Surveillance: Citizens and the State - Constitution Committee Contents

Examination of Witnesses (Questions 540-559)

Professor David Feldman

2 APRIL 2008

  Q540  Lord Woolf: I am not aware of it.

  Professor Feldman: It would probably depend on some doctrine of necessity. It would be quite difficult to establish in those circumstances.

  Q541  Lord Woolf: I dare say. We have now, I think, come to a situation where in this jurisdiction we adhere to a principle of separation of powers. Do you consider that the extent of the surveillance and data collection activities that are taking place have any impact on the separation of powers?

  Professor Feldman: I do not think, my Lord, that it has any direct impact on the separation of powers, but the separation of powers may have implications for those kinds of activities. For example, in other jurisdictions where the separation of powers has long been a central constitutional principle—for example, the Australian Commonwealth—it has been held that warrants, when required to authorise interference with private space, or private lives, or interception of communications, must not be issued by a judicial authority because the issuing of warrants, the authorising of that sort of activity, is classified as an executive or ministerial act rather than a judicial act, and so it breaches the separation of powers to have it authorised by a judicial officer. That is something which we would, I think, find rather difficult in this country and rather strange, but it does raise questions about the extent to which one might want to look at the allocation of power, the nature of powers—executive, legislative and judicial—over authorisation processes for different kinds of surveillance or data collection. Secondly, take management or regulation of the storage and implementation of authorities; and then final decisions about the way in which the activity had been conducted, interfering with people's rights or breaches of legal obligations. The last of those is clearly a judicial function. I think it should ideally be carried out by a judicial authority. The first may or may not be; the one in the middle, I think, is not.

  Q542  Lord Woolf: Do you see any need, in order to maintain the separation of powers, to make any particular agency of state power subject to restrictions on their surveillance and data collection powers?

  Professor Feldman: Yes, my Lord, I see some really quite serious problems where there is a gap in the authorisation and so in the legal accountability for certain of these powers. I can draw attention particularly to two. One is the use by local authorities of—I come back to it again because I think it is a major gap—CCTV and similar surveillance and the use of the information that flows from that; and, secondly, responsibility for information sharing where a particular agency has quite legitimately exercised a statutory power to acquire or store personal information and then is given a very wide discretion as to the circumstances in which he can share that with others. Youth offending teams, for example, are a classic example of that, where although the person who originally held the information remains subject to Data Protection Act obligations in relation to the information, that person is also enjoined to share it with education or health professionals and it may well lead to a situation where it is not at all clear who is accountable or responsible for the use made by those further bodies. I would like to see something done about it.

  Q543  Lord Woolf: Obviously, from what you have said, there are circumstances where you see a need for greater protection than we have already. From a constitutional perspective, who would you see as best placed to protect the constitutional rights in this area against over zealous surveillance and data collection? Should it be the role of Parliament or some other independent body or both? We have heard from the Commissioner.

  Professor Feldman: Yes. I think the Commissioner does a very good job. I think that the question has to be answered in relation to the various elements in the collection and processing of data. It is clearly the responsibility of Parliament to establish, if possible, generally applicable criteria for bodies that are going to be given power to use powers to obtain information and then store and use it. The statutory regimes are at the moment rather a patchwork quilt. Each in its own terms is quite valuable and well thought out, although there are gaps, but I think that the legislature does need to look at the overall distribution of these powers and decide on the criteria—only Parliament can do that job—and introduce some sort of consistency into the picture. When it comes to the regulation of the powers that are granted, that seems to me to be outside the functions of Parliament, although the individual select committees of each House have a role in reviewing the use of powers, but on a day-to-day basis that has to be the job of the dedicated regulator, or regulators, and I think, on the whole, we are fortunate in the ones that we have. We may want more and we may want to extend the jurisdiction of the ones we have to cover other areas.

  Q544  Lord Woolf: Regulators rather than parliaments.

  Professor Feldman: Regulators rather than parliaments. The idea of parliaments trying to carry out micro-management or micro-regulation of, and advice to, the work of people gathering and using information seems to me unrealistic now.

  Q545  Lord Woolf: You obviously see a need on the larger plain for developments, I think is implicit in your answer, by Parliament. How could things be made more effective in scrutinising the Government's creation and use of surveillance and data collection powers?

  Professor Feldman: I suppose that that could be done through orthodox techniques, by giving effect to individual ministerial responsibility for each House, by raising questions, taking evidence from ministers and their officials in the way that select committees do. That may well be useful, it may well be very useful, in working out what might be done where something has obviously gone seriously wrong in the Government's management of its data responsibilities through, for example, loss of large amounts of personal data, something of that kind. I think it is less effective where one is dealing with agencies outside the central government, simply because of the limited capacity to make ministers responsible for activities of outside agencies, and it is particularly likely to be ineffective where one is dealing with private individuals, private organisations that are using powers, as is happening a great deal. Now I think one relies on a regulator operating outside Parliament.

  Q546  Chairman: Before turning to Viscount Bledisloe, can I jump back briefly to the separation of powers? You mentioned the position in Australia. The Committee is going to be taking evidence in the United States later in the month. Do you think that the interception authorisations by the judiciary in the United States, the judicial authorisation interceptions, breach the separation of powers?

  Professor Feldman: One of the things about the separation of powers is that it is, like any other constitutional principle, to be interpreted in the light of the constitutional arrangements in a particular state. I think that we would not say in this country, traditionally we have not said, that the issuing of authorisation, for example, to search premises by a magistrate or, indeed, by a county court or high court judge breaches the separation of powers because we have a different view both about the separation of powers and about the classification of that function as judicial or ministerial; so I think whether it breaches the separation of powers in the USA will depend on the view taken by the USA of its own constitutional separation of powers and can only be seen in that context. I would not want to try to import it any more than I would want to try to import the Australian model.

  Chairman: I think, Professor Feldman, you ought to be a politician.

  Q547  Viscount Bledisloe: Is it right that, in so far as the collection of personal data is concerned, the private sector is less constrained than the public sector, for example, because Article 8 does not apply to the private sector?

  Professor Feldman: Yes and no, my Lord.

  Q548  Viscount Bledisloe: The "yes", I can understand. Could you explain the "no"?

  Professor Feldman: The "yes", as you have said, the Human Rights Act and the obligations that are imposed directly by Article 8 of the European Convention do not apply other than to public authorities. The "and no" is slightly more complicated than that, first because the European Convention on Human Rights as interpreted by the Strasbourg courts imposes on states positive obligations, which include in some situations obligations to regulate the activities of private individuals or bodies to ensure that they do not do something which impacts on other people's Convention rights, and it is through that kind of indirect mechanism that the courts in this country have been able to develop, for example, the law of breach of confidence in ways that give protection to some Article 8 interests that would have been undreamed of 15 or 20 years ago. The other side of the "and no" is that the Data Protection Act applies to private as well as the public users of personal data. There is no distinction there, and in some ways you might say that, as far as that Act is concerned, the constraints on private users of information are stronger than those on at least some public agencies because the private agencies are less likely to be able to make use of the limitations on their obligations, for example cases involving protection or prevention of crime or protection of national security or the exercise of regulatory functions.

  Q549  Viscount Bledisloe: In the light of that, do you see a worry and a danger in the sharing of personal data which has been collected in the private sector with the public sector or vice versa?

  Professor Feldman: There is a significant risk that, where information is collected by the private sector for the business purposes of private sector organisations and is then shared with the public sector, the person who provided the information will not know and will not be able to find out, first, that the information is being shared and, second, that it is being used by the other agency for a purpose completely different from that for which the information was originally provided. What is effectively able to happen is that information which is provided by a person for the purposes of that person ends up being used by a completely different agency for purposes that they may be either not for the benefit of that person or directly contrary to the interests of that person. For that to happen without some clear process of authorisation and decision-making and perhaps information being given to the data subject is a matter of concern, and it operates mutatis mutandis in the other direction as well.

  Q550  Lord Rowlands: I think on a number of occasions you have touched on the role of Article 8 as a good basis for the protection of privacy rights. Do you think the exemptions in Article 8(2) are too broad, and, if so, in which way would you restrict them?

  Professor Feldman: I think the exemptions in Article 8(2) are in themselves perfectly satisfactory, but we come back to the point that was raised in my Lord Chairman's question, I think, earlier about whether proportionality is a satisfactory basis for protecting rights. I have no problem with any of the legitimate aims that might justify an interference with the rights under Article 8(1). I think, in fact, that one needs fairly broadly stated legitimate aims for two reasons: first, privacy related rights are inevitably the subject of suspicion that they can be used for illicit or improper purposes, and so the possibility of control or limited interference over a wide range of purposes is quite sensible; second, because the European Court of Human Rights has interpreted the scope of the right in paragraph (1) of Article 8 so incredibly broadly as covering more or less now any aspect of any person's personality or life-plan, that for practical purposes one almost never sees the Strasbourg court say, "This interest, which is asserted as an Article 8 interest, actually falls outside Article 8". The whole focus, therefore, has been on the justification for interfering with the rights under Article 8(2), and where one has an immensely wide set of rights, then it makes sense to have a similarly flexible and adaptable set of justifications potentially for interfering with the right. The core of the question is how robustly do, first of all, initial decision-makers, and then reviewing commissioners, tribunals or courts apply the pressing social need for the interference and proportionality of the interference tests, because that is crucial? If it is done robustly and with careful attention to the detailed circumstances of each case, as it is done typically by the Information Commissioner and the Information Tribunal, then it works well. As I said earlier, the more one allows an attitude to creep in that one will, other things being equal, assume that the decision-maker made a sensible decision, the less effective it will be and the more need there may be to put some extra tension into the way that the Article 8 right is—

  Q551  Lord Rowlands: Just completing what you are saying, you do not think we should try to redraft Article 8(2), but it is in the application. Has the experience to date shown that in fact this balance has been generally speaking held, the kinds of tensions you have described have produced sensible and reasonable outcomes?

  Professor Feldman: On the whole, I think the answer is, yes. In fact, the Strasbourg court has shown an interesting tendency to be very critical of the use particularly of personal information and photographs by state agencies. For example, it has held that it breaches Article 8 and it is a disproportionate interference with Article 8, without a special reason, to publish photographs of people who have been arrested and charged with criminal offences in the case of Sciacca v Italy. It has also been held in Strasbourg that the state, Germany in this case, was unable to justify a gap in its constitutional law in the protection for privacy of the individuals against having photographs of those individuals published in the press even where the individuals concerned might be described as public figures; so it means that you are seeing at the Strasbourg level pretty strong attention to the impact on individuals of particular forms of interference with—

  Q552  Lord Rowlands: The political test will be the DNA cases.

  Professor Feldman: Yes, exactly, which I am looking forward to greatly.

  Q553  Lord Peston: I am still a little puzzled about the human rights aspect of the concept of the purpose for which the data was collected, which you have referred to several times. To take one within my own field, which is economics, we fill out a tax form for the purpose of the Government taxing us, but that data, as I understand it, becomes the basis for calculating national income as part of the large input into that kind of calculation, and there are many other examples of that without which there would not be the massive economics data economists rely on in order to do their subject. What would happen? Is there a human right in your concept of you saying, "I do not want my tax form to be used in calculating national income"? Most people would regard that as crackers, and yet your concept of purpose seems to me to lead to that being a valid position that you could take. I am just a little puzzled. I honestly do not see your human rights being infringed very strongly by ONS being able to calculate national income via, partly, what the Revenue tells them is coming through from the tax form.

  Professor Feldman: I agree.

  Q554  Lord Peston: I am prejudiced here because I want to defend the ability of economists to do their subject.

  Professor Feldman: You are right to defend their subject. I think the answer is that one has to look at the form in which the information is used. When we fill in our tax returns, the information is clearly personal: it relates to identifiable individuals and is used for the purpose of calculating the tax due from those individuals; but one can both anonymise and aggregate information in ways that make it cease to be personal information. At the point where it is anonymised and aggregated, the information ceases to be personal information because it is not capable of being used to identify anything relating to a particular individual. At that point there is no reason why it should not be used for calculating national income or, indeed, anything else. It has to be said that we are already a great deal less protective of personal confidentiality in the tax system than we were 210 years ago when income tax was first introduced, because the schedule system for income tax was originally introduced so that each schedule, or income under each schedule, was returned to a different inspector so no one person ever knew the total income of any person, and that was the purpose of the schedule system.

  Q555  Chairman: One of the purposes.

  Professor Feldman: It got undermined when the basis for income tax moved to total income in the early seventies.

  Q556  Lord Peston: So we protect your human rights by aggregation and anonymity.

  Professor Feldman: Yes.

  Q557  Lord Peston: Our pledge to you then is that that is what we do, and sometimes we may fail.

  Professor Feldman: Yes, the same applies in other contexts: the aggregation and anonymisation of medical information that is needed for health planning and statistics.

  Q558  Baroness O'Cathain: Does the existing law of breach of confidence compensate for the deficiencies of Article 8? Is privacy better protected through the tort of breach of confidence?

  Professor Feldman: It depends on what you think the deficiencies of Article 8 are, but my view of that is as follows. As a matter of domestic English law, leaving aside completely the statutory regimes of the Data Protection Act and the human rights regime, the only credible candidate for protecting privacy as a matter of domestic common law was breach of confidence, but breach of confidence protects only particular types of privacy. It protects privacy in relation to information and there has to be something in the nature of the information which makes it of a kind that makes it sensible to be regarded as confidential. A lot of the constraints around the use of breach of confidence have been relaxed by the courts, and Lord Woolf in his judicial role made a substantial contribution to the development of breach of confidence in that way, but it still remains, essentially, an information-based remedy. It is very difficult to use it to deal with the process of acquiring or collecting information through general surveillance, for example, because much of what is collected simply would not be regarded, even arguably, as confidential even though it might be an important aspect of people's ordinary private lives. Nor does it provide a basis for giving protection against harassment as such. All of that relies on other statutory regimes and Article 8 of the European Convention. I think my answer to your Ladyship's question is that I see breach of confidence, as developed in the light of the Human Rights Act, as a useful hand-maiden to the protection of privacy of information, but not as something that could ever take the place of Article 8 or the other statutory regime.

  Q559  Baroness O'Cathain: As a supplementary to that, do you think the development of a separate tort of privacy would help to protect the privacy interests of individuals and organisations?

  Professor Feldman: If we could do it, it would help. It would have, I think, now to be done by statute, as I think the courts have effectively painted themselves out of the picture by a number of decisions which, with respect, I found slightly disappointing, but the ultimate one, in a case Wainwright v Home Office, which simply reaffirmed the absence of a privacy right at common law, means that for practical purposes we are going to depend on legislation and the Human Rights Act.

  Viscount Bledisloe: I think that last answer has very clearly and concisely answered my question. Lady O'Cathain having volunteered to ask it has meant that I do not need to.

previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2009