I’m away places foreign at the moment, delivering a keynote on data protection and data governance stuff in an EU country where everyone was shocked and horrified to hear what a cack handed job of Data Protection compliance Irish Water was making.
I was hoping to leave Irish Water alone. But they’ve apparently gone and done another SideShow Bob on it and trodden on yet another Data Protection compliance rake.
@daraghobrien @NewsNeil13 @Tupp_Ed Apparently IW staff posing as construction workers are filming protesters at IW installation sites
— Fred Logue (@fplogue) October 10, 2014
So. We now have covert surveillance by a company. I’m sure that’s something that the DPC has had some thoughts on in the past. But before we do that, we need to distinguish between recordings by the police, or revenue/customs authorities and recordings by private individuals or companies. The distinction is simple: the police can process data (i.e. record) where the processing is necessary for the prevention, detection, investigation, or prosecution of an offence. Their law enforcement function gives them a little lee way around things like fair processing notices etc (it defeats the purpose of a police covert surveillance operation if they have to have a big, visible sign and flashing lights).
With regard to other forms of CCTV recording, the Gardai have produced this helpful document for people who are installing CCTV systems. It’s not as helpful as it might seem at first as its focus is on ensuring that the recordings are admissible in court as evidence and it spends a lot of time on the rules of evidence for CCTV in court. It fails to mention that CCTV recording constitutes processing under the Data Protection Acts and, therefore, requires that the Eight Principles of the Data Protection Acts be complied with by anyone who is not a member of a law enforcement agency in the State. The Data Protection Commissioner’s Guidance on CCTV can be found here.
Use of recordings, particularly covert recordings, is a very tricky and complex area to get right from a Data Protection point of view as you are balancing competing rights.
- The data must be obtained fairly
- It must be obtained for a specified and lawful purpose
- It cannot be used for a purpose that is not compatible
- It must be kept safe and secure
- It should be kept accurate, complete, and up to date
- It must be adequate, relevant, and not excessive (i.e. proportionate to the purpose)
- it should be retained for no longer than necessary for the purpose
- Data subjects have a right of access
Fair Obtaining/Processing/Not incompatible use
Where covert CCTV is installed by an organisation to investigate a specific instance of an offence, then the DPC has historically taken the view that this is reasonable, but only if it does not infringe on the rights of people who are not committing that offence. Given that peaceful protest is not an offence, covert recording is excessive unless there is an offence being committed, but a public CCTV system with appropriate Fair Processing notice and statement of recording and the purposes for that recording would be OK . The relevant case study from the DPC is here. – note it is filed under both CCTV and “Fair Obtaining”.
The DPC picked up the thread again in 2009 with a complaint about covert CCTV filed against Westwood Fitness. Again the issue for the DPC was the fairness and transparency of the processing. Specifically they stated that:
any monitoring must be a proportionate response by an employer to the risk he or she faces taking into account the legitimate privacy and other interests [of others]
and thatthe
in terms of meeting transparency requirements, staff must be informed of the existence of the CCTV surveillance and also of the purposes for which personal data are to be processed by CCTV systems.
In the Westwood case, Westwood stood down their CCTV, terminated all staff disciplinary proceedings that were based on CCTV evidence, and were found to have breached the Data Protection Acts.
If Irish Water are engaging in recording for the purposes of prevention or investigation of criminal activity that might occur, any use AT ALL for any other purpose is incompatible with that, so sharing, distribution etc., except to An Garda Siochana in the course of an investigation, would be unlawful.
[Update – inserting a statement of the bleedin’ obvious]
But if An Garda Siochana are already present, for the purposes of preventing crime, detecting its occurrence, and taking action if criminal acts take place, what is the lawful purpose of any recording? CCTV is used in shops because the gardai are not there all the time so need to have some tools to help them track down ne’er-do-wells when a crime occurs as, despite earnest hopes to the contrary, Doctor Who’s blue police box never really made it as a default tool in modern policing.
So, what is the specific purpose for which Irish Water is engaged in recording, covert or overt, at water meter protests, given that the constabulary are already in attendance?
[/update]
Suggestion:
- Add a section to the Irish Water Data Protection notice to the effect that “from time to time, in order to help ensure the safety of our installers and contractors, and for the purposes of preventing and detecting criminal activity, we may use CCTV recording equipment in the vicinity of engineering works on behalf of Irish Water. These recordings will be retained for XX days”.
- Don’t use a covert surveillance system disguised as workers. Use a massively visible camera and an audible warning (for the blind among us) that alerts people to the fact of recording. It will either deter criminal acts or lead to one happening. It all depends on how Irish Water handle the escalation.
- Don’t act like you are sanctioned and authorised police officers engaging in covert surveillance. Even though there are exemptions for law enforcement under the Data Protection Acts, constitutional privacy rights still apply and even the Gardai are bound by certain rules and protocols on the use of covert video surveillance under the Criminal Justice (Surveillance) Act 2009, not least that a senior officer can only approve surveillance of an individual for 72 hrs for an “arrestable offence”. Revenue published a useful guideline to their interpretation of that legislation in 2010. TJ McIntyre put it here. Of course, if you are standing in a place to which the public has access (i.e. on the road) that means the 2009 Act may not apply even if the Gardai are recording you, but the Data Protection Acts still do!
- If there are specific individuals who Irish Water wish to gather evidence against in relation to the commission of offences, then I would suggest filing an appropriate complaint with the Gardai and allowing them to make the decision as to the appropriate approach to evidence gathering and the handling thereof.
Subject Access Request
Irish Water should bear in mind that, as Data Controllers, they are subject to subject access requests for information that is recorded by CCTV (whether overt or covert) or by way of photography or audio recording. The address to write to to make a request is on the Irish Water website (www.water.ie).
Use of Contractors to take recordings (Data Processors)
If Irish Water has engaged a firm to engage in covert recording, that firm are a Data Processor. Irish Water will be liable for any unlawful acts of that Data Processor. The recent prosecutions of private investigators for unlawful obtaining of information should be a warning to any organisation engaging 3rd parties to obtain data on individuals through blagging, surveillance, or other means, that the Data Protection Acts apply and are being enforced.
Irish Water need to ensure that there is a contract in place covering this activity and the means by which the data is being obtained, processed, stored, and retained.
Retention
Irish Water need to have a retention period for these recordings. The current “for as long as required by law” response from Irish Water’s customer service team is, frankly, insipid nonsense. The DPA does not specify a period for retention, so you need to nail down either a policy (28 days) or a specific statutory purpose, and exemptions to that (i.e. “or for the duration of a criminal prosecution and related appeals”).
The Kicker
Of course (and this is where I will INSTANTLY become unpopular with all the people who’ve been hanging off my earlier missives on Irish Water’s Data Protection woes) ANYONE ELSE who is engaged in recording for anything other than a “domestic purpose” needs to be very careful that they too are not breaching the Data Protection Acts.
Journalists have a journalistic exemption they can rely on where there is an intent to publish a story. Sean Q Ó Pobail who wants to post the video to Youtube needs to bear in mind that the domestic exemption is not the same as a “non-business” use. A recent case on CCTV has raised these issues and the Advocate General’s opinion (which may or may not be followed by the CJEU) was that video surveillance of others could not be considered exclusively “personal” within the meaning of the Directive, although it could be within the scope of “domestic” processing. However, when that processing extended into a public space, it could not be considered exclusively domestic due to its impact on others, who may wish to protect their privacy. There is a good analysis of that case here.
So, while Joan Bruton might jump on a minefield by complaining about the smartphones and tablets being used, the people engaging in recording need to be aware that the Data Protection Acts can cut both ways and care should be taken with the use of and disclosure of any images that are recorded.
Of course, you might be able to argue that the recording by protestors would fall under a “legitimate interests” exemption where they are using the recordings to document the lawfulness of their actions and peaceful nature of their protests. That still can carry with it an obligation to comply with a Subject Access request. If there is an intention to produce a news item for publication (online, on air, in print media) then that would likely be covered by the journalistic exemption under the DPA and all that goes with that.
But if protestors are intending to use recordings as a tool of intimidation against Irish Water workers (who are, like it or not, simply doing a job to put bread on the table and keep a roof over their heads) or to gather “intel” on Irish Water staff, then complaints about Irish Water recording them ring somewhat hollow.
If you are publishing, pay attention to the need to protect privacy even in a publication – are you ready to redact faces from videos? Do you know how?
If you are just recording in an attempt to intimidate… please stop and think how it makes you feel when someone does it to you. Don’t be a hypocritical asshat with an iPhone.
Suggestion: Protestors engaged in recording also clearly state and communicate their purpose for recording events in the area. Journalists try to identify themselves when covering large public events, if you are a “citizen journalist” don’t hide behind the keyboard – identify yourself as such. If you are engaging in journalism, be a responsible journalist. Balance free speech with respect for privacy. Be a better person for it.
Conclusion
Both sides here should educate themselves quickly on the issues and risks involved in recording in public places. Both sides need to put in place appropriate protocols to ensure that they are complying with the Data Protection Acts. Covert recording is invasive and disproportionate in most circumstances, and one of the touted benefits of CCTV is not the recording but the deterrent effect of people being aware that recording is happening. If everyone declares their recording, their purposes for recording, and other items necessary for compliance with the DPA, we might at least reach a stage of mutually assured destruction, an audio visual cold war.
But at least we’ll have some respect for fundamental rights.