So, for no reason at all, I was wondering today about CCTV at work. So, I did some internet based research, and here's what I came up with.

Apparently, the Information Commissioner has published an Employment Practices Code (Data Protection), which has a whole section on workplace monitoring (Part 3). Here are some sections I have selected at random:

"where monitoring goes beyond one individual simply watching another and involves the manual recording or any automated processing of personal information, it must be done in a way that is both lawful and fair to workers."

"Monitoring may, to varying degrees, have an adverse impact on workers. It may intrude into their private lives, undermine respect for their correspondence or interfere with the relationship of mutual trust and confidence that should exist between them and their employer."

"In broad terms, what the [Data Protection] Act requires is that any adverse impact on workers is justified by the benefits to the employer and others."

"Where possible, any video or audio monitoring should be targeted at areas of particular risk and confined to areas where expectations of privacy are low. Continuous video or audio monitoring of particular individuals is only likely to be justified in rare circumstances."

There is also a CCTV Code of Practice, and again I have selected some random paragraphs:

"When you install CCTV in a workplace, such as a shop, it is likely to capture pictures of workers, even if they are not the main subject of surveillance. If the purpose of the CCTV is solely to prevent and detect crime, then you should not use it for monitoring the amount of work done or compliance with company procedures."

"Example: You suspect that your workers are making mobile phone calls during working hours, against company policy, and you consider installing CCTV cameras on their desks to monitor them throughout the day. This would be intrusive and disproportionate. Continuous monitoring should only be used in very exceptional circumstances, for example where hazardous substances are used and failure to follow procedures would pose a serious risk to life."

"Is CCTV limited to areas which workers would not expect to be private? CCTV should not be used in toilet areas or private offices."

I should add to this my own advice that it is never, ever acceptable for an employer to use CCTV footage to earn money by submitting it to You've Been Framed! - even if the footage is as funny as this:

Labels: Just for Fun, Privacy

I note from browsing human rights and anti-terror law blog, The Lift that a report commissioned by the Scottish Government has called for an immediate review of the funding of CCTV cameras. The report reports that the cost of operating the snooping devices over the next three years is more than 40 Million pounds. It also points out that there has been little research into their effectiveness in preventing crime and disorder.

Apparently, there are about 2,200 CCTV cameras in public spaces such as city centres, parks and shopping centres across Scotland (except Aberdeenshire, which has none).

And, according to the Telegraph, in London just one crime is solved a year by every 1,000 CCTV cameras. As the leader quite pointedly asks: "If they do not stop crime or catch criminals, what are they for?"

Posted on Absolvitor: Scots Law Online.

Labels: Blawgs, Human Rights, Privacy, Scottish Government

An article in the Times Educational Supplement reports that a court in Germany has ruled that schoolchildren may rate their teachers online.

The Court rejected the case of a woman who argued that her pupils had infringed her rights by giving her poor grades on the popular site spickmich.de. The German Federal Court of Justice found that pupils had the right to offer their opinions so long as their teachers were not hindered professionally.

Similar controversy (though, to my knowledge, no litigation) has followed sites such as RateMyTeachers in the UK with teachers complaining about unfavourable comments from pupils.

To my mind (outside the ordinary laws of defamation) there is absolutely no reason why teachers should not be subject to pupil evaluation on the web. After all, pupils' views are now sought as an integral part of HMIe school inspection reports - which are reported online too.

Maybe it's time for a RateMyLawyer website? Or is that why we have Chambers and Legal 500?

Labels: Children, Defamation, Education Law, News, Privacy

From the good offices of NO2ID, the following.

"The ID scheme has not been shelved, cancelled, or even significantly changed.

"Once more government spin has triumphed and much of the media has got it wrong. The new Home Secretary Alan Johnson has not made any significant changes to the scheme. Compulsion by stealth is still the order of the day, just as it always was. Someone joining the ID scheme "voluntarily" will still be placing control of their identity in the hands of the IPS for life.

"The Home Office line remains the same. No compulsion (as the Home Office defines it) was going to be applied until almost everyone had "volunteered" and then it was only a matter of rounding up a minority of resisters and marginalised people.

"The Home Office's idea of "voluntary" is not the same as yours and mine. Since 2004 the scheme was (and it still is) to proceed by "designating" one-by-one under the Identity Cards Act 2006 other documents issued by official bodies -- in the first place passports.

" Once a document has been designated, you won't be able to apply for one without also applying to be entered, for life, on the national identity register. If you don't agree to be registered it won't be that you are refused (say) a passport; you'd have voluntarily decided not to apply. There's no compulsion to have a passport. It is useful for travelling. But you aren't compelled to travel.

"Or (say) to drive. Or to work as a security guard. Or with children. Or in healthcare. To get parole from prison. To practice as a lawyer. ... Any official licence, registration certificate or permit can be designated, and -- in the home office's skewed logic -- handing control of your identity to the Home Office's Identity and Passport Service will still be entirely voluntary.

"That they were due for a confrontation with the airside worker's unions over designating new passes at Manchester and City Airports is an illustration of just how voluntary "voluntary" really is. But the fact they have now ducked that fight for political convenience suggests saying no does work - if you say it loudly enough."

"It is still not too late for MPs to derail the scheme by repudiating the regulations due to be debated next week and detailed in the last newsletter. Only one of those statutory instruments has been dropped. If you have not done so already, please contact your MP: www.writetothem.com.

"(NO2ID's lobbying guide, written for us by the former assistant of a very distinguished retired minister, is brusque but absolutely to the point: http://www.no2id.net/downloads/print/NO2ID-HowtoLobby.pdf).

"Peers will also have a vote on this; so if you happen to know one (or be one), then it would be a good idea to alert friends in the Lords now that the matter is soon to come up."

Since when can you make one right (to privacy from the State) dependent on surrendering another (the write to travel freely) and still call it a voluntary scheme.

No to ID.

Posted on Absolvitor: Scots Law Online.

Labels: News, Privacy

From the website of the Scottish Government, I learn that a pilot project to provide parents with improved access to information about known sex offenders who may be in contact with their children will be trialled in Tayside from September 2009 until the end of May 2010.

Under the scheme, members of the public within the pilot area will be able to register a child-protection interest in a named individual who has unsupervised access to their child or children.

Police will be alerted to concerns, with a presumption that they will inform the parent, carer or guardian if the named person has convictions for sex offences. If the child is found to be at serious risk of harm then child protection measures will also be instigated.

Justice Secretary Kenny MacAskill is quoted as saying: "I'm pleased to confirm that Tayside will be the area for the sex offender disclosure pilot and that we are now liaising with all the criminal justice partners in the region as they prepare for implementation."

"While we must all rightly be alert to stranger danger, most sexual offences against children are committed by individuals known to the child's family - adults who abuse a position of trust with that child. This project provides another link which will assist in identifying vulnerable children and families who are unknown to police and care agencies to ensure that correct help and advice are provided."

It will be interesting to see by what criteria the pilot will be judged, what counts as a "child-protection interest" (can you check up on your next door neighbours? the local shopkeeper? members of your own family?), and what will happen post-disclosure? Should we be stocking up on torches and pitchforks?

Labels: Children, criminal law, News, Privacy, Scottish Government

16-year-old Kim Swann went on facebook and took the opportunity to describe her job as "boring". She cannot be alone in having done this and, as she was working in the office of a logistics company, it was almost certainly true.

What marks her out though, is the response of her employers, which was to fire her after only three weeks in the job.

Her mother has been quoted as saying: "I think she's been treated totally unfairly. She didn't mention the company's name. This is a 16-year-old child we're talking about. She says Clacton is boring but we're not going to throw her out of the house for it."

Kim herself added "You shouldn't really be hassled outside work. It was only a throw-away comment. "

The employers in question are Ivell a marketing and logistics firm. I note that the "contact us " page on their site has now been taken down - presumably due to abusive e-mails which have been sent to them. I noticed this when I visited the site to not send an amusing message.

When the site is up and running again, perhaps I can ask them (as marketing experts) whether all publicity really is good publicity?

Muppets.

Labels: Employment Law, News, Privacy

Law Actually brings us this story of insurance firms using facebook to scupper personal injury cases. So, think twice before posting that video of you limbo dancing while you're supposed to be recovering from a serious back injury!

Labels: News, Privacy

In the same week as the European Court of Human Rights decided that the retention of DNA data by police forces in England & Wales was unlawful (Scotland already had legal limits on DNA retention) comes the disturbing news that the Scottish Children's Reporter Administration has been disclosing personal details of vulnerable children (such as where and with whom they are now living) to ... the very people the SCRA are supposed to be protecting the children from.

Exposing Scotland's most vulnerable children to serious risk of violence, on at least 12 occasions in the past year, secret addresses of children taken from their parents and given new homes for their own safety were accidentally passed to their abusive or neglectful birth parents.

SCRA have admitted their mistake and issued an apology (for all the good that will do anyone). This sort of thing has happened once too often with government bodies for me to describe it as "unbelievable", but this surely represents staggering new depths of incompetence?

Labels: Children, Human Rights, News, Privacy

The UK government has launched a consultation on the Electronic Communications Data Retention (EC Directive) Regulations. Responses should be sent by 31st October by e-mail to commsdata@homeoffice.gsi.gov.uk or by post to Andrew Knight, Home Office, 5th Floor, Peel Building, 2 Marsham Street, London, SW1P 4DF.

See A consultation paper: Transposition of Directive 2006/24/EC or "Final phase of the transposition of Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC." for more detail.

Labels: European Law, News, Privacy

A concerning post on William Beck's "SCCRC Deny Justice" website. (Worth visiting if only for the Billy Joel soundtrack!)

By all accounts, Mr. Beck has been informed by the Scottish Criminal Cases Review Commission that in revealing Jurors' Names and Addresses to him (I assume these are same jurors who once tried and convicted Mr. Beck?) they have acted properly as the information is "in the public domain" being held by National Archives of Scotland.

I imagine that this will be both a surprise and a matter of concern for anyone called as a juror. In the meantime, Mr. Beck has taken SCCRC at their word and posted the juror's names and addresses on his Flickr page.

Labels: criminal law, News, Privacy

Internet expert Scott Cleland testified yesterday before the U.S. House Energy and Commerce Internet Subcommittee on broadband regulations and privacy, highlighting the need for a comprehensive approach to Internet privacy, and spotlighting the serious privacy threat posed by Internet applications like Google.

"I am concerned that selective oversight of only broadband privacy matters fosters a blind eye to arbitrage of privacy laws by application companies like Google, Yahoo and others," Cleland said. "This creates perverse incentives for companies not covered by U.S. privacy laws to push the envelope on privacy for competitive advantage."

Cleland noted that while broadband providers are subject to a host of privacy laws and regulations, Internet applications are not subject to any consumer privacy protections. Cleland called the discrepancy a double standard that Google and others have arbitraged to the detriment of consumers. He said "Americans' privacy should not be an unrestricted commodity to sell to the highest bidder." Moreover, Google collects and stores "more private information about more people than any other company in the world."

"The lack of a holistic, comprehensive and balanced approach to privacy is a serious threat to Americans' privacy," Cleland said.

Labels: News, Privacy

A government run database holding the telephone and internet communications of the entire population would raise serious data protection concerns, the Information Commissioner, warned today. Commenting on speculation that the government is considering the development of such a database Richard Thomas said that it would be "a step too far for the British way of life".

He continued: "I am absolutely clear that the targeted, and duly authorised, interception of the communications of suspects can be invaluable in the fight against terrorism and other serious crime. But there needs to be the fullest public debate about the justification for, and implications of, a specially-created database (potentially accessible to a wide range of law enforcement authorities) holding details of everyone's telephone and internet communications. Do we really want the police, security services and other organs of the state to have access to more and more aspects of our private lives?"

In another blow for the Government, the Information Commissioner's Office (ICO) is today serving enforcement notices against HM Revenue and Customs and the Ministry of Defence following recent high profile data breaches. The notices require both departments to provide progress reports documenting in detail how the recommendations have been, or are being, implemented to improve Data Protection compliance. Failure to comply with an Enforcement Notice is a criminal offence.

• Information Commissioner's Office
• NO2ID Campaign

Labels: News, Privacy

Kevin Dunion, Scottish Information Commissioner, has welcomed the House of Lords ruling on the appeal by the Common Services Agency against a Court of Session judgement in favour of his decision in the case of Michael Collie and the CSA.

The decision concerned a request in 2005 by a Green Party researcher for data showing the incidence of childhood leukaemia at ward level in Dumfries and Galloway. The Commissioner ordered release of this statistical data in "Barnardised" form: a method for disguising statistical information to prevent identification. The Court of Session upheld the Commissioner's decision on appeal, after which the CSA took their case to the House of Lords.

The Appellate Committee (Lord Hoffmann, Lord Hope of Craighead, Lord Rodger of Earlsferry, Baroness Hale of Richmond and Lord Mance ) decided to allow the appeal, and have remitted the decision back to the Commissioner, to establish whether or not the statistical information can be released without the risk of identifying individuals.

Mr. Dunion commented: "I am pleased that the Lords have upheld my view that the Common Services Agency does hold the information in dispute and I am entitled to require authorities to anonymise personal data so that it can be released. Clearly, developments since the issue of the original decision mean that I need to address again what statistical information can be disclosed in this case whilst protecting the privacy of individual patients. I am looking forward to working with the Common Services Agency to establish what information can be released in light of the House of Lords decision."

According to Wikipedia, Barnardisation is a method of disclosure control for tables of counts that involves randomly adding or subtracting 1 from some cells in the table. It is named after Professor George Alfred Barnard (1915-2002), a professor of mathematics at the University of Essex.

• Scottish Information Commissioner
• Common Services Agency v. Scottish Information Commissioner [2008] UKHL 47

Labels: House of Lords, News, Privacy

The Electronic Frontier Foundation are reporting that a court ruling will expose the viewing habits of YouTube users. As part of the ongoing Viacom v. Google litigation, the federal court for the Southern District of New York has ordered that Google hand over "all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website."

The Video Privacy Protection Act in the USA is supposed to put a stop to this sort of behaviour, but the Court was apparently persuaded that releasing this information, including IP addresses and log-in ID names, was not sufficient to identify individuals. This is demonstrably untrue.

The Foundation concludes: "The Court's erroneous ruling is a set-back to privacy rights, and will allow Viacom to see what you are watching on YouTube. We urge Viacom to back off this overbroad request and Google to take all steps necessary to challenge this order and protect the rights of its users."

Labels: News, Privacy