The end of the purpose-specification principle in data protection?

Abstract

The ‘purpose specification principle’, that is, the principle that a citizen needs to be informed why the personal data is being collected and the specific purposes for which it will be processed and kept, is a central protection for a citizen in data protection law. Data sharing practices using personal data collected for one purpose for another purpose are on the increase with clear prejudice to the purpose specification principle. While initially, at law, data sharing was limited to instances where the purpose for which the personal information is used is not incompatible to the purpose for which the same information was collected, there seems to be a trend to extend instances of data sharing with clear disregard to the purpose-specification principle. This paper documents the proposal and withdrawal of two legislative initiatives (the introduction of data sharing provisions in the Coroners’ and Justice Bill 2009 and the Communications Data Bill 2008) to determine whether a clear pattern to end the purpose-specification principle in data protection in the UK is emerging or whether it has in fact seen its end already. The paper argues that while the withdrawal of these legislative initiatives is a positive step even if perhaps instigated by political opportunism, the systematic erosion of the purpose-specification principle will unfortunately continue to increase the possibility of abuse of citizens’ rights.

Keywords:

• purpose specification
• data sharing
• communications data

Notes

In the Data Protection Act 1998, the purpose-specification principle is the second Data Protection Principle, which states that ‘Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.’ Data Protection Act 1998 Schedule 1, Part 1, 2.

Robert Gellman, ‘Privacy: Finding a Balanced Approach to Consumer Options’. Available at http://www.cdt.org/privacy/ccp/consentchoice4.pdf

London School of Economics and Political Science, ‘The Identity Project: An Assessment of the UK Identity Cards Bill & Its Implications’, 27 June 2005 at p. 26, available at http://is2.lse.ac.uk/IDcard/identityreport.pdf

Joseph A. Cannataci, ‘Lex Personalitatis and Technology-driven Law’, SCRIPTed 5, no, 1 (2008): 1, available at http://www.law.ed.ac.uk/ahrc/script-ed/vol5-1/editorial.asp

Richard Thomas and Mark Walport, ‘Data Sharing Review Report’ (2008), available at http://www.justice.gov.uk/docs/data-sharing-review-report.pdf

See in particular, ibid., 46–48.

Ibid., 39.

Ibid.

Ibid., 2.

UK Ministry of Justice, Response to Data Sharing Review Report, November 2008, available at http://www.justice.gov.uk/publications/docs/response-data-sharing-review.pdf

Ibid., p. 16.

Coroners and Justice Bill 2009, Section 152, introducing a new section 50A(4) to the Data Protection Act 1998.

Coroners and Justice Bill 2009, Section 152, introducing a new section 50A(1) to the Data Protection Act 1998.

See note 12 above.

J. Cannataci and J.P. Mifsud Bonnici, ‘The UK 2007 Data Protection Fiasco: Moving On From Bad Policy And Bad Law’, International Review of Law, Computers and Technology, 23, nos. 1–2 (2009): 47–76

Sally Almandras, Sally Broadbridge, Grahame Danby and Pat Strickland, ‘The Coroners & Justice Bill: Crime & Data Protection, Bill 9 of 2008-09’, Research Paper 09/06, House of Commons Library, 22 January 2006, at p. 108

Coroners and Justice Bill 2009, Clause 152 introducing a new section 50A(3) to the Data Protection Act 1998.

Information Commissioner Response to the Joint Committee of Human Rights, 27 February 2009, available at http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/jchr_memorandum_letter_270209.pdf

Ibid.

Bold is found in the original. See Information Commissioner, Memorandum submitted by the Information Commissioner to the Public Bill Committee (30 January 2009), available at http://www.ico.gov.uk/upload/documents/library/data_protection/detailed_specialist_guides/cj_bill_ic_memorandum_300109.pdf

See for example report in Out-Law, ‘Government Data Sharing Plan Could Extend to the Private Sector’, 16 January 2009, available at http://www.out-law.com/page-9716

Ibid.

See Zosia Kmietowicz, ‘Government Removes Data Sharing Clause from Coroners Bill’, British Medical Journal 338 (11 March 2009): b1009.

Committee stage discussions on 26 February 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmpublic/coroners/090226/pm/90226s06.htm

Ibid.

Amendments to Coroners and Justice Bill Thursday 26 February 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmpublic/coroners/090226/pm/90226s01.htm

Speech of Mr Bellingham, available at http://www.publications.parliament.uk/pa/cm200809/cmpublic/coroners/090226/pm/90226s02.htm

Bold in original. Human Rights Joint Committee–Eighth Report- Legislative Scrutiny: Coroners and Justice Bill, available at http://www.publications.parliament.uk/pa/jt200809/jtselect/jtrights/57/5706.htm

See note 26.

Ibid.

Committee stage discussions on 26 February 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmpublic/coroners/090226/pm/90226s06.htm#end

David Barrett, ‘Government Abandons Data-Sharing Scheme’, The Telegraph, 7 March 2009. Available at http://www.telegraph.co.uk/news/newstopics/politics/lawandorder/4954058/Government-abandons-data-sharing-scheme.html

David Leppard, ‘There's No Hiding Place as Spy HQ Plans to See All’, The Times, 5 October 2008, available at http://www.timesonline.co.uk/tol/news/uk/article4882622.ece

See Leader of the House of Commons, ‘Introduction to Communications Data Bill’, available at http://www.commonsleader.gov.uk/output/page2466.asp?p=1&g=59FD1FD3-8251-4783-B40B-C6702020AA70 and available at http://www.official-documents.gov.uk/document/cm73/7372/7372.pdf

Ibid.

In a Times article: Richard Ford, ‘Big Brother’ Database for Phones and Emails’, The Times, 20 May 2008, available at http://business.timesonline.co.uk/tol/business/industry_sectors/telecoms/article3965033.ece

See Chris Williams, ‘Spy Chiefs Plot £12bn IT Spree for Comms Uber database: Black Boxes to keep Black's Firm in the Black’, 7 October 2008, available at http://www.theregister.co.uk/2008/10/07/detica_interception_modernisation/

Hansard 8 July 2008: Column WA73, available at http://www.publications.parliament.uk/pa/ld200708/ldhansrd/text/80708w0001.htm

‘Communications Date Bill’, 16 October 2008, available at http://www.politics.co.uk/legislation/legal-and-constitutional/communications-data-bill-$1245133.htm

Chris Williams op. cit.

9 June 2008. Dr Julian Lewis:asked on measures planned for the comprehensive storage of national telephone and e-mail communications data. Available at http://www.parliament.uk/commons/lib/research/briefings/snha-04884.pdf

8 July 2008. Lord Northesk: asked on objectives of IMP, financing and cost. Available at http://www.publications.parliament.uk/pa/ld200708/ldhansrd/text/80708w0001.htm

July 2008. Baroness Miller of Chilthorne Domer: asked on what guidance had been given to Internet Service Providers on when and how they can intercept their customers’ website use; and what information they have made available to the public about the privacy issues involved, available at http://www.parliament.uk/commons/lib/research/briefings/snha-04884.pdf

July 2008. Viscount Bridgeman: asked whether the government would withdraw their plans for a communications data Bill to set up a database logging every private phone call and e-mail following the opposition to the idea, available at http://www.parliament.uk/commons/lib/research/briefings/snha-04884.pdf

See, for example, Leppard, ‘There's No Hiding Place’; Williams, ‘Spy chiefs Plot £12bn IT Spree’.

Information Commissioner's Office, ICO Statement on the Communications Data Bill, 20 October 2008. Available at http://www.ico.gov.uk/upload/documents/pressreleases/2008/ico_statement_comms_data_bill.pdf

Ian Grant, ‘Government Scraps Communications Data Bill’, 24 October 2008. Available at http://www.computerweekly.com/Articles/2008/10/24/232819/government-scraps-communications-data-bill.htm

Karl Flinders, £12bn Snooping Database Ommitted from Queen's Speech, 3 December 2008. Available at http://www.computerweekly.com/Articles/2008/12/03/233713/12bn-snooping-database-ommitted-from-queens-speech.htm

Ibid.

UK Home Office, ‘Protecting the Public in a Changing Communications Environment’, April 2009 (Ref.: Cmmd. 7586), available at http://www.homeoffice.gov.uk/documents/cons-2009-communications-data. The Consultation process ended on 20 July 2009. No official response by government had been published by the time this paper was submitted for review.

Speech of then Home Secretary while presenting the Consultation paper to the house on 27 April 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmhansrd/cm090427/wmstext/90427m0002.htm

UK Home Office, ‘Protecting the Public’ at p. 4, para. 19.

See Liberty Press Release, ‘Liberty Welcomes Government Climb-Down on Centralised Communications Database’, 27 April 2009, available at http://www.liberty-human-rights.org.uk/news-and-events/1-press-releases/2009/27-04-09-liberty-welcomes-government-climb-down-on-centralised-communicati.shtml

Letter by Andrew Findlay in response to Consultation (date 30 April 2008), available at http://www.skills-1st.co.uk/papers/policy/commsdata-200904.pdf

Marc Dautlich, head of the data protection group at Olswang, ‘I trust the private sector more than I trust the government, based on the number of recent breaches. Plus the private sector is regulated and has its public reputation to think about.’ As reported in James Boxell, ‘Smith Drops Plans for State Web Database’, Financial Times Online, 28 April 2009, available at http://www.ft.com/cms/s/0/070ca8e0-3382-11de-8f1b-00144feabdc0.html?ftcamp=rss&nclick_check=1

See No2ID Press Release, ‘Jacqui Smith Announces UK to Have Most Intrusive Surveillance Powers Anywhere’, 27 April 2009, available at http://www.no2id.net/news/pressRelease/release.php?name=Smith_announces

The London School of Economics and Political Science, ‘Briefing on the Interception Modernisation Programme’, 2009, available at http://www.lse.ac.uk/collections/informationSystems/research/policyEngagement/IMP_Briefing.pdf

See Information Commissioner's statement on the Communications Data Bill, date 27 April 2009, available at http://www.ico.gov.uk/upload/documents/pressreleases/2009/ico_statement_dc_bill.pdf

The Consultation asks the public to comment on four questions:

• Q1. On the basis of this evidence and subject to current safeguards and oversight arrangements, do you agree that communications data is vital for law enforcement, security and intelligence agencies and emergency services in tackling serious crime, preventing terrorism and protection the public?

• Q2. Is it right for government to maintain this capability by responding to the new communications environment?

• Q3. Do you support the government's approach to maintaining our capabilities? Which of the solutions should it adopt?

• Q4. Do you believe that the safeguards outlined are sufficient for communications data in the future?

• UK Home Office, ‘Communications Data Consultation’, 27 April 2009, available at http://press.homeoffice.gov.uk/speeches/comms-data-consultation.html

The Court of Appeal has labelled it ‘a particularly puzzling statute’ in R v. W [2003] EWCA Crim 1632; [2003] 1 WLR 2902, 12 June 2003, at para 98.

Transcript of debate of Fourth Delegated Legislation Committee held 16 March 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmgeneral/deleg4/090316/90316s01.htm

Transcript of debate of Fourth Delegated Legislation Committee held 16 March 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmgeneral/deleg4/090316/90316s01.htm#end

The Consultation process ended on 10 July 2009. No official response by government had been published by the time this paper was submitted for review at the end of July 2009.

UK Home Office, ‘Regulation of Investigatory Powers Act 2000: Consolidating Orders and Codes of Practice – Consultation and response’, available at http://www.homeoffice.gov.uk/documents/cons-2009-ripa

Regulation of Investigatory Powers Act 2000: Consolidating Orders and Codes of Practice (April 2009) at p. 4, available at http://www.homeoffice.gov.uk/documents/cons-2009-ripa

Ibid., p. 6.

Ibid., p. 7.

See Liberty, ‘Liberty's Response to the Home Office Consultation on the Regulation of Investigatory Powers Act 2000: Consolidating Orders and Codes of Practice’ (2009), at p. 24, available at http://www.liberty-human-rights.org.uk/pdfs/policy-09/liberty-s-response-to-the-ripa-consultation.pdf

Section 22 RIPA.

Section 28 RIPA.

Section 29 RIPA.

See sections 22(h) (communications data), 28(g) (directed surveillance) and 29(g) (covert human intelligence sources).

Liberty, ‘Liberty's Response to the Home Office’, p. 13.

See the Explanatory Notes to the Welfare Reform Bill at paragraph 418, available at: http://www.publications.parliament.uk/pa/cm200809/cmbills/008/en/2009008en.pdf as reported in Liberty, ‘Liberty's Response to the Home Office’, p. 14.

Grand Chamber decision 2000 (Application 28341/95).

Liberty, ‘Liberty's Response to the Home Office’, p. 14.

Regulation of Investigatory Powers Act 2000, p. 4

UK Home Office, ‘Consultation: Transposition of Directive 2006/24/EC’, available at http://www.homeoffice.gov.uk/documents/cons-2008-transposition-dir/

Government Response to the Public Consultation on the Transposition of Directive 2006/24/EC – February 2009, available at http://www.homeoffice.gov.uk/documents/cons-2008-transposition-dir/cons-2008-transposition-response?view=Binary

Grahame Danby, ‘House of Commons Library Standard Note No. SN/HA/4884 on the Draft Communications Data Bill’, January 2009, available at http://www.parliament.uk/commons/lib/research/briefings/snha-04884.pdf

The Minister for Security, Counter-Terrorism, Crime and Policing (Mr Vernon Coaker) in transcript of debate of Fourth Delegated Legislation Committee held 16 March 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmgeneral/deleg4/090316/90316s01.htm

The Minister for Security, Counter-Terrorism, Crime and Policing (Mr Vernon Coaker) in transcript of debate of Fourth Delegated Legislation Committee held 16 March 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmgeneral/deleg4/090316/90316s01.htm

Home Secretary Jacqui Smith Speech ‘Protecting Rights, Protecting Society’ delivered to the Intellect Trade Association on 16 December 2008, available at http://press.homeoffice.gov.uk/Speeches/home-sec-protecting-rights

Transcript of debate of Fourth Delegated Legislation Committee held 16 March 2009, available at http://www.publications.parliament.uk/pa/cm200809/cmgeneral/deleg4/090316/90316s01.htm and Explanatory Memorandum, available at http://www.opsi.gov.uk/si/si2009/draft/em/ukdsiem_9780111473894_en.pdf

Transcript of debate of Fourth Delegated Legislation Committee held 16 March 2009. See previous note.

Statutory Instrument 2009 No. 859 Electronic Communications: The Data Retention (EC Directive) Regulations 2009’, available at http://www.opsi.gov.uk/si/si2009/pdf/uksi_20090859_en.pdf

Nigel Morris and Robert Verkaik, ‘Ministers Cancel “Big Brother” Database’, The Independent, 10 November 2009.