I am not alone in wondering what the status of Limerick City & County Council’s Smart CCTV surveillance system is. County councillors have been asking what the delay with the system is and it appeared some weeks ago that the provision of legal advice to the Council was imminent but, as far as I can see, it has not been presented to councillors for consideration.
The Data Protection Commission had told me last month that their office was not going to investigate complaints against the Limerick scheme because a national study on public CCTV was to commence within weeks, part of which would look at the Limerick scheme. However, the Commission also told me that it was their “understanding that the CCTV systems … are not in operation.” They did not state where that understanding came from. Somewhat unusually, the Commission does not appear to have made any public statement about its national study other than what was reported in the Irish Times in March.
So, I asked Limerick City & County Council if the cameras were recording. This request was made under section 3 of the Data Protection Acts 1988 and 2018, which allows individuals to see if an organisation is processing personal data. The Council have today told me that the surveillance system is active and recording footage. They say, however, that the footage is not currently being accessed because the cameras are being tested.
The Council’s position on this is that the system is in a “transitional” status and not a “live” or “operational” one because the footage is not being monitored. They say that the system is not not yet “live” because the Council is finalising its CCTV policy in line with the GDPR and data protection legislation. However, it is clear that the cameras are recording and the Council is, therefore, processing personal data (see Article 4 GDPR for the definition of “processing”). It is not clear what is being done with the footage recorded or what the testing of it involves.
A notable aspect of the Limerick scheme is that it has been authorised by the Garda Commissioner under section 38 of the Garda Síochána Act 2005, which provides for authorisations of community surveillance only for public order. The then Acting Commissioner confirmed to me in January that the authorisation granted was “for the sole or primary purpose of securing public order and safety in public places by facilitating the deterrence, prevention, detection and prosecution of offences.” The Council tell me that the primary purpose of the scheme is public order and safety “including” the following:
I was particularly interested in the reference to the “perception of safety” – the Council’s own statistics in the report that lead to the surveillance system show a significant drop in reported crime in many areas, including Newcastle West.
The Data Protection Commission will have to decide, in the first instance, whether or not the purposes to which the Council wishes to put its surveillance network are a justified and proportionate infringement on the privacy rights of individuals. The remarkably vague reference to “open data” gives rise to further concern and it is again astonishing that a privacy impact assessment does not appear to have been done in advance of planning such a system.
It remains to be seen how piggybacking these additional purposes on the surveillance system is compatible with the section 38 authorisation granted by the Garda Commissioner. The Commissioner has not yet confirmed the position on that point but the previous Acting Commissioner confirmed to me that they had not, for example, authorised ANPR or tourism cameras.
Whatever results from the national study, it will be interesting to see where the Data Protection Commission obtained the understanding that Limerick’s surveillance system was not in operation and how the Council’s continuing preparations for the full operation and monitoring of the system will interact with the Commission’s national study.
I have had a draft blog post lingering for many months addressing some of the issues and concerns with community surveillance, particularly in light of Limerick’s “Smart CCTV” scheme which, I believe, will be a model for a national network of community surveillance.
Quite a lot has since been written (and spoken) about the issue so I include links below to various reports and discussions about the scheme, and some other schemes around the country.
Given the commencement of the GDPR and Data Protection Act 2018, and the forthcoming examination by the DPC, one would think that they State authorities might pause these systems so that a national approach to them could be put in place before expanding their scope further. The opposite seems to be the case.
Litigation solicitors often request and disclose too much information about clients when representing them in court cases. The imminent data protection reforms in the GDPR are bringing data protection issues into focus on a daily basis, not least the routine things many businesses and professionals do and have always done which might not be acceptable under the GDPR or even existing data protection law.
Respecting privacy, and the GDPR, requires that we all consider and reconsider what personal data should be collected and what can or should be done with it. Solicitors owe a duty to their own clients, for example, not to unnecessarily disclose personal data.
What is the issue
This often arises when dealing with requests for information or documentation from “the other side” in a case. If you sue someone there is certain information you must provide the other side with, and some information they are entitled to ask for. I’m going to use the example of personal injury cases, as they are the most relevant in this context.
In those cases the injured party (the plaintiff) has to give certain basic information like their name, address, PPSN, details of special damages and negligence alleged. The person being sued (the defendant) can ask the plaintiff for some additional information such as about previous personal injuries, claims and treatments where relevant and, if asked, the plaintiff must answer. These questions are put in what is called a “notice for particulars”, a document sent by the solicitor for the (usually) insurance company defending the claim. If the plaintiff refuses to answer the notice with “replies to particulars”, the defendant can ask for a court order compelling the plaintiff to answer.
That does not, however, mean that all questions must be replied to. The purpose to particulars is so that the defendant knows what case they have to meet at trial and to prevent them being surprised with unexpected allegations. It is not a means of a defendant getting advance details of the evidence that will be presented at trial, nor is it an opportunity for a fishing expedition for information about the plaintiff. It is, however, often treated as just that and defendants often ask all sorts of questions about the plaintiff’s family and domestic circumstances, personal and employment history and medical affairs whether or not they have a bearing on the case.
The (non-data protection) law on particulars
Mr Justice Hogan delivered a significant judgment (Armstrong v. Moffatt) on replying to notices for particulars in 2013. The judgment provides a good run-through of the law on particulars but Hogan J was notably critical of the practices which had developed in recent years of defendants seeking a huge range of information, and of plaintiff solicitors going along with these requests.
Not least in personal injury cases, the particulars sought in many cases had reached something of an art form. Quite often no possible detail or dimension of a [claim] remained unexplored at the hands of pleaders who at times seemed to revel in this glorious new art form. It was by no means uncommon to find notices for particulars stretching to twenty or more paragraphs, often replete with individual sub-paragraphs. Most litigants (or, perhaps more accurately, their solicitors and junior counsel) simply yielded dutifully to these requests, as it was often more convenient and expedient to do so rather than to take a stand on principle. In retrospect, the courts should, perhaps, have been more prepared to strike out many of the pre-rehearsed requests as oppressive and, in some cases, as constituting quite simply an abuse of process … [M]any of the requests in this and similar cases are either irrelevant or not permissible in law as particulars are nonetheless steadfastly advanced shows that many pleaders have simply gone astray in their enthusiasm to interrogate every possible detail of their opponent’s claim.
While the judgment did not mention and was not based on data protection law it was, in effect, a call to action addressed to solicitors on both sides: stop requesting so much information in notices for particulars, and stop acquiescing to excessive requests.
Unfortunately, it has not been heeded. The practice certainly varies from solicitor to solicitor but some insurance defence solicitors continue to issue lengthy notices for particulars, often with very surprising questions about the plaintiff’s personal life and family circumstances that do not appear to have any bearing on the case. Moreover, judges have not always accepted arguments against providing replies to particulars on the basis of Hogan J’s judgment.
A similar issue arises in the context of voluntary discovery, which involves the handing over of full records rather than just replying to questions. I would hope that solicitors are generally more restrictive when it comes to discovery, but solicitor Dervila McGirr quite rightly criticises the reliance on discovery “on the usual terms”, particularly in relation to extensive requests for highly sensitive medical records, and the impact on client privacy. There should be little if any basis for operating “on the usual terms”. Each request for information or documentation should be considered on its own terms.
It is important to note that in these situations, a solicitor acts as the “agent” of her/his client. I won’t digress into the field of agency law but a solicitor acting as agent of the client has a certain amount of latitude to do things on behalf of a client with their authority (whether explicit or implied). Delivering replies to particulars is one of those things, but how far does a solicitor’s authority go? Surely not to hand over personal data wholesale. However, in personal injuries cases at least, the client must swear an affidavit of verification confirming the accuracy of the information in the replies to particulars so the client necessarily has to have reviewed what is in the document. You could, therefore, argue an express authority to hand over the information (after all, the client confirmed the contents), but does it end there?
Which is where data protection comes in
Quite simply, if a defendant is not entitled to certain information in the course of obtaining further and better particulars, what right does a plaintiff’s solicitor have to provide the information? The obligations of the Data Protection Acts (and the GDPR/Data Protection Bill) mean that a solicitor should consider whether the defendant is entitled to the particulars sought. If not, the information (which will often be sensitive personal data) should not be disclosed to the defendant.
A client may have reviewed the contents of replies to particulars and confirmed them in an affidavit of verification, but have they consented to the release of the personal data or expressly authorised it? Consent is notoriously problematic in data protection, and for sensitive personal data (which many replies to particulars in personal injuries cases are) it must be explicitly given. If a solicitor puts draft replies to particulars in front of a client, asks that they be checked for accuracy and that an affidavit of verification be sworn, at what point was the client given a clear explanation of the processing involved (the disclosure to the other side)? The key explanation should involve advice as to whether or not the client is required to disclose the particulars. And this is, I suspect, where many would fall into difficulty.
What is the consequence?
This issue does not appear to have been the subject of a judicial decision or complaint to the Data Protection Commissioner (yet), but this is true of many persistent issues in data protection.
A possible explanation is the lack of serious consequence to date. There has, possibly, been too much deference to exemptions and exceptions in the Data Protection Acts relating to litigation and connected services. And while the Acts (section 7), impose a duty of care to data subjects under the law of torts, the utility of that provision was almost entirely hollowed out by a High Court decision in 2013 (Collins v. FBD). Section 7 was never satisfactory and the Collins decision made it worse, requiring that a plaintiff had to show specific loss in order to claim damages – i.e. the fact that the duty of care owed to them was breached in some way alone was not enough to obtain compensation. Eoin O’Dell’s excellent paper on compensation for GDPR breaches expertly outlines the issues with Collins, forcefully concluding:
the decision … in Collins is quite simply wrong – as a matter of principle, as a matter of national law, and as a matter of European law
In addition, judges sometimes order that replies to particulars be given which should not be ordered – many plaintiff personal injuries solicitors will probably have had this experience in the past. While, under the Acts, this may cure data protection issues for the plaintiff’s solicitor (because there is now a legal obligation to disclose the personal data) the GDPR, again, changes the landscape.
Which is where the GDPR comes in
Mr Justice Frank Clarke (Chief Justice) has recently commented in a number of forums about the challenges the GDPR raises for the judiciary and the need for privacy training among judges. Future disputes about particulars and discovery are likely to involve increased reliance on data protection concerns and the GDPR when before the courts. All of this should mean a more restrictive disclosure regime than has often existed in Ireland, despite the decision in Armstrong v. Moffatt on particulars and the changes in relation to discovery outlined by McGirr.
In the context of voluntary particulars and discovery, while O’Dell points out that the decision in Collins would not survive further challenge, it will be made redundant by the GDPR which requires that someone whose rights under the Regulation have been infringed must be entitled to seek compensation for both material and non-material rights (section 112 of the Data Protection Bill 2018 purports to implement this).
It is difficult to see how a solicitor is fairly processing personal data by unnecessarily disclosing it in these circumstances. This has been the case for many years, but a key change with the GDPR is that breach of data protection rights will no longer be mere technical, regulatory breaches but actionable ones that could give rise to compensation.
And, legal provisions aside, there is a very obvious and natural objection that someone might have to sending out all manner of personal information (including information about other family members or cohabitees) to third parties where it is not necessary to do so. Defence solicitors need to be robustly challenged on notices for particulars, or plaintiff solicitors may find themselves struggling to justify the unnecessary disclosure of their client’s personal data to insurance companies.
Court judgments, often complex and difficult to translate into a soundbite (or, these days, clickbait), are frequently misreported. This is particularly the case with European court judgments, whether from the ECJ, where Advocate General opinions are usually reported as “rulings”, or the European Court of Human Rights, where the consequences of decisions are frequently misstated. And that’s before you even get to the difference between the ECJ and the ECHR, another source of confusion.
This week the ECHR gave judgment on a case involving a Romanian engineer (Barbulescu v. Romania) who was disciplined for using Yahoo! Messenger during work hours. A key point here is that the Y! Messenger account was set up by the employee on the instruction of the employer for work purposes. It was not a personal account. The employee argued that the employer had breached his right to privacy, but the ECHR decided that the actions of the employer were limited and proportionate.
Most headlines and some reports represented the decision as meaning that employers can now spy freely on employee communications. This is quite a dangerous misinterpretation or oversimplification of the decision.
In passing down the ruling, the judges stated that unregulated spying on employees would not be acceptable, and called on a set of polices to be drawn up by employers that would clearly state what information they could collect and how.
The judgment is not a surprise to employment lawyers. These cases are focused on whether the employee has a reasonable expectation of privacy in their communications. Whether a reasonable expectation arises largely depends on whether or not policies are in place governing the use of communication services or whether warnings have been given to employees that communications may be monitored. Even if covert surveillance might be used, and such surveillance is sometimes necessary, a policy should be in place so that employees are aware that they might be subjected to covert surveillance at some point. The Employment Appeals Tribunal (now the Workplace Relations Commission) has previously said:
Setting traps and ambushes for an employee is inappropriate behaviour for an employer.
One interesting point, noted in the UK Human Rights Blog, is that the warning given to Barbulescu that his employer might monitor his communications was of a general nature. Such a warning by an employer in the Irish context might not be sufficient.
Barbulescu definitely does not give employers carte blanche to put their employees under surveillance. There remain – as there were before this judgment – cases where such surveillance is justified, and cases where it is not … national courts, perhaps excited by the new Regulation, might insist that higher standards apply in national law. For the time being, though, employers should be aware that there is still a fine line between acceptable and unacceptable monitoring of their employees.
He alludes to an important point: the judgment does not displace Irish employment or data protection law. The Data Protection Commissioner published guidance on workplace monitoring years ago which notes the importance of balancing the legitimate interests of the employer against the privacy rights of the employee. It requires that monitoring, whether by CCTV or access to electronic communications, be done in a transparent manner. An interesting recommendation, often forgotten by organisations, is that “[e]mployers should consider whether they would obtain the same results with traditional measures of supervision”.
[The] headline in the Mail : “Bosses free to spy on emails” should actually have read : “Bosses free to check that you are using their equipment to do what you are paid to do”. But where would be the news in that?
Cameras are everywhere these days, but CCTV systems have been popular since well before the advent of camera phones. For the most part CCTV cameras are positioned in fixed, known locations such as public offices, shops or streets. A variety of covert cameras are available which have been used for many years to detect theft and fraud in particular. Any such use of covert recording should only be undertaken with caution, in specific circumstances and on the basis of advice.
This week’s Limerick Leader carries a story of covert recording in the offices of a school. It appears from the report that the reason for covert recording was that sensitive files had gone missing from the school. The full circumstances of the case are not yet known. The use of covert CCTV systems raises one set of issues, the missing files another. Missing files indicates a security breach and while a loss of personal data (likely sensitive personal data) is not specifically governed in the Data Protection Acts 1988 and 2003 a duty of care arises and the Data Protection Commissioner has published a code of practice on dealing with such breaches.
In general terms, the main considerations in using CCTV systems are the individual’s constitutional right to privacy, the Data Protection Acts and employment law. The right to privacy is somewhat undefined as no specific privacy law has been enacted (a previous bill was abandoned). Data protection legislation does not specifically refer to recording equipment or CCTV but since cameras record images of individuals, the images themselves are personal data within the meaning of the Acts and the general rules therefore apply to them. It is crucial that the collection of personal data by recording images is justified. Security would be an obvious justification but the Data Protection Commissioner is very clear that security does not justify indiscriminate recording of employees, for example.
[U]sing a CCTV system to constantly monitor employees is highly intrusive and would need to be justified by reference to special circumstances. If the monitoring is for health and safety reasons, a data controller would need to demonstrate that the installation of CCTV was proportionate in addressing health and safety issues that had arisen prior to the installation of the system.
Cameras should not ordinarily be put in locations where occupants and visitors would have a reasonable expectation of privacy. Particular sensitivity might be required in a school, for example, which is obviously frequented by minors. In addition, the Acts require that people are provided with information about the data collected about them and who has collected it. In the context of CCTV, therefore, notices should be displayed indicating that recording is taking place, who is responsible for the recording and why it is being carried out.
Use for monitoring staff performance or conduct is not an obvious purpose and staff must be informed before any data are recorded for this purpose.
Of course, there are situations in which these rules will neither work nor be appropriate and the Acts do allow for this. Indeed, the collective EU grouping of data protection regulators accepts that employers may have to resort to covert recording in order to address fraudulent or criminal behaviour and that national laws may permit this. Employment law has long recognised that covert recording might sometimes be justified. But it is clear that specific consideration must be given on a case-by-case basis to the use of covert CCTV recording. Case studies of the Commissioner demonstrate the factors which must be borne in mind.
For data protection purposes, covert recording can be justified generally only with the involvement of the Gardaí. Covert recording may be justified in the case of criminal offences, but not for performance-related monitoring.
The use of recording mechanisms to obtain data without an individual’s knowledge is generally unlawful. Covert surveillance is normally only permitted on a case by case basis where the data are kept for the purposes of preventing, detecting or investigating offences, or apprehending or prosecuting offenders. This provision automatically implies that a written specific policy be put in place detailing the purpose, justification, procedure, measures and safeguards that will be implemented with the final objective being, an actual involvement of An Garda Síochána or other prosecution authorities for potential criminal investigation or civil legal proceedings being issued, arising as a consequence of an alleged committal of a criminal offence(s).
Where CCTV footage is recorded, whether covertly or not, obligations continue to govern its retention and access to it. It is common for operators of CCTV systems to refuse to provide copies of their recordings to anyone other than Gardaí. It should be noted that, because camera footage is the personal data of the people recorded on it, those people have a right of access to it under the Acts. Again the Commissioner is quite clear:
Where a data controller chooses to use technology to process personal data, such as a CCTV system to capture and record images of living individuals, they are obliged to shoulder the data protection obligations which the law places on them for such data processing. In the matter of access requests for CCTV footage, data controllers are obliged to comply fully with such requests. Claims by a data controller that they are unable to produce copies of footage or that stills cannot be produced from the footage are unacceptable excuses in the context of dealing with an access request. In short, where a data controller uses a CCTV system to process personal data, its takes on and is obliged to comply with all associated data protection obligations.
I wrote twicebefore on product recalls by Toyota and the apparent legislative oversight which meant that there was no legal provision allowing Toyota to obtain records of Toyota owners from the vehicle licensing authorities.
At any rate, the 2009 Regulations revoke and replace the 2005 Regulations and designate specified manufacturers and distributors as being entitled to obtain vehicle licensing records, rather than the generalised category stated in the 1996 Regulations.
The Regulations are lengthy but the Data Protection Commissioner already has a guidance note online outlining the changes introduced, the most significant being:
Compulsory notification of individuals and the Office of the Data Protection Commissioner in the case of data breaches
More stringent requirements for user consent for the placing of “cookies” on electronic devices
Stricter requirements for the sending of electronic marketing messages and the making of marketing phone calls
I previously wrote about mandatory reporting of data breaches in the context of general data protection law (rather than sector-specific rules).
Leo Moore (William Fry) points out that the new rules on cookies do not provide for a lead in time, as was the case in the UK. This will put pressure on operators subject to the rules to get their house in order quickly. He notes:
Website operators and other interested parties are keenly following how the Cookie Regulations will be interpreted and enforced in Ireland in light of the need to obtain website user consent each time a cookie is placed on a website user’s computer. Many such parties have concerns in relation to the practical implications of complying with such obligations.
I wrote a short article for last week’s Sunday Business Post on the super-injunctions story and the conflict between freedom of speech and privacy. It appeared in the Computers and Business magazine and is available here.
It’s a difficult topic to tackle in a short article and some more thoughts on the issue are in my earlier rambling blogpost. However, Karlin Lillington dealt with the issue expertly in last Friday’s Irish Times by contrasting the UK super-injunctions saga with the Irish experience of data protection and retention laws.
PRIVACY HAS two definitions. There is the definition that applies if you are wealthy, or a celebrity, or a corporation or organisation, and you wish carefully to protect from the public eye your infidelities, personal peccadilloes, ethically questionable activities, illegal doings or other foibles that might damage your income, reputation or bottom line.
Then, there is the definition that applies if you are just an ordinary citizen and a bank, an insurance company, an electronics manufacturer, a telecommunications company, a law enforcement agency, a government department or other organisation holds or would like to view lots of potentially sensitive information about you.
If you are in the former, elite group, lucky you. You will find you are entitled to all sorts of perks and privileges when it comes to your special definition of privacy. Your national government may come up with laws specifically to protect your version of privacy.
Justice systems may invent special protections that mean not only is no one allowed to mention whatever it is you or your company is said to have done, but no one is even allowed to mention that such a legal protection is there in the first place.
Social media and internet companies may, despite public statements about valuing their users and freedom and democracy, relinquish information about the people who might have said something annoying about you, your company or your government, the better to enable the justice system to get these aggravating people off your back.
If you are in the second group, your privacy is too often a commodity.
This morning’s Irish Times reports on a change to a Health Service Executive policy I never knew existed. Until now, Irish hospitals provided members of the clergy with access to patient admission records. This practice, the article reports, “has been stopped by recent data protection legislation.”
I was surprised by the reference in the article to “recent data protection legislation” and “new legislation”. The main Irish legislation in this area is the Data Protection Act 1988. It was amended in 2003. There are a number of regulations affecting those Acts but the most recent relates only to the Director of Corporate Enforcement.
So, is the new legislation referred to the 8 year old act or the 23 year old one?
The truth is, one might reasonable speculate, that the consequences of long-standing legislative requirements have recently been considered by the HSE and they changed their policy accordingly. [I since found that the Offaly Independent reported on this story last Friday, without any indication that the legislative requirement which led to the policy change was new or recent.]
Information on an individual’s health is sensitive personal data for the purposes of the Acts and is the category of personal information that is subject to the strongest protections.
The Data Protection Commissioner has published a guidance note on the application of the Acts to the health sector. That note begins with the following, non-legislative point:
The confidentiality of patient records forms part of the ancient Hippocratic oath, and is central to the ethical tradition of medicine and health care.
It goes on to say that
Given the immense sensitivity of health-related information, it is imperative that professionals in this sector be clear about their use of personal data.
This recent, very much belated, change of policy by the HSE suggests that the organisation may have some distance to travel in this regard.
There has been so much political uncertainty in recent weeks that one wonders what business of Government has gone on unnoticed. One such item of business, I discovered from the A&L Goodbody legislative FAQreferred to earlier, was the passing by the Oireachtas of the Communications (Retention of Data) Act 2011.
The President signed the Act into law on 26 January 2011 but, as far as I am aware, this has not been reported on anywhere. The commencement date is not known but the latest draft available does not contain a commencement clause so, if one was not inserted before it was passed by the Oireachtas, it is now in effect.
ISPs providing Internet services to the public are now obliged to retain certain data, as set out in the Act, identifying the occurrence of a communication (but not about the content of the communication itself). This must be done for every user, whether they are a private or business customer. In the case of Internet communications the ISP must keep the data for a period of one year … [The] ISPAI regrets [the passing of the Act] despite the trojan efforts of non-government Senators who argued the amendments (which were defeated) aimed at giving greater clarity to the legislation and particularly to minimise its potential to put Ireland at a cost disadvantage to our EU neighbours for Internet based business.
Digital Rights Ireland summarised the effect of the legislation when it was first put before the Oireacthas as follows:
In essence, the Bill requires telecommunications companies, internet service providers, and the like, to retain data about communications (though not the content of the communications); phone and mobile traffic data have to be retained for 2 years; internet communications have to be retained for one year … This will impose significant costs on those obliged to retain and secure the data, and those costs will be passed on to their already hard-pressed customers. And it is likely to drive international telecommunications and internet companies to European states which have introduced far less demanding regimes.