The future of privacy in law enforcement: the United Kingdom's experience.

Personal privacy often is pervaded by well-meaning reasons of security or freedom of the press. Since 2000, the United Kingdom has been governed by the rights-based law of the European Court of Human Rights (ECHR). (1) Specifically, public authorities must not infringe on the rights of citizens without legitimate cause. (2) Will more invasions of personal privacy occur? Will a higher level of privacy exist for those who can afford it? Has a gradual and imperceptible erosion of civil liberties occurred?

Invasions of citizens' privacy occur every day in the interest of security or law enforcement. Are these invasions lawful, necessary, and the least intrusive possible? Invasions of privacy often occur when systems and processes commence following security incidents, and they sometimes remain for periods long after their use can be justified either morally or legally. Questions linger about potential abuses of personal privacy following terrorist incidents both in the United Kingdom and the United States. While many countries face the same challenges connected with this issue, the author offers the United Kingdom's experience as an example to help other countries concerned with this topic.

IDENTIFIERS

Closed-Circuit Television

A 1998 report in England revealed that "over the last decade, the use of CCTV systems in town centres, shopping precincts, and car parks has become widespread." (3) Indeed, the Home Office, a UK government department, actually funded many of the CCTV schemes. In 1997 and 1998, bids established 2,298 new cameras, and trade magazines calculated that the UK CCTV market was valued at over $490 million annually. UK citizens know that CCTV cameras are in many public streets, shopping malls, banks, and gas station forecourts. In fact, British citizens can expect to be caught on CCTV 500 times per week and have personal details stored on 300 corporate or government databases. (4)

Most citizens are not concerned; they receive a comforting message from the police, (5) who would not have detected serious crimes without CCTV. (6) Many countries now have regulatory frameworks for CCTV, but, until recently, the United Kingdom had only an advisory voluntary code. However, perhaps in recognition of these concerns, on October 24, 2001, it became a criminal offense to use an unregistered, nondomestic CCTV system to record people in a public or private place. (7) Certainly, concerns exist about the use of CCTV as it impacts upon privacy and its potential abuse (8) in the fight against crime, especially because some police departments now use community volunteers to view the CCTV monitors in a cost-saving initiative.

[ILLUSTRATION OMITTED]

Biometrics

Civil liberties watchdogs and privacy advocates are not comfortable (9) with biometrics, the science of verifying a person's identity by measuring unique features, such as nasal curvature, eye iris patterns, or hand shape. (10) Biometrics, from fingerprint and iris pattern recognition to walking patterns and even body odor, (11) also could eliminate the need to remember passwords and personal identification numbers (PINs).

One concern, already a reality, is the use of automatic facial recognition systems where people are unaware of the surveillance. These systems are used in UK soccer stadia where CCTV cameras scan the crowd and identify individuals whose facial characteristics are digitally stored in the pictorial database of alleged troublemakers or persons subject to court exclusion orders. A biometric facial recognition system also was used at a recent Super Bowl in the United States. With digital photographs on drivers' licenses and passports, the future of facial recognition already is planned far ahead.

The invasion of privacy continues with cameras in taxicabs and at public transportation terminals. Motor vehicle license plate readers record when people drive onto a ferry and when they return and keep logs regarding the frequency of these trips. Further, because these license plate readers know when people speed, they can use facial recognition technology intended to identify terrorists to catch speeding drivers. (12) One senior police officer advised that 10 percent of drivers caught speeding by traffic cameras avoided penalties; therefore, more sophisticated measures were necessary for effective law enforcement. (13) "This idea raises a host of sensitive civil liberties matters which would require very careful examination." (14) One organization recommended mass facial scanning to identify terrorists and pedophiles; its report suggests that the privacy rights of the majority of the community should be sacrificed to identify and prosecute dangerous criminals. (15)

But, many citizens do not mind this intrusion on their privacy when it helps speed their journey through tollbooths while using passes they pay for in advance or when global positioning systems help locate stolen cars. (16) However, people might object when the police can identify individuals' positions through triangulation of their mobile telephone calls, although no law of privacy is broken by use of such evidence. In the United States, the Federal Communications Commission requires that cell phone operators help police locate cell phones from which users have dialed 911. (17)

Surveillance

Police lawfully can take still photographs and video footage of suspects in public places in the United Kingdom. Further, police and authorized investigatory agencies lawfully can obtain and retain records of photographs, fingerprints, and other personal data because, according to European law, it is necessary in a modern democratic society for the prevention of crime. But, does this address photographs taken in a private place without the consent of the individual and where, even in a public place, people have an expectation of privacy, such as public restrooms or restaurants?

The criminal law Data Protection Act states that information should be kept only for as long as it serves the legitimate purpose of crime prevention; however, recent legislation has enabled police to take and retain DNA and fingerprints of persons arrested regardless of whether they are charged and convicted with an offense. (18) The UK national DNA database reached its halfway point of 1.5 million records, about 6 percent of the population, toward the target of 3 million. (19) In 2001, an increase of 34 percent occurred in sample matches with a more than 40 percent chance of DNA found at the scene of a crime matching a name on the database. Further, DNA matches assisted detection in 49 murders, 75 rapes, and 165 violent crimes. DNA samples can be taken from anyone charged with, reported for, and, subsequently, cautioned for a recordable criminal offense. How soon will the United Kingdom have a national database of DNA samples from all citizens?

Several cases recently have occurred where the police obtained evidence in the investigation of serious crimes by covertly recording conversations between suspected offenders while they were under arrest and detained in police cells--some of the recordings were between the suspects and their lawyers. Courts in the United Kingdom (20) have held that this sort of evidence is sometimes admissible, (21) although it is a breach of the right to private and family life under ECHR. (22) Other courts have thrown out such evidence, thereby releasing suspected murderers. (23) In the investigation of serious crime, two cases held that foreign telephone intercepts were admissible evidence if they were lawfully obtained in the monitoring country. (24)

INTRUSIVE SURVEILLANCE LEGISLATION

Covert surveillance laws relating to interception of mail and telephone communications were not subject to legislation in the United Kingdom prior to the year 2000. The courts hold that police surveillance "is a necessary evil in modern society," but that the surveillance must be "prescribed by law." (25)

Regulation of Investigatory Powers Act

The Regulation of Investigatory Powers Act 2000 (RIPA) commenced in the United Kingdom on October 2, 2000. The act was intended to replace, update, and satisfy the ECHR test of legality for police and investigatory agencies' activities in the areas of covert surveillance, the management and handling of informants, and the decryption of electronic communications. Commercial organizations are concerned that electronic communications might not remain confidential and business information might be accidentally or deliberately made available to competitors.

Privacy Issues

The Internet

With little or no control, users become victims of "cookies" (personal identification tags) placed in computers subliminally every time they link to the Internet. This poses a potential intrusion on privacy. In fact, because of privacy concerns, the European Commission introduced legislation to prohibit the use of cookies. Advertising executives thought this move seriously would damage electronic commerce and Internet advertising sales because information about individuals apparently is crucial for marketing and targeting purposes. (26)

One of the biggest concerns about online privacy issues is the lack of overarching principles--even federal laws are at the most minimal level. (27) Data protection principles in the European Union strictly require that individuals have to "opt in" before information can be collected. The United and Strengthening of America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act) (28) applies to college technology systems (29) and permits federal agents to obtain stored voice mail without wiretap authorization. It also allows Internet service providers to contact federal agents who do not need a search warrant to help them intercept the communications of a hacker.

Employment

Rules exist over company monitoring of e-mails and Internet use if employees download from inappropriate Web sites. But, to comply with the law, employers should make employees aware that they monitor Internet use. Now, companies can plug into corporate networks and monitor all e-mail traffic, including chat rooms, network printer lists, and instant messaging. Further, inappropriate content, including intellectual property or harassing messages, sets off an alarm.

Additionally, many employers no longer trust their employees to make or take telephone calls; companies often monitor calls for quality purposes. European courts have held that private telephone conversations should not be monitored unless parties receive notification of the possibility.

[ILLUSTRATION OMITTED]

A recent survey revealed that 78 percent of U.S. companies monitor their employees; Internet use is monitored by 63 percent of employers; 47 percent monitor e-mails; 15 percent have surveillance by video; 12 percent review and record telephone calls; and 8 percent review voice mails. (30) In addition, some Web sites that help users search for jobs have been accused of failing to adequately protect the privacy of millions of applicants whose curricula vitae are posted within massive databases. (31)

Marketing and the Media

Why are people targeted with unwarranted e-mails? Why do they receive unsolicited offers through the mail? Why do they get telephone calls from sales people? When people buy goods or respond to surveys or questionnaires, information about personal preferences and vital statistics sometimes are recorded and may be used subsequently to build a relationship with suppliers. Consumers should know that tools and technology exist to protect their privacy, but it is not in the interest of software or hardware suppliers to divulge this information. One computer company executive has called for legislation to protect consumers, stating that companies have not "lived up to the leadership responsibilities with such standards," although protections for consumers exist in many national jurisdictions. (32)

In one UK case involving intrusive photographs taken at a celebrity's wedding ceremony and the publication of them without the permission of the subjects, the judge said, "Equity and the common law were today in a position to affirm that everybody had a right to private space." (33) Legal commentators said that the decision was of huge significance in summarizing and developing the law of breach of confidence. (34) The judge used the Human Rights Act 1998 to justify the development of the law, saying, "that this is precisely the kind of incremental change for which the act is designed." This represents a clear development of existing law to use the remedy of injunction rather than damages because a previous case held that the common law in England does not recognize a right of privacy. (35) Also, a later case (36) decided that the courts were not justified in interfering with the freedom of the press simply because there was no identifiable special public interest in particular material being published. (37)

Personal Data

The UK Data Protection Act 1998 took effect on March 1, 2000, but its provisions are incremental and organizations do not have to fully comply for 7 years. The police service has some exemptions from the act's provisions relating to the use of data for intelligence purposes and data protection in that "personal data shall be processed fairly and lawfully." For example, officers can use information for intelligence purposes but must keep it confidential. (38) However, most police departments have developed protocols so that information can be lawfully shared with community safety partners, such as local and health authorities, to successfully achieve crime- and disorder-reduction strategies. In two UK court cases involving child-access name checks where police forces communicated confidential information about individuals to partner organizations, such as local education authorities, the infringements of rights to privacy were justified. (39) Also, the Consultancy Service Index (CSI) (40) maintained by the secretary of state for the Department of Health did not contravene the law. (41)

Identity Cards

Enhanced "smart" identity cards are within the capability of existing technology and could contain embedded chips to hold fingerprints and other data, such as biometrics and DNA profiles. They may increase security, but breaches of such data-bases could compromise hundreds of thousands of individuals. (42) On February 6, 2002, the UK Home Office announced that it intends to publish a consultation document on entitlement (identity) cards. Home Secretary David Blunkett said, "After the terrorist atrocities in the United States on 9/11, the issue of introducing an identity card scheme was raised by many people." He also advised that the idea of an entitlement card would allow people to prove their identity more easily and allow them to access public services, but any proposed legislation on entitlement cards would not make it obligatory to carry the card.

One futurologist predicted that computer chips will be inserted into the human body and connected to nerves to govern sensations. (43) Meanwhile, the first experiment of linking the human nervous system to a computer already is taking place in the United Kingdom. (44)

It seems that some people have fewer rights than others, as all asylum seekers throughout Europe will be forced to provide their fingerprints, although not convicted of any offense. (45) The Eurodac fingerprint database will allow the Immigration Service to check the fingerprints of asylum seekers in the United Kingdom against the records of other European Union (EU) countries. If asylum seekers already have claimed asylum in another EU country, authorities will ensure that they are returned to have their claims dealt with there. Since 1993, the United Kingdom has been authorized to fingerprint asylum seekers. This ability meets with EU and UK data protection requirements.

Identity Theft

Identity theft is one of the fastest growing cybercrimes, and the rewards are great. (46) For example, a former employee of an insurance company was arrested and charged with stealing the identities of colleagues from a company database containing over 60,000 names. (47) He sold some of them over the Internet as part of a credit card scam and offered names and social security numbers for $50 each; one employee had $2,000 dishonestly charged to his credit card. Estimates place the cost of identity fraud in the United Kingdom at over $1.9 billion per year, and a consultation document on how to combat this growing crime was circulated by the government during 2002. (48) In November 2003, the home secretary outlined plans to phase in an identity card scheme in the United Kingdom to "help tackle issues like illegal working, immigration abuse, fraud, terrorism, and organized crime." Further, the result on the consultation with the public revealed that 62 percent of people in the United Kingdom were in favor of ID cards. (49)

THE FUTURE OF PRIVACY

Potential threats to privacy currently exist and have a wide application and impact on many individuals. Will policing continue to assist in the erosion of privacy, or will it, as its remit should be in a democratic society, uphold the rights of the individual to maintain confidentiality and personal integrity? Two experts proposed three models of policing in the future: the enabling police force, the crime fighters, and the social engineers. (50) While it is accepted that no police force pursues one model to the exclusion of all others, the crime-fighter model could place citizens' rights to private and family life at greatest risk. The crime fighter police force is waging war on crime through the use of high-technology surveillance, tracking, tagging, and intelligence systems. Ancillary aspects of policing that do not form part of crime fighting are outsourced and uniform police work is limited to intelligence gathering and crackdowns. Is this the highly specialized police force of the future, or do other paradigms exist?

More security will occur in the short term through the response to 9/11. (51) Police will be granted heavy powers to ensure the safety of the community against terrorists--but at what cost? Will it be to the ultimate alienation of police from society? Will the financially wealthy be able to buy privacy with gated residences and an ability to litigate against public authorities and the media? Many questions concerning invasion of privacy still require answers.

Existing systems can track and monitor an individual's actions in real time and over a period of time, which could result in "super surveillance." This will be further exacerbated when databases become linked and interlinked, thereby causing possible unauthorized and unlawful use or disclosure of information.

CONCLUSION

Invasions of privacy frequently occur, often unbeknown to many individuals. The United Kingdom has enacted laws to protect its citizens, but questions remain about potential abuses of personal privacy in the interest of security or law enforcement. Various techniques, such as closed-captioned television, biometrics, and surveillance, exist to invade the privacy of others, and courts in the United Kingdom have addressed issues related to evidence obtained by these methods. Further, privacy issues arise regarding Internet use, marketing and media outlets, and personal data for intelligence purposes. Existing technology already has the ability to add biometrics to identity cards.

The future of privacy depends on the acknowledgment of many unanswered questions. The ability to invade another's privacy already is well documented. Law enforcement should carefully determine its strategy regarding incremental intrusion on privacy--reduction in liberty is unacceptable in a democratic society.

Further Reading

A. Beckley, The Human Rights: The Pocket Guide for Public Authorities (Hampshire, UK: The New Police Bookshop, 2002).

M. Colvin, Under Surveillance: Covert Surveillance and Human Rights Standards (London, UK: Justice, 1998).

P. Neyroud and A. Beckley, Policing, Ethics and Human Rights (Cullompton, Devon, UK: Willan Publishing, 2001).

P. Neyroud and A. Beckley, "Regulating Informers: The Regulation of Investigatory Powers Act, Covert Policing and Human Rights," in Informers: Policing, Policy, Practice, eds. Billingsly, Nemitz, and Bean (Cullompton, Devon, UK: Willan Publishing, 2001).

Endnotes

(1) The Human Rights Act 1998 commenced on November 2, 2000.

(2) ECHR, Article 8: The Right to a Private and Family Life.

(3) Madeline Colvin, Under Surveillance: Covert Surveillance and Human Rights Standards (London, England: Justice, 1998).

(4) As reported by Privacy International in The London Times, March 7, 2002.

(5) Policing with Intelligence, Her Majesty's Inspectorate of Constabulary, Thematic Inspection Report 1997/8.

(6) For example, the murder of a toddler by two juveniles whose identities were established when police viewed the CCTV recordings in a shopping mall; retrieved August 4, 2003, from http://www.crimelibrary.com/classics3/bulger.

(7) Provisions of the Data Protection Act 1998 and the Regulation of Investigatory Powers Act 2000.

(8) T. Bennett, and E. Gelsthorpe, "Public Attitudes Toward CCTV in Public Places: Studies in Crime Prevention"; J. Ditton, "Public Support for Town Centre CCTV Schemes: Myth or Reality?" in C. Norris., J. Moran, and E. Armstrong, eds., Surveillance, CCTV, and Social Control (Aldershot, UK: Ashgate Publishing Company, 1998).

(9) See http://motherjones.com/magazine/JF02/up_close.html.

(10) See http://www.fcw.com/geb/articles/2002/0311/web-face-03-04-02.asp.

(11) David Rowan, "The End of the Password?" The Independent, March 23, 2002.

(12) The Daily Telegraph, January 31, 2002.

(13) Richard Brunstrom, chief constable of North Wales Police and head of the Technical Committee of the Association of Chief Police Officers of England, Wales, and Northern Ireland.

(14) John Dawson, Policy Director, UK Automobile Association.

(15) Thomas C. Greene, "Think Tank Urges Face-scanning of the Masses"; retrieved August 4, 2003, from http://www.theregister.co.uk/content/6/20966.html.

(16) Jeffrey Selingo, "It's the Cars, Not the Tires, That Squeal," The New York Times, October 25, 2001.

(17) See http://news.co.com/2100-1033-846744.html.

(18) Criminal Justice and Police Act 2001.

(19) See http://www.excelsor.pwcglobal.com/knowledge/article.asp.

(20) R v [1] Mason [2] Wood [3] McClelland [4] Tierney, February 13, 2002, Court of Appeal.

(21) Police and Criminal Evidence Act 1984, Section 78.

(22) Supra note 2.

(23) "Family Vents its Fury as Murder Trial Collapses," The London Times, February 20, 2002.

(24) R v X, Y and Z (2000) and R v P and Others (2000), Times Law Reports, December 19, 2000 (November 11, 2000; House of Lords).

(25) X v Germany (1976) 3 DR 104.

(26) "Proposed European Legislation Takes Aim at Cookies," Sans newsletter, October 31, 2001. See http://www.wired.com/news/politics/0,1283,48025.00.html.

(27) Laura J. Gurak, director of the Internet Studies Center and associate professor in the rhetoric department at the University of Minnesota-Twin Cities and author of Cyberliteracy: Navigating the Internet with Awareness (Yale University Press). See http://chronicle.com/free/2002/2002021901t.htm.

(28) PL 107-56, October 26, 2001, 115 Stat 272.

(29) Scott Carlson and Andrea L. Foster, "Colleges Fear Anti-terrorism Law Could Turn Them Into Big Brother," The Chronicle of Higher Education, February 28, 2002. See http://chronicle.com.

(30) Eric J. Sinrod, "E-legal: Electronic Surveillance in the Workplace," October 16, 2001; see http://www.law.com.

(31) "Systemic Privacy Abuses at Monster.com"; http://www.newsbytes.com.news/01/169779.html.

(32) See http://update.internetweek.com/cqi-bin4/.

(33) Michael Douglas, Catherine Zeta-Jones, Northern and Shell plc v Hello Ltd. (2001) Court of Appeal December 21, 2001, Times Law Report, January 16, 2002.

(34) Philip Plowden, "Right to Privacy," Journal of Civil Liberties, University of Northumberland, School of Law, Northumbria Law Press, March 2001, 57-72,

(35) Secretary of State for the Home Department v Wainwright and Another (2002), Times Law Report, January 4, 2002.

(36) A v B plc and Another, Court of Appeal, Times Law Reports, March 13, 2002.

(37) The Human Rights Act 1998, Section 12, and ECHR, Article 10, Freedom of Speech.

(38) See Alan Beckley, The Human Rights Guide for Public Authorities (Hampshire, UK: The New Police Bookshop, 2002).

(39) Article 8 infringements are subject to the "pressing need" test, which, in this case, justified the infringement.

(40) A register of people deemed unsuitable to work with children. In these cases, the court agreed that "the maintenance of the CSI was in proportion to the objective to be obtained."

(41) Supra note 2.

(42) Ari Schwartz, Center for Democracy and Technology, Washington, DC. See http://www.nandotimes.com/technology/story/269751p-2478282c.html.

(43) @METRO Free Newspaper, February 28, 2002, (Trinity Mirror plc: London).

(44) "Briton Wires Nervous System to a Computer," Reuters, March 22, 2002. See http://www.nytimes.com/reuters/technology/tech-britain-cybernetics.html.

(45) Police related press releases for February 28, 2002; "Final Agreement Reached on EU Fingerprint Database for Asylum Seekers," provided by Police Profiling from Horn Ltd.

(46) For more information on identity theft, see Matthew L. Lease and Tod W. Burke, "Identity Theft: A Fast-Growing Crime," FBI Law Enforcement Bulletin, August 2000, 8-13; and John Pollock and James May, "Authentication Technology: Identity Theft and Account Takeover," FBI Law Enforcement Bulletin, June 2002, 1-4.

(47) Jacob H. Fries, "Worker Accused of Selling Colleagues' IDs Online," New York Times, March 2, 2002; retrieved on August 4, 2003, from http://www.nytimes.com/2002/03/02/technology/02INTE.html.

(48) "Government Joins with Private Enterprise to Fight Identity Fraud," daily police-related press releases, provided by Police Profiling from Horn Ltd., March 21, 2002.

(49) "Blunkett: ID Cards to be Phased In," daily police-related press releases, November 11, 2003.

(50) P. Neyroud and A. Beckley, Policing, Ethics, and Human Rights (Cullompton, Devon, UK: Willan Publishing, 2001).

(51) Overwhelming evidence was provided to the author at "Homeland Security: Policing in the 9/11 Era," a conference hosted by The Institute of Law Enforcement Administration of the Center for American and International Law, March 25-27, 2002.

By Alan Beckley, M.Law, M.Sc.

Mr. Beckley, a retired chief inspector for the West Mercia Constabulary, United Kingdom, is a member of the Society of Police Futurists International.