Naked Law

ICO consultation draft guidance

2009-11-10T18:45:18+00:00

An update on the ICO's monetary penalty consultation - recent draft guidance has set the maximum penalty for serious breaches of the Data Protection Act at £500k. The ICO believes this is a proportionate sanction for serious contraventions of the data protection principles, and has stated that the possibility of a monetary penalty 'should act as an encouragement towards compliance, or at least as a deterrent against non-compliance' on the part of data controllers.

The guidance states that, following an investigation to determine whether there has actually been such a contravention, the Commissioner will determine whether a monetary penalty is appropriate and the amount of that penalty firstly based on the underlying aim of the measures to promote compliance with the DPA and then based on the circumstances of the particular breach. Factors including the nature of the data, the number of people affected by the breach, whether it was a one-off incident or part of a series, the duration and extent, whether the breach was deliberate and the steps taken by the data controller to prevent such an incident may all be taken into account.

Interestingly, the Commissioner will also consider the size and financial and other resources of the data controller in determining the amount of monetary penalty, and it seems that a data controller with substantial financial resources is likely to attract a higher penalty than one with limited resources for a similar contravention. So large organisations should beware - it would seem that once the 'serious' threshold is crossed in relation to the breach, financial resources may 'proportionately' affect the size of the fine (sorry, monetary penalty) imposed.

The consultation period ends on 21 December this year, and as yet there is no definitive information as to when these measures will be implemented - though the Commissioner has made his eagerness to use the powers public knowledge.

Incidentally, a slight inadvertent slip in Part 4 of the draft guidance - '...whether liability to pay the fine will fall on individuals...'

Good news for disclaimers?

2009-11-03T10:50:51+00:00

A recent Court of Appeal case may be good authority for saying that website disclaimers can be effective.

A husband and wife wanted a swimming pool in their garden. They searched the Swimming Pool & Allied Trade Association ("SPATA") website (http://www.spata.co.uk/) in order to find a contractor. The website explained that contractors listed were approved member companies who were fully vetted. Having found their details on SPATA, the claimants engaged Crown Pools Ltd ("Crown") to do the work. However, the work was not completed due to Crown becoming insolvent. The couple alleged that they had suffered financial loss and bought proceedings against SPATA on the basis that Crown was not in fact a full member of SPATA and SPATA had made negligent misstatements on their website to this effect, which the claimants had relied upon.

SPATA successfully argued that they had urged visitors to the site to seek further information as to the members, ie by obtaining an information pack (which had the Claimants done, they would have discovered that Crown was not a full member). This guidance appeared on the home page of SPATA and the list of members was sited very near to the wording mentioned above, namely that 'SPATA supplies an information pack and members lists which gives details of suitably qualified and approved installers in the customer's area'. The court held that the fact that visiters were directed to obtain an information pack meant that it was not liable where a visiter relied on wording on the website without seeking the information pack. Therefore, the Court of Appeal held that SPATA did not owe a duty of care to the couple.

The verdict will surely be welcomed as it is one of the first to consider the issue of website disclaimers. I note that the judge specifically states that the fact that the list of members appeared on a website did not make any difference and that no special considerations apply to representations on websites. However, the fact that in this case a mistake on a website did not necessarily lead the website provider to be liable, means that this could represent good news for website operators who, up until now, have had little guidance or inkling as to the enforceability of their website disclaimers. The case did not, unfortunately, give a steer on where a disclaimer must be found for it to be able to be enforced against a visitor, but no doubt it was relevant that the wording in this case relied upon by the website operator was very close to the representation in question.

Digital Economy Bill due soon

2009-10-23T11:49:00+01:00

Proposals for new legislation to combat internet piracy are expected be announced at the State Opening of Parliament. It will be interesting to see how the government’s thinking has evolved since the Digital Britain report suggested that those who illegally download films and music may have their internet connections slowed.

You may recall that in August, Lord Mandelson upped the ante by voicing his opinion that people who illegally download films and music should have their internet connection cut off and possibly incur a fine of up to £50,000.

Whilst Lord Mandelson’s comments have not been unanimously supported some luminaries of the music world, including Elton John, have backed the harsher sanction. Presumably those pirates who have illegally downloaded Mr John’s songs have found that sorry seems to be the hardest word.

Latest ICO intelligence at Intellect

2009-10-21T17:34:00+01:00

I'm on my way back to Cambridge after a meeting at Intellect's Russell Square offices about the new Information Commissioner and the latest from the ICO. Interesting points covered included:

ICO will be able to impose fines from early next year for serious breaches with potential to cause substantial damage or distress (which we knew already) - but they're 'monetary penalties' and not fines because they are not criminal sanctions.
Monetary penalties are still under consultation. ICO currently favours setting a maximum figure (rather than unlimited penalties or a percentage of turnover). The level is likely to be a 'substantial figure' (though less than £1m). Likely to go to a public consultation later this year so may still change further.
April still the best bet for when the fines ... er ... penalties ... will be available to the ICO.
They won't only apply to security breaches/7th principle breaches (though the ICO would have expected to be able to impose penalties on HMRC, MOD and the people behind the construction employee gaffe that all made headlines if the power had been introduced earlier).
Also talk about compulsory audits (after 'assessment notices') for central Government (and other sectors, where extended by order).
And data breach notification is still on the radar and still under discussion by the EC.

I’m a celebrity…get me out of this courtroom!

2009-10-06T10:18:13+01:00

As from 1 October 2009, and for the first time in English legal history, Supreme Court proceedings may be televised. We’re passing comment on this in the Naked Law forum because although no mention has yet been made of the possibility of downloading coverage from the internet, one assumes it would be the next logical step...and even if it isn’t, this story is of general interest!

Broadcasting is banned from all other courts in England and Wales, but new rules apply to the Supreme Court under the Constitutional Reform Act 2005. Although the public have been able to see parts of House of Lords proceedings previously, such as the Pinochet extradition, the new broadcasting rules allow unprecedented access to proceedings.

The big objective of broadcasting is to make proceedings more accessible to the public, although there are (naturally) limitations. Footage will be filmed by the court and then passed to broadcasters; justices will be able to stop filming as necessary; and the footage may only be used for news, current affairs and educational and legal training programmes. In this way, the State should be able to overcome privacy issues, but even so, one feels that Strasbourg beckons in the not too distant future.

It remains to be seen whether the decisions of the Supreme Court Justices will be scrutinised as carefully as those of Alesha Dixon during Strictly Come Dancing.

Your privacy is not worth tuppence

2009-09-23T12:59:30+01:00

There have been concerns recently about the value the courts put on people's sensitive personal data. Readers may recall that in November 2008, the entire BNP membership list was published online. Approximately 12,000 names, addresses, phone numbers and email addresses were disclosed. This information was clearly "sensitive personal data" under the Data Protection Act 1998 ("DPA"), as in the context it related to the political opinion of BNP members.

Due to its sensitive nature, political opinion is meant to be fastidiously protected by the DPA (and the data controller). As a result of BNP membership disclosure, some of those named were attacked, had their property vandalised, received white powder through the post (said to be anthrax) and one BNP member lost his job as a police officer (see here). The police received more than 160 complaints about the disclosure and its consequences. It comes as some surprise then that, following an investigation to have cost around £50,000, a former BNP security chief was fined £200 by the Nottingham Magistrates' Court. He was also ordered to pay costs of £100.

So, the disclosure of each individual's name attracted a fine of about one and two thirds of a penny. Mary Poppins couldn't feed the birds for that.

The judge is reported to have said that the fine had to be "so low as to be ridiculous" because the former BNP security chief was living off benefits, but that may not satisfy those who suffered harm to themselves and/or their property as a result of the illegal disclosure.

To put the level of the fine into context, in December 2006, the Liverpool Magistrates' Court fined Liverpool City Council £300 for failing to respond to an information notice issued by the Information Commissioner's Office. This Naked Lawyer is not convinced that the punishments in data protection cases always fit the crime. Perhaps when the Information Commissioner finally receives the power to fine those who breach one of the eight data protection principles, the unauthorised disclosure of another's political opinion will attract a rather stiffer fine. It is currently anticipated that the Information Commissioner will receive this power in April 2010.

L'Oreal not worth it on eBay

2009-07-15T14:45:27+01:00

It has been widely reported that L'Oreal have recently lost a case against eBay in France concerning the sale of counterfeit L'Oreal goods on eBay. This is one of a reported number of cases L'Oreal is bringing against eBay in different jurisdictions around Europe (including recent decisions in the UK and Belgium) in a series of cases which may have implications for the liability of online sales portals for third party actions.

It is also potentially a welcome relief for eBay following an unfavourable ruling in France in the Louis Vitton case. The general manager of eBay France, Alexander von Schirmeister, described the case as “a big victory for eBay” and “more importantly, a big victory for French consumers".

L'Oreal's contention in France was that eBay should be doing more to actively prevent conterfeit goods bearing L'Oreal trade marks from being sold in eBay. eBay's defence was that they had a procedure (the VERO procedure) for rights owners to report illegitimate sales of goods. They responded promptly when illegal activity was brought to their attention, but did not proactively screen content unless a report was made.

The French Court decided that eBay had put sufficient measures in place and is acting in good faith in its dealing in this area. The Court's view was that a sensible approach was for rights owners and internet hosting providers to work together on this issue, avoiding litigation where possible.

The writer has significant issues with the Louis Vitton decision and its consistency with the E-commerce Directive 2000 (specifically Article 14) - specifically whether this decision impliedly imposes a positive obligation on eBay (and others) to actively monitor third party content on their websites. Hopefully this series of decisions represents a consistent approach towards determining the liability of hosting services providers for illegal actions committed through their websites. Also, the writer hopes it helps to demonstrate to rights owners that collaborating with hosting service providers is preferable to resorting to the Courts at the first opportunity.

L'Oreal is reported to be appealing the French ruling, so sadly this might have some way to go.

Digital Britain - will it guarantee access?

2009-06-17T13:06:53+01:00

The Government proposes to tax fixed phone lines for broadband roll out. The big question remains for those with "theoretical" broadband access -- the ones who have it but at much less than the advertised rate, or intermittently, or both -- whether there will be a commitment to ensure that there is recourse for such consumers. Despite the lack of concern from OFCOM about the poor service given by many broadband providers because apparently few complain, there are many out there who are simply resigned to a service which is below the advertised speeds.

Human right to internet access?

2009-06-12T09:59:25+01:00

Yesterday I went to the CUTEC conference here in Cambridge which provided a forum for encouraging innovation and entrepreneurship. One of the major themes this year was around social responsibility and empowering individuals - big aims for a room of techies and ambitious PhD students.

In particular cloud computing was very much viewed as the way forward and the democratisation of information and accessibility to services - resulting, for example, in the wife of one panelist being able to get real time advice on breast feeding at 4am from other mothers via her iPhone.

In this context I was interested to see that the French courts have refused to uphold a new law allowing officials to cut off the internet connection of persistent online infringers. The Constitutional Court held that only a court could do that - on the basis that access to online services is a human right.

That's the first time I've heard of internet access being referred to as a human right, and I question whether an English court would reach the same view - and clearly on one level it's not in the same league as the rights to life, to freedom of thought and religious beliefs.

But there were many inspirational (as well as aspirational) stories at the CUTEC conference about precisely this issue - that internet and mobile technologies do change lives and communities; that widespread access to and democratisation of services could be the catalyst for social change and improvement in developing nations.

I suspect there's a fundamental tension here between the increasing attempts to regulate the online world (with admitedly varying degrees of success) and the desire to fully exploit its potential and enable people all over the world participate in the online revolution.

One Tough Cookie?

2009-06-04T19:18:26+01:00

When you visit a website, more often than not, a small text file called a "cookie" is sent to your computer. Now, what possible use is a cookie without a glass of milk, this Naked Lawyer asks?

Well, the purpose of a cookie is to store data. For example, if you log onto a website and give details such as your name and e-mail address, the cookie will maintain your log-in details so that you do not have to log back in the next time you visit the site. A shrewd advertising tactic? Yes. An invasion of privacy? Potentially.

Cookies are currently regulated by the 2002 European Communities Directive on Privacy and Electronic Communications. Under the Directive, provided website users are given “clear and comprehensive information” about the purposes of cookies and are given the opportunity to refuse to have cookies stored on their equipment, cookies can be used for activities such as advertising, analysing website effectiveness and identifying online purchasers. Currently website owners comply with this requirement by putting information about cookies in a privacy policy and then adding a link to the policy to every page of their website.

Now proposed amendments to the law on cookies suggests that users may have to give prior consent in order to allow cookies. (This is subject to an exemption if the cookies are “strictly necessary” i.e. they enable a specific service explicitly requested by the user.) At this stage it is completely unclear what prior consent under the new proposals will mean in practical terms. A website owner could perhaps consider the following pop-up message on entry to their site: "click here for a cookie (non chocolate chip variety)". However, a pop-up message is arguably very cumbersome and not least rather off-putting to passing website traffic. This Naked Lawyer awaits the developments...