Southampton City Council has lost its landmark appeal against an enforcement notice issued by the Information Commissioner over its policy of requiring continuous audio-recording in all licensed taxis.
The council’s licensing committee had adopted a policy in 2009 requiring all taxis and private hire vehicles to install CCTV equipment. This followed a number of serious violent and sexual offences taking place in or around taxis and was a bid to protect vulnerable users of taxis. A voluntary scheme had previously failed.
The ICO served the notice on Southampton in July 2012, ordering it to stop the mandatory recording. It was the authority’s requirement for continuous audio-recording to which the watchdog objected, not the requirement for continuous video-recording. The council appealed.
The First-Tier Tribunal (Information Rights) heard the appeal – the first ever surveillance case under the Data Protection Act – on 30 and 31 January this year.
In its ruling, the FTT said it was clear that the Commissioner had power under s. 40(1) to issue an enforcement notice against the council if he was satisfied that the audio-recording involved the contravention of a data protection principle. The primary issue was whether he was right in his conclusion that this was so.
In deciding whether to exercise the power to issue an enforcement notice, the Commissioner was also obliged to consider under s. 40(2) whether ‘the contravention has caused or is likely to cause any person damage or distress’.
Although accepting that a finding to this effect was not a pre-condition to issuing an enforcement notice, Southampton argued before the tribunal that the IC approached s. 40(2) in a fundamentally flawed way. The council also argued that even if he was right to conclude that the council was contravening the first data protection principle, he ought not, as a matter of discretion, to have issued an enforcement notice.
The parties agreed that the essential question on contravention was whether Article 8 of the European Convention on Human Rights (the right to privacy) was infringed by Southampton’s policy, and whether the policy was justified as a proportionate means of achieving a legitimate aim.
In summary, the specific issues in the appeal were:
1.Whether the words recorded under the council’s policy included “sensitive personal data”;
2.Whether the council’s policy infringed Article 8 of the ECHR;
3.Whether the Commissioner was right to exercise his discretion to issue an enforcement notice.
Ruling unanimously in the Information Commissioner’s favour, the tribunal concluded in particular that the council’s policy “in so far as it requires continuous blanket audio-recording of everything said in taxis, is disproportionate when the extent of the interference with the right of privacy is weighed against the marginal benefits to the legitimate social aims of increasing public safety and reducing crime in relation to taxis which are likely to result from it”.
The tribunal added: “It follows from that conclusion that the policy is not justified under Art 8(2) and accordingly that it contravenes the first data protection principle.”
However, it also said it was impressed by the police evidence in the case. The tribunal appreciated the nature of the problem and the special vulnerability of some taxi passengers.
“It may be that…there is scope for a more targeted scheme involving audio-recording based on times of day, types of customer (for example, children or vulnerable adults carried under contract between a taxi firm and the council), the use of panic buttons or a combination thereof, which strikes a better balance between the competing considerations and does not contravene the Data Protection and Human Rights Acts,” the tribunal said.
Welcoming the ruling, a spokesman for the ICO said it understood that councils must take measures to keep the public safe and that the use of CCTV in taxis could play an important role in keeping passengers and drivers secure.
“However the continuous recording of people’s conversations 24 hours a day, including when the taxi is not in use, clearly goes too far and is disproportionate to the problem it is trying to address,” he said.
“We are glad that the tribunal dismissed the appeal made against our original enforcement action by Southampton City Council and hope that any other councils considering the mandatory introduction of similar schemes take note of this legal judgment.”
The spokesman added that the ICO was happy to support and advise councils who were “trying to get the balance right between keeping the public safe and respecting their rights to privacy” and urged them to read our CCTV Code of Practice.
It emerged during the hearing that since the licensing condition was introduced, the police had asked the council for access to audio-visual recordings made in taxis on 193 occasions, of which a chief superintendent had been able to review 164 where it had been possible to get access to a relevant recording.
Of these the vast majority involved criminal allegations against drivers or passengers, including racially aggravated and sexual assaults. The largest group involved allegations of making off without payment. A substantial number of requests did, however, involve serious criminal offences, but did not directly involve taxis – the police simply seeking evidence that might assist their enquiries.
In relation to the three key issues, the tribunal’s findings included:
Sensitive personal data
* It was “quite satisfied that the inhabitants of (and visitors to) Southampton will from time to time discuss their own and others’ sex lives, health, politics, religious beliefs and so on in taxis (notwithstanding the presence of the taxi driver) and, if necessary, we take judicial notice of that fact”.
* There must be numerous conversations in taxis of a sensitive nature which do not necessarily come within the strict definition of ‘sensitive personal data’.
* A suggestion by Southampton’s QC that it was open to taxi users, having been informed by the label in the taxi that conversations were being recorded, not to discuss sensitive matters they did not want to be recorded was unrealistic. “We not see any reason why anyone should be forced to modify their normal behaviour in such a way, by being forced to treat what is now (at least) a semi-private space as a public one, not least the taxi-driver driving his taxi to a holiday destination with his family”.
* It noted a point by the IC’s barrister that if the council’s policy resulted in people ‘self-censoring’ their conversations, that would prima facie involve a contravention of Article 10 of the ECHR (guaranteeing freedom of speech).
Infringement of Article 8
* The Commissioner accepted that the policy served a legitimate aim and that there was a pressing social need for some surveillance in taxis. The real issue was whether Southampton’s policy of continuous audio-recording was ‘proportionate’.
* The question whether the policy was “proportionate” was ultimately one of judgment for the tribunal, balancing the benefits to the legitimate social aims it was likely to achieve against the extent of the interference with the right of privacy likely to be caused.
* In striking this balance it was “important to note two things: (a) the “legitimate aim” of the policy is that of deterring and detecting taxi-related crime and other misconduct; the fact… that the police have been able to obtain useful evidence about crimes not directly related to taxis cannot therefore come into the balance as a benefit; (b) the relevant benefits and disbenefits are only those marginal ones that come from audio-recording; no-one is complaining about the existence of CCTV in taxis as such or about video-recording.”
* As the council pointed out “forcefully”, there were special features of taxis which made those who use them particularly vulnerable to crime. These include the fact that: passengers and drivers were generally strangers to one another; passengers might be children, have disabilities or be intoxicated; or the driver faced the risk of passengers making off without payment.
* The tribunal accepted that the existence of CCTV in taxis tends to deter crime and assists in its investigation when it does occur. It also accepted that it assists the council in relation to its function of licensing only suitable taxi drivers.
* The extent of any deterrence, and in particular the extent of any additional deterrence arising from audio-recording was unlikely to be susceptible to proof. An attempt by the council’s licensing manager in his written statement to enlist statistical evidence was unsuccessful.
* However, the tribunal did accept there must be some form of additional deterrent effect from having continuous audio-recording in taxis.
* In some cases the existence of audio-recording in addition to video-recording had made a real difference. “The clearest were a few cases where drivers had alleged that passengers were guilty of racially aggravated assaults or racial abuse where, obviously, the existence of audio-recording was crucial.” There were also allegations of sexual assault where the video recording did not show what was going on out of view of the camera but an audio-recording would help.
* The benefit comes form the ability not only to prove true allegations but also to disprove false allegations. It was also “right to recognise that while few of the examples raised involved really serious crime, it may be that one day there is a rape or a murder associated with a taxi which would have been successfully prosecuted if there was audio-recording but not if there was only video-recording”.
* The Commissioner had proposed a ‘panic button’ system allowing the driver or passenger to activate audio-recording. However, the Commissioner had not fully met the council’s criticisms of such a system. The tribunal accepted that a panic button system would not be as effective as continuous audio-recording, would require vulnerable or incapacitated passengers to make use of it and would miss the initial and perhaps most important part of an incident. However, such a system would have some (“albeit limited”) additional benefits.
* In terms of interference with privacy rights, “every single conversation, however private and however sensitive the subject matter, taking place during every single taxi ride in Southampton (of which there may well be a million a year) will be recorded and accessible to a public authority”.
* The tribunal accepted as highly relevant considerations aspects of the policy that Southampton’s QC argued meant there was only a slight interference with privacy rights: the data was only retained for a short time (14 to 30 days) unless it was accessed for good reason; access to the data was confined to a few individuals; and access was strictly controlled. The evidence was that the data had only been accessed on about 200 occasions in three years. It was not in any sense continuously monitored.
* However, the tribunal said these points were weakened by a number of factors: for example, Southampton’s policy, in so far as it relates to audio-recording, was not very fully consulted on or well thought through. “Rather it appears to have been driven by technological developments”. The retention period was simply a function of the capability of the systems.
* There was also evidence of so-called ‘function creep’. “The use of the system by the police to gather evidence about crimes not directly related to taxis, however beneficial in itself, was not (or should not have been) part of any policy devised by the council arising from its taxi licensing function.”
* It had to be accepted that however robust the systems in place and however well-intentioned and conscientious the licensing manager was – “and he made a generally good impression on us” – there must always be a danger that a taxi driver or a council official or someone else will access and make improper use of the data.
* The tribunal wondered whether full consideration had been given to the interests of data subjects other than the requester who submitted a data access request. It noted that once in the hands of the requester, “notwithstanding the council’s standard letter warning him that to publish will involve a breach of the council’s copyright, there is little that anyone can do in practice to control the use of such data (and these days they can be instantly broadcast to the whole world through sites like YouTube)”.
* Exercises by both the council and the IC to demonstrate public support for their respective positions were not sufficiently focused on audio-recording to have an influence on the tribunal’s decision. No weight could be attached to complaints from taxi drivers (as cited by the Commissioner) without knowing more about their motivation.
* Some weight was given to the views expressed by the Commissioner in his 2008 Code of Practice on CCTVin which he said there were only limited circumstances in which audio recording might be justified, subject to sufficient safeguards that might include where recording is triggered due to a specific threat, “e.g. a panic button in a taxi cab”.
* Having regard to these considerations, the council’s policy in so far as it required continuous blanket audio-recording of everything said in taxis, was disproportionate when the extent of the interference with the right of privacy was weighed against the marginal benefits to the legitimate social aims of increasing public safety and reducing crime in relation to taxis which were likely to result from it. It followed from that conclusion that the policy was not justified under Art 8(2) and accordingly that it contravened the first data protection principle.
* The tribunal wished to record that it was impressed by the police evidence in this case. It also appreciated the nature of the problem and the special vulnerability of some taxi passengers. “It may be that…there is scope for a more targeted scheme involving audio-recording based on times of day, types of customer (for example, children or vulnerable adults carried under contract between a taxi firm and the council), the use of panic buttons or a combination thereof, which strikes a better balance between the competing considerations and does not contravene the Data Protection and Human Rights Acts.”
The exercise of the discretion by the Commissioner
* The tribunal was inclined to agree with the council’s QC that the Commissioner did not apply a sufficiently stringent test of likelihood of damage or distress.
* However, it did not think that it needed to consider that matter further “for the simple reason that, having concluded that the council were acting in breach of the Data Protection Act and having regard to the high level of public importance of the case, we think it must have been right in this case to decide to issue an enforcement notice, regardless of the likelihood of any actual damage or distress resulting from the policy”.
Anya Proops of 11KBW represented the Information Commissioner. Timothy Pitt-Payne QC, also of 11KBW, was counsel for Southampton.
Philip Hoult
source: http://www.localgovernmentlawyer.co.uk/
No comments:
Post a Comment