Robin Wilton's esoterica

It's all over the news at the moment. Yesterday, Professor Alec Jeffreys (the scientist who invented DNA fingerprinting), expressed his concerns at 'functional creep' in the UK's law-enforcement  database of DNA samples. He pointed out a fairly basic Data Protection issue, in the sense that when the database was first established, it was set up with the stated intention of storing the DNA of convicted criminals so as to make their arrest easier in case of re-offending; however, as well as the DNA of convicted offenders, the database now includes records for those arrested but found innocent, and of victims and witnesses who have given consent to being sampled.

Worryingly, in those cases where a non-offender has given consent, that consent cannot be withdrawn, according to Chief Constable Tony Lake (chairman of the strategy board for the database).

So let's just look at the law here. The Data Protection Act 1998 says the following:

Principle # 2. Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

and

Principle # 5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.

Incidentally, Principle # 1 says that:

1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless [the relevant conditions of Schedules 2 and 3 of the Act are met]. We'll see why that's a factor in a moment.

Of course, there are exemptions from the Act in the case of data being used for law enforcement; however, the law-enforcement exemption is clearly phrased as follows:

29. - (1) Personal data processed for any of the following purposes -
(a) the prevention or detection of crime,
(b) the apprehension or prosecution of offenders, or
(c) the assessment or collection of any tax or duty or of any imposition of a similar nature,
are exempt from the first data protection principle... [my underscore]

I'm interested and somewhat alarmed to see that the unlawful processing of PII seems to be permitted under this exemption.

However, you'll also note that the exemption is from the first principle, and not the second or fifth principles... in other words, the 'law enforcement' purpose apparently does not give and exemption from the requirements relating to 'purpose of processing' and 'period of retention'.

So if - as a victim of a crime - I am invited to give a DNA sample "so as to eliminate me from enquiries" on one occasion, and then ten years later the police find my DNA in suspicious circumstances at a crime scene, can they really argue that they are matching it against the database record "to eliminate me from enquiries", or are they doing so in order to confirm my guilt?

Let's not forget that, if the 'burden of proof' still applies, I must have been considered innocent at the time of the first sampling.

Over-all, I can't see a consistent logic in the way the DNA database is being used currently.


So what else...? Oh yes, today there's news of a report by the Surveillance Studies Network which describes the UK as 'the most surveilled country' by comparison with other Westner industrialised nations, and that it has 'more CCTV cameras and looser laws on Privacy and Data Protection'. When I can get a copy, I'll blog more.

I suspect the report has been carefully timed to co-incide with the 28th annual conference of Data Protection and Privacy Commissioners. As it happens, that's where I'll be tomorrow, on a panel to discuss "The Privacy Implications of User-Centric Identity Management Systems". If you're there, please stop by and say hi.