Archive for category: News

Most of the issues concerning cookies do not involve privacy or data protection but rather whether they are malicious, slow down your computer or cause pop-ups. Nevertheless, there are some issues concerning privacy and data protection that some people misunderstand. Many fear that cookies make them personally identifiable and track all their on-line activity, which they make available to the companies that manage websites. Neither of these is true always. It is important to understand what cookies are, how they work and what risks they pose.

What is a cookie?

A cookie is a small text file that a website places on your hard drive for different purposes when you access the website. Some cookies are limited to your one browsing session and disappear automatically when you exit your browser. These cookies do not appear on your hard drive and do not collect information from your computer. Other cookies are permanent, in that they do not disappear when you close your browser. They can identify individual users and track their surfing activities on a particular website. They also track information such as the total number of users, the average time users spend on a page and the overall performance of the website.

Normally, the website you are visiting will place the cookies on your hard drive. These are call ‘first-party’ cookies.  They remember what you have added to your shopping basket or data you have put into on one of their forms. Other companies, such as Google Ads, may also put cookies on your hard drive. These are ‘third-party’ cookies. They are responsible for you seeing adverts for the same thing popping up repeatedly on different sites.

The webserver sets the information contained in the cookie and the server can use it whenever you visit the site. Cookies make your user experience faster and easier by remembering details, such as your preferences, registration details or the contents of a shopping cart. Without cookies, you probably would have to re-enter data every time you returned to the same webpage. They are not computer programmes, and they cannot disseminate viruses or malware.

Cookies and privacy/data protection

What we are interested in from a privacy/data protection perspective is to what extent cookies pose a threat to privacy. With respect to personal data, cookies only collect what users input directly to a website, such as when shopping, or indirectly through their user activities, such as what pages they view. They do not surreptitiously access other information stored on the hard drive of a computer.

The privacy issues relating to cookies involve the information you give the website or what you do while you are on the website and how transparent the companies are about processing it. The website company must be able to demonstrate that they have a lawful basis under the privacy/data protection laws that authorises them to collect this personal data and use it (including to share with third parties). This is one reason many websites ask for consent to use non-essential cookies and the personal data that users provide.

Browsers enable you to control the use of cookies with a variety of settings. Use the one that is right for you. Privacy/data protection laws will govern how the website owner processes your data with cookies. If you believe that a website owner has processed your personal data unlawfully, you may make a complaint to our office. It is important to note that it is possible for web adverts to reflect the browsing history of the web browser without collecting personal data. It will take a detailed investigation to determine whether personal data has been involved and if there has been a contravention of the Law.

Another common myth is that privacy/data protection interferes with the ability of the police to investigate crimes effectively. That is incorrect; there is an exemption in our data protection law to enable the police to collect, use and disclose personal data that is relevant to the prevention, detection or investigation of crime (including the apprehension and prosecution of individuals). The law also permits public authorities and businesses to disclose personal data to the police to assist with any investigation. There is another exemption regarding subject access requests that permits the police to refuse to disclose information that would damage an investigation. Individuals should not use legal rights of access to information to obstruct an active investigation.

Police Investigations

This does not mean, however, that police have unbridled access to personal data. They are able to collate any personal data that is/may be relevant to an investigation, but they are not entitled to conduct a ‘fishing’ expedition without probable grounds. When police request personal data from a public authority or private business, they should provide the organisation with sufficient information to establish that they are conducting a formal investigation. In some cases, quoting a police file number would be sufficient. In other cases, it might be necessary to produce a warrant. Officials disclosing information to police must be able to demonstrate that they had reasonable grounds to believe that the information was relevant to a formal investigation. Officials should not use privacy/data protection as a blanket excuse not to provide information to police. If they are in doubt about whether the law permits disclosure, they should contact their privacy/data protection officer or regulator.

National Security

There is a similar misconception that privacy/data protection laws put national security at risk. All data protection laws make provision for the processing of personal data for purposes of protecting national security. There is no need for new national security laws to override the data protection laws. Current laws enable authorities to collect, use and disclose all of the personal data required to meet their specific needs. Nevertheless, some security services desire the authority to collect information that is not relevant to protecting national security, just in case it might be useful in future. Privacy/data protection laws strike the right balance between preserving national security and protecting the human rights of innocent people. Information should be available on a ‘need to know’ basis, not a ‘just in case it might be useful in future’ basis. Reports from the United States have indicated that personal data collected allegedly for national security purposes has been used for other purposes.

Community Services

Another myth is that community services caring for mutual vulnerable clients cannot share personal data or discuss coordinated care. Whether it involves children or adults, these organisations may share personal data for providing services to their common clients. There may be some cases where the client objects to this sharing. This does not mean that the law prevents sharing their information in these cases. However, service providers should take into account the wishes of the clients when determining whether to share their information. In the context of integrated services to clients, it is useful to draft an information sharing agreement that sets out what information may be shared by which organisations for what purposes. Parties drafting the agreement should involve data protection experts to ensure that that the proposed sharing conforms to the privacy/data protection laws. The agreement is a useful resource for staff in the field to refer to whenever they receive requests to share data.

As we can see from the numerous examples I have provided, fears about the harm of data protection laws are largely unfounded. Drafters took time and effort to examine all the possible circumstances where it would be in the public interest to process personal data, even without the consent of the individual. They consulted widely to ensure the laws would not hamper the provision of important services to individuals and the community in general. They facilitate getting the right information to the right people at the right time for the right purpose. Where problems exist, it is with the understanding about the laws. Some people believe that they prevent certain types of processing that is legal. If you believe that someone is inappropriately preventing the processing of personal data on the grounds of data protection, ask to speak to their data protection officer or call our office.

New technologies can help to protect staff and secure assets, but it is important to remember that employees do not lose their privacy rights when they arrive at work. The same rules apply to data of employees as to the data of members of the public. If you are considering using biometric technologies, the data protection requirements are even more extensive. These technologies can provide effective solutions to real problems, but it is important to conduct a proper analysis to ensure that they provide the right solution to the right problem.

In cases where there have been documented incidents of violence against employees by members of the public, CCTV has allowed for the identification of offenders and has acted as a deterrent to others. This does not mean, however, that CCTV is necessary in every workplace. CCTV is highly privacy intrusive and the benefit of using it must outweigh the loss of privacy. The key risk is that it collects personal data on everyone within its field of vision, including individuals who are not the intended targets.

Employers should use it only as a last resort, once less invasive alternatives have failed to resolve the problem, such as physical barriers or additional security staff. Before you implement it, employers should have documented evidence of a continuing risk to the business and/or their employees. They will need to consult their employees beforehand, as surveillance can affect their psychological well-being as well as their human rights. It is also necessary to post signs informing the public of the existence of the surveillance, the purpose of the surveillance and the contact information of an office they may contact if they have questions. There needs to be policies and procedures in place indicating where the technology will be installed, who will have access to the data, how long it will be retained, and what technical safeguards will be in place.

Biometric technologies offer convenience of use and greater certainty of identification. However, they also require the collection of special category data on users, and this requires additional protection. Employers will probably need to conduct a data protection impact assessment prior to implementation. This involves examining the reasons why they think they need this technology and whether these reasons are compelling enough to warrant the invasion of privacy involved. For example, what is the security concern that requires the replacement of a pass card with a fingerprint scan or iris scan? There needs to be a good answer to that question.

Generally, employers should not use CCTV or other surveillance technologies, such as keystroke capturing software on computers, to put their employees under surveillance surreptitiously. The technology is not a replacement for proper in-person management supervision. They should not use it to enforce policy. They should not use it to measure employment performance and make decisions about an employee without an employee being made aware that they are going to be monitored in this way.

The only case where it would be acceptable to monitor employees without making them aware of it would be for the purposes of investigating incidents of wilful damage or theft of assets including data, when employers have exhausted other less-intrusive options. Any actions that could lead to employee discipline should follow standard human resources policies and procedures. Resorting to surveillance technologies precipitously can lead to employment tribunals finding against employers, even in cases where the employers’ suspicions are valid. Always consult a human resources advisor prior to implementing surveillance technologies in the workplace. If you were in the employee’s shoes, how would you feel if you were under surveillance and what would you expect from your employer in such a situation?

Surveillance and biometric technologies can provide innovative solutions to some intractable problems, but they involve their own risks and can create new problems. The transparency principle in data protection laws require notifying people when they are under surveillance. However, the sense of being watched can be unnerving and stressful for employees, and this can adversely affect their work performance. Some may make data protection complaints, and the entire situation could cause conflict and undermine positive working relationships unnecessarily and for no tangible benefit to the business.

Surveillance and biometric technologies, like marriages, should not be entered into unadvisedly or lightly; but reverently, discreetly, advisedly, and soberly.

The use of CCTV has become so commonplace that most people have become oblivious to the risks that it poses. In the right circumstances, CCTV can be effective in protecting property and personal safety. Privacy and data protection laws permit the use of CCTV for the right purpose, with appropriate controls.

Nevertheless, businesses and individuals often use CCTV for purposes where it is excessive to their needs and not effective in that it does not help solve the problem they have. Service providers often promote their products aggressively. Some property developers automatically install it in new buildings, whether prospective tenants even want it. This results in the unnecessary overcollection of personal data that can compromise the rights and freedoms of individuals whose images the CCTV captures. It is important for everyone to understand the risks of CCTV and for data controllers to determine its use to be appropriate before implementing it.

Most people are rightly concerned about their personal security and that of the homes, businesses and assets, and they want to take appropriate and effective measures to protect themselves. CCTV is an attractive option because it is inexpensive and widely available. We assume that it will provide a deterrent to crime because it increases the risk to a perpetrator that law enforcement will apprehend them. However, CCTV often also captures the data of many innocent, law-abiding individuals. This raises the risk of someone abusing that data to compromise the rights and freedoms of those innocent people. In that way, if CCTV recordings fall into the wrong hands, they can facilitate crime, as well as detect it. Moreover, being under video surveillance affects how individuals behave and can become emotionally stressful.

Years ago, when I was investigating complaints about the overuse of CCTV in a block of flats, one of the complainants spoke eloquently about the impact of video surveillance:

Surveillance by video cameras has a different effect than other forms of collection of information. Being under a state of constant observation has real psychological effects. … People react differently to being under surveillance. … They feel self-conscious and nervous. They may feel humiliated, and certainly many are intimidated. There can be a sense of personal violation. The psychological impact of feeling under constant observation can be enormous, incalculable. It causes people to alter their social behaviour. Casual behaviour can no longer be casual. [1]

When we take into account how frequently CCTV captures our images during the course of a day in our cities, we see that this effect can multiply.

The question then becomes how to obtain the benefits of CCTV technology, while avoiding the risks. This involves a two-step process. The first step is to determine whether CCTV is appropriate for a particular purpose. Conducting a data protection impact assessment (DPIA) or privacy impact assessment (PIA) will help to answer this question. CCTV is highly invasive and is appropriate only when all of the following circumstances apply:

1. There is a documented current issue with respect to personal security or the protection of property.
2. There is evidence that CCTV will be effective in addressing that issue.
3. All less invasive measures have been exhausted.
4. The benefit obtained outweighs the harm of the loss of privacy involved.

It is important to note that the function of CCTV is forensic: that is to say, that it assists in the investigation of crimes. There is nothing in the technology that explicitly prevents crime. It is only the deterrent effect of the expectation that police are more likely to be able to identify the perpetrator of a crime. CCTV does not prevent drunken brawls. Nor does it prevent accidents. Therefore, it is not effective, for example, in ensuring safety around a swimming pool. It has proven effective, however, in deterring shoplifting, which is endemic in the retail sector. It is important to note that CCTV will only deter crime where people are aware of its existence. This requires adequate signage to notify the public of the deployment of CCTV. Privacy and Data Protection laws also require this notification on signs to include the purpose for the collection of personal data and the contact information of the person responsible.

If a DPIA or PIA determines that the four conditions above apply, it is necessary to complete the other elements of the assessment with respect to the deployment of the equipment. This includes such factors as the placement of the cameras, security measures to protect the images in the system, controls on who has access and the retention period for the recordings. The law requires that data controllers limit the collection of data to the minimum required to achieve the objective and limit the use of the data to only the stated purpose. The law prohibits using CCTV recordings, collected for the purpose of personal security or the protection property, for other purposes, except in limited circumstances.

These rules also apply to home surveillance systems and dash cams. Users must take care in positioning cameras to ensure that they do not capture the data of innocent, law-abiding individuals in public places. Dash cams should not be able to record the number plates of passing cars or the faces of passing cyclists. The Data Protection Law includes an exemption for the collection of personal data for domestic or family purposes, but this does not apply to the collection of personal data of members of the public acting lawfully in a public place.

Our privacy and data protection laws supports getting the right information to the right person at the right time for the right purpose. If used properly, CCTV can achieve these goals. However, when used improperly, it can be illegal and do more harm than good. The key message is to resist the allure of technology for its own sake. Conduct a thorough analysis of the existing problem and identify the most effective means to address it. If CCTV is the answer, make sure to implement it with the safeguards that the Law requires.