

  Q528  Baroness O'Cathain: Can I pursue that point? People are still not aware that it is being sold. For example, if you subscribe to a magazine like Vogue, et cetera, there is always on the bottom of it a little box that says, "Are you agreeable that your details can be sent or given to other people?" They never say, "Can be sold to other people". I am wondering, is there any way of stopping this, because, in fact, at the other end of the process there is an enormous amount of junk mail which goes through every letterbox in the country of anybody who subscribes to anything or is on the data register, which is just so infuriating, and it is all being sold. Is there anything to stop it?

  Professor Feldman: If the information that is held is personal information, then I see no reason why a complaint to the Information Commissioner would not have a good chance of success. If it is not personal information, then the—

  Q529  Baroness O'Cathain: Are names and addresses personal information?

  Professor Feldman: Addresses would be, yes.

  Q530  Baroness O'Cathain: It is widespread, I can assure you.

  Professor Feldman: Residential addresses.

  Q531  Lord Peston: In fact, you have answered virtually all of my questions apropos of the Chairman's question, but there are two concepts or words that keep appearing here. One is the word "creeping"—creeping when it comes to surveillance. In other words, it is not happening as a planned change in our society, this creeping, it is your view that what we are observing here is a sort of creeping increase in these things. The second question, which may be less for a lawyer and more for a sociologist, is: is this creeping phenomenon inevitable or not?

  Professor Feldman: There is certainly creep, yes, and it may well be inevitable because one of the features of legislation that confers new powers on any agency is that they start by conferring it to deal with what is billed as an exceptional problem or threat, and usually the power is nicely limited and it is subject to carefully thought out safeguards which provide a graduated system for ensuring that the use of the power is properly limited and proportionate. It then becomes, as it were, normalised and increasingly drifts across into other functions, other agencies, and at the same time what tends to happen is that the safeguards, which were carefully thought out at the initial stage, get watered down, and that is a pattern which has been a common feature of police powers, data sharing powers, a whole range of powers to obtain and then use information across a very wide range of statutory fields. If that is a sociological observation, then I suspect that it is inevitable.

  Q532  Lord Peston: The example I was going to use, but in fact it slightly anticipates question three, is Terminal 5, where they were going to use fingerprinting—I think it was for 48 hours per person—simply as a way, as it were, of protecting various things inside the terminal. That seems to me an example of creep in the most forthright terms. It would never have occurred to someone a few years ago, surely, that an organisation, in this case a private one, would use fingerprinting as a method of dealing with passengers.

  Chairman: This is the British Airports Authority?

  Lord Peston: The British Airports Authority.

Chairman: New Spanish practice!

  Q533  Lord Peston: Or whatever it is. The Spanish practice is actually for methods of stopping things happening, particularly employment for non-union workers! Is that not a good example of what would have been regarded as simply laughable even ten years ago, that an organisation would think that? There was a fuss, and so it got dropped, but the fact is that they thought that that was a perfectly reasonable thing to do.

  Professor Feldman: Indeed. One of the interesting things about the fuss was that it was led by the Information Commissioner, and it was led by the Information Commissioner because although the British Airports Authority is a private organisation, it is subject to the Data Protection Act, so it falls within the jurisdiction of the Information Commissioner and the Information Tribunal and it is a good example, I think, of how the protections offered by the Data Protection Act can be effective both at the planning stage, the pre-implementation stage, and at the subsequent stage. The position is rather different if one looks not at the data protection aspect directly but at, for example, CCTV surveillance: because there we are in a situation where for the last ten or 15 years the number of cameras in public and private spaces has grown exponentially; at the same time there is no regulatory regime at all. The security industry has a rather weak self-regulatory code of practice, individual local authorities have their own codes of practice, but the only thing that we have in legislation is a blanket authorisation for local authorities to set up cameras in public places for the purpose of crime protection and prevention. There nothing restrains it, and if one looks, for example, at the Home Office website, where one might expect to find the Executive would begin to support the regulatory process in some way by laying down standards, more or less all you find, or all I found a couple of days ago when I had a look, is a very large number of circulars and notes of guidance for people as to how to make their CCTV coverage most effective from a technological point of view, and that, I think, is a sign of failure of responsibility.

  Q534  Chairman: Can I ask as a supplementary, before moving on to Lady O'Cathain, Professor Feldman, if you think that surveillance or data collection represents a threat to constitutionally established understandings of citizenship in this country and if the Human Rights Act and the Data Protection Act provide adequate protection for privacy or if there is a need for additional constitutional protection of citizens in connection with surveillance and personal data and, if you think there is such a need, what form might it take?

  Professor Feldman: My Lord Chairman, as far as the constitutional understanding of citizenship is concerned, we discussed a few minutes ago how the changing idea of citizenship had been moved from subject to citizen and how it had not actually, in my view, been reflected in any valuable enhancements in the freedom or rights of the newly defined citizens; so I do not know that there is a constitutionally established understanding of citizenship in the UK and, that being so, it is hard to know how these technologies might affect it or change it. I do think that there is an effect on the relationship between various arms of the states. If I can enlarge on that a little bit, the process that I have already mentioned, whereby powers are conferred on administrative agencies with very wide discretion, with very little in the way of controlling or constraining principles, does provide a shift of power between the central executive and Parliament and agencies out in the fields doing things with information and obtaining information, a distinct shift of power, new power, to those agencies in the field. I also think that we have a responsibility as a state, the legislature has a responsibility, to make sure that a coherent look is taken at the grounds on which these activities could be undertaken, the people by whom they could be undertaken and the purposes for which they could be undertaken and then the use that could be made of the information afterwards. There is a patchwork of pieces of legislation, some of which are actually very good at setting standards and criteria. For example, I think the Regulation of Investigatory Powers Act 2000 did a good job on the powers that it covers for the agencies that it covers; I think the Data Protection Act 1998 did a good job as well on the data protection side of things. There is nothing on the sort of issues relating to control of surveillance in public space by camera and film. There is a certain amount of academic literature on the effects of that, but there is no legislative attempt to oversee that, and that is unfortunate. I do not know whether I have answered your question.

Chairman: Indeed you have. Thank you very much.

  Q535  Baroness O'Cathain: Is there something inherent in this exercise of surveillance power that means that it is a threat to the rule of law and the notion of accountable constitutional democracy? Are there state employees who, in order to protect the Rule of Law, should be particularly subject to restrictions on their surveillance activities?

  Professor Feldman: The answer to the second part of the question, I think, is yes, but then I think the answer to the second part of the question has to go on to say it already is to a large extent regulated. Where state employees are doing it, it is regulated by the piece of legislation that I have just mentioned, plus the Human Rights Act 1998, and the case law from the European Court of Human Rights became relevant as a result of that Act. The answer to the first part of the question is that I personally do not think that there is anything inherent in the nature of surveillance and data collection that raises problems of that kind; it all depends on the form of the legislative scheme, if any, that is put in place to regulate it and the methods of accountability that are put in place. If you have surveillance introduced without any form of regulation or accountability other than legal law or effectively political, then there is a serious problem, but that is contingent on the way in which the legislature allows schemes to be introduced rather than being inherent in the schemes themselves.

  Q536  Baroness O'Cathain: Can I give a hypothetical example? Say, for instance, there was a gang of 20 or so youths in a shopping precinct on a Friday night, having had far too much to drink probably, and they suddenly come across the surveillance cameras and they decide that they just do not like this and they do not see why they should be the subject of surveillance, no matter what they were doing, and even if they were not drunk, and if they decided to knock out these cameras they would be breaking the law, obviously, would there be any excuse for them so doing? Surveillance can actually be quite threatening, irritating and infuriating.

  Professor Feldman: They can, and there have been studies of that sort of thing. The Home Office itself has done a study on the effects of CCTV surveillance, and there have been a number of sociological and psychological studies, including one or two by my colleague in Cambridge, Professor von Hirsch, looking at what sort of interests, psychological interests, are affected by surveillance and how. There are some consistent themes in the admittedly rather sparse literature. One is that CCTV surveillance can be very beneficial in at least discouraging or perhaps displacing certain kinds of offence and to that extent can be very reassuring to some people who find it helpful to have what feels like a more secure or less insecure environment. On the other hand, there is a compromise involved, a cost involved, in that, and that is that we may reduce our capacity to be ourselves in public spaces, and by "public spaces" I mean what are actually technically private spaces like shopping arcades as well. It is easy to see how one might feel intimidated, for example, if one were a gay couple holding hands in a public place if one thought it might get back to one's employer. One can see how it might look intimidating if one wanted to behave in a way that is perfectly lawful but a little bit abnormal; it leaves no space for withdrawal when one is in public; it leaves no space for collecting one's thoughts and moving on. That is a loss, which can be a significant loss, and it is hard to quantify the importance of the loss, but it is a fact, I think, that in Cambridge, for example, it is more or less impossible to walk 100 yards without being captured on at least one security camera. That I find slightly worrying.

  Q537  Baroness O'Cathain: But then again, if somebody just gets really furious about that, they might just be walking along the street in Cambridge and just say, "I have had enough of this", and get a brick and throw it at it.

  Professor Feldman: Yes.

  Q538  Baroness O'Cathain: That could be constituted as actually encouraging problems.

  Professor Feldman: May I suggest a number of matters that might need to be thought about if one were trying to decide whether that would be justifiable. First of all, it would be more justifiable to do that, I suggest, if one discovered that one was being covertly surveyed than if one knew that surveillance was taking place. Secondly, it might be more justifiable to take direct action against the surveillance if one knew or suspected that there was no effective regulation in place, apart from your direct action, to control the places where the surveillance was taking place, the circumstances where it was taking place and, perhaps most importantly, the use that could be made of the tapes. Thirdly, it may be that one would feel more justified in taking direct action if the nature of the surveillance were more rather than less intimate. For example, one could have different kinds of camera surveillance. One could have a generalised sweep with no focusing possibility—that is a relatively low level of intrusion; one could have focusing and zoom capacity, which would allow the operator of the camera to target particular people without letting them perhaps know that they were being targeted—that is more intrusive and might, justifiably, elicit a more aggressive response; and then if one knew or discovered that there was an audio capacity as well (there is in some of these cameras, although a lot of local authorities have accepted in their codes of practice that they will not make use of audio capacity), that would be a very serious interference with one's intimacy and ability to carry on ordinary, private conversations and activities and would be much more difficult to justify and so perhaps might make it easier to justify direct action. I am not exhorting anyone to go and take a brick and smash your nearest camera, but those are the sorts of nuanced considerations that too often get ignored when one tries to think about things in very broad terms. The reason, I think, that it is ignored, although I should say not by Professor von Hirsch, on whom I have drawn for some of those distinctions, is that there is no legislative scheme. The legislature has never turned its mind to these issues.

Chairman: Until today.

  Q539  Lord Woolf: I wonder if I may ask a question following up from your answer. Professor Feldman, I apologise that I was late. Is there any concept of self-help in relation to breaches of the Human Rights Act? Has that ever been considered by the courts?

  Professor Feldman: As far as I know, it never has.

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2009