Robin Wilton's esoterica

The Information Commissioner's Press Release from yesterday is worth a look. The Criminal Justice and Immigration Bill was to have contained a clause introducing prison sentences for those convicted of trafficking illegally in personal data; that clause has apparently been watered down to the point where the Justice Secretary "will be able to introduce prison sentences if illegal activity continues"... though in the meantime the penalty will continue to be a financial one. Given that, in the same press release, the ICO cites some of the kinds of trafficking which it has exposed over the last two years or more, one has to wonder what further activity the Justice Secretary is waiting for.

I was lucky enough to take part in a fascinating discussion yesterday evening, with a mixture of policy-makers, regulators and technologists. The conversation took place under the Chatham House Rule, to encourage frankness, so I can't say who said what - but here's a snippet which neatly encapsulated one of the key topics.

"If you've just spent over £5bn on an ID cards system, and commercial organisations start to offer you large sums of money to mine various bits of the personal data you hold, the pressure to say 'yes' is going to be huge".

In the context of recent remarks about the Oyster Card database (see my previous post), and the publication of just how much cash the DVLA will admit to having raised through the sale of personal data, I'd say that's an entirely valid concern.

A lot of the discussion also circles around the different data-sharing perspectives of "service-providing" public sector bodies (such as, for instance, the health service, or benefits agencies) and "enforcing" public sector bodies such as Revenue and Customs, or the police and intelligence services. My own belief is that, where it's a matter of service provision, much more still needs to be done to give the citizen the ability to exercise consent and control over the disclosure and sharing of her/his data.

To take a relatively well-worn case: the example of "change of address" is often cited as a justification for public sector data-sharing; the argument is often that it is time-consuming and inconvenient for the citizen to have to write separately to each public sector body to notify them of a change of address. That may be so - but I think it's wrong to focus exclusively on that use-case while ignoring two others:

1 - some people would rather make their own decision about whether to allow their data to be shared, or whether to accept the 'inconvenience' of notifying individual bodies that they have moved house;

2 - some people seldom, if ever, move house. Unbridled data-sharing on behalf of those people who have no need for a joined-up 'change of address notification service' seems to me to be entirely inappropriate.

I think most of the people involved in yesterday's discussion readily grasp the importance of the distinction between consensual and enforcement-related data-sharing, but I think there are plenty of others who need to appreciate it more clearly and, as yet, do not. "Consensuality" might a hard word to spread, but it could be fun trying...

Oh, and here's the other reason the evening was such fun. This is the view from one of the windows of where we were:

It's part of the grounds of the Palace of Westminster. :^)  I have no idea where that cloaked bull came from, but I would be disappointed if it wasn't nicknamed... Ermine-trude.