Dpa Hiding
Cloud Society: Is the Data Protection Act the silver bullet for cover-ups?
The tragic saga of an alleged cover up (LINK: http://www.bbc.co.uk/news/health-22997705 ) at a hospital in Morecambe Bay has brought the Data Protection Act (DPA) into stark focus. That the Act itself was misused in this incident is quite clear, as illustrated by the Information Commissioner’s own statement on the matter. “What appeared to be going on yesterday was a sort of general duck-out,” he remarked.
This is far from being the first time, however. The Act has been used repeatedly to hide information or give institutions a get-out-of-jail-free card, in examples ranging from the complex to the simply ridiculous.
In December 2012 for example, Durham County Council cited the Data Protection Act in court to object to providing the names of residents in a care home, who may have been able to provide witness evidence in an abuse case. The objection was overturned on appeal. (LINK http://www.qualitysolicitors.com/abneygarsden/news/2012/12/abuse-lawyers-win-ground-breaking-case-in-local-authority-cover-up)
Clearly in this case there was a need to balance the privacy considerations of care home residents with the need to ensure a fair trial. Equally however, the local council involved was seen as trying to cover up allegations of abuse by citing the DPA.
Some other examples are, quite simply, laughable. Consider for example how in 2010, the ICO had to explain (LINK: http://www.ico.org.uk/upload/documents/library/data_protection/practical_application/taking_photos.pdf) that it was not illegal for parents to take photos at school sports days, as – quite simply – the law was “unlikely to apply”.
And right back in 2001, the then-Ministry for Fisheries and Food was castigated for not providing data about numbers of livestock slaughtered following the Foot and Mouth disease outbreak. (LINK http://www.telegraph.co.uk/news/uknews/1331279/Maff-hiding-behind-law-to-conceal-true-picture.html)
Outside of government cover-ups, consumers and citizens are faced with repeated examples of DPA misuse when they have to engage with call centres. “Sorry, I can’t tell you that, Data Protection,” goes the mantra. This can lead to absurd interactions around consent, which can be used as a reason to hide a multitude of shortfalls in service.
In a recent, anecdotal but very real example, a person was told by one part of an institution that it could not access records held elsewhere in the institution. The need for a signed consent form wasn’t the issue – more the fact that the question hadn’t even come up for over a year, and now it was being used as a reason why no action had been taken.
It does all beg the question – has anyone actually read the DPA? Or are people – even at the highest levels – simply reading the term “data protection” and applying to it whatever meaning they see fit?
In a nutshell, the DPA refers to data handling and management processes – largely to do with computer systems, though this is not an obligation. The principles are here (LINK http://www.ico.org.uk/for_organisations/data_protection/the_guide/the_principles). The main focus of its 7 principles is:
- Does the organisation actually have a need to store the information?
- Is it only storing the information it needs to do the job?
- If so, is it keeping it safe, accurate and up to date?
Perhaps the greyest area around the Act is Principle 6, that “Personal data shall be processed in accordance with the rights of data subjects under this Act.” It is here that an obligation to assure a person’s privacy can be seen to apply, particularly if holding or processing information might cause the person damage or distress.
It is the ultimate irony however, that more damage and distress seems to have been caused by misuse of the DPA to cover up or withhold information. Quite clearly, we need more than simple ICO opinion on this matter. If the privacy rights of those in powerful positions continue to be seen as more important than the rights of the people they are supposed to be looking after, we are in a sorry state indeed.