Digital Rights Ireland

PPS Numbers and “Cradle to Grave” Tracking

Cian Murphy gave an interesting talk on the privacy implications of PPS numbers at the recent IALT Conference:

Since September 2003, the PPS Number has been allocated automatically on the basis of birth … A PPS number is required for revenue purposes in all employment, for welfare receipt, local authority grants and tax relief at source. It is, in effect, almost impossible to function in the State without a PPS number.

[...]

While originally the list of bodies concerned was relatively limited, the spread of use into areas of security and the private sector, albeit to a limited extent, makes it increasingly likely that it is only a matter of time before the Number is universally used.

[...]

The PPSN is clearly well on its way to becoming a national identity number … From birth, a person’s progression through different life events will all be capable of being monitored through the use of a single eight digit number: full ‘cradle to grave’ tracking will be possible.

With his permission, the full paper is now available here .

13 comments April 20th, 2006

Defamation Bill – Will it Meet Internet Users’ Needs?

According to the Irish Times the Cabinet has decided to proceed with a new Defamation Bill. The text of the Bill is yet to be published, but there is concern that (if it follows previous recommendations) it may focus too much on the traditional media while leaving internet publishers out in the cold.

In particular, it’s not clear whether internet publishers will be able to sign up to the proposed Press Council, to benefit from the new defence of reasonable publication, or whether they would be required to establish a code of conduct or fairness procedure to rely on this new defence.

TJ wrote an editorial on this in the November 2005 Commercial Law Practitioner and (with the kind permission of the publishers) the following is an expanded version of that piece.

Defamation Reform: the Impact on Internet Publications

Background

The recent death of Liam Lawlor and the inaccurate and hurtful reports carried by some newspapers about the circumstances of his death have added weight to calls for greater regulation of the Irish press. Reform has been in the offing since the Report of the Legal Advisory Group on Defamation in March 2003, and heads of a Defamation Bill reflecting that Report have now been agreed with the Bill now expected to be published before Christmas.

It is difficult to forecast precisely what that Bill will say, particularly as the Minister for Justice has already indicated his intention to depart from some of the recommendations made by the Legal Advisory Group. However, from the Minister’s most recent comments, it seems likely that the Bill will create a new defence of “reasonable publication” and will provide for statutory recognition of an independent Press Council. This body will draw up a code of standards and a complaints procedure to be administered by an Press Ombudsman. Subscription to the Press Council would be voluntary; however, to avail of the new defence of reasonable publication, a publication would either have to subscribe to the Council or would have to show that it operated “an equivalent fairness regime … [or] an equivalent and publicised code of conduct”.

This proposed reform has already proved controversial. In particular, the proposal to establish a statutory Press Council has split the Irish newspaper industry, with some publishers (notably the Independent Newspapers group, News International and Associated Newspapers) opposed while other interests (such as the Irish Times, the National Union of Journalists and the umbrella group National Newspapers of Ireland) are in favour. However, the debate so far has largely turned on the impact on the print media, with little consideration of the impact which this Bill might have on Internet publishers.

The Press Council

Will membership of the Press Council be available to online-only publishers? There are an increasing number of news services (such as SiliconRepublic.com) which resemble traditional publications except for having a print edition. These publications (as well as other publications such as blogs) may wish to subscribe to the Press Council, particularly where this will help to establish a defence of reasonable publication. Will it be open to them to do so? What criteria will be laid down for a publication to qualify?

Reasonable Publication

The defence of reasonable publication also raises questions. It is not clear from the Minister’s comments when publications which are not members of the Press Council can rely on this defence. In particular, will it be required as a matter of law that they have their own “equivalent code of conduct” to benefit from the defence, or will this merely be one factor which the court can take into account in deciding if a defendant has, in all the circumstances, behaved reasonably? The Legal Advisory Group Report recommended that membership of the Press Council should merely be one factor which could be taken into account, and it would be unfortunate if the Minister went further by making membership, or an equivalent code of conduct, a legal requirement. Such a requirement would place a significant burden on smaller online publishers, and it would make little sense to impose on them a standard designed with large newspapers in mind.

The Single Publication Rule

One reform which will be welcomed by online publishers relates to the time from which limitation periods start to run. As things stand, each individual publication of a libel creates a fresh cause of action. In the case of a web page, this means that each time the page is viewed a fresh tort is committed, so that the limitation period starts afresh. Consequently, online publishers face almost indefinite liability. Suppose that a newspaper prints a story in its print edition in 1997, and on the same day puts that story on its website. In 2003 the Statute of Limitations expires for the print version. However, the newspaper remains at risk of a libel action for the online version of the story indefinitely, as each time it is accessed the six year limitation period begins anew. The new Bill is expected to greatly improve the position of online publishers by introducing a single publication rule, modelled on US law, under which time will begin to run from the date on which the material was first published – which, in the case of online publication, will mean the date on which the material was first made available and not the date on which it was first accessed.

The Hosting Defence – Actual Knowledge and Expeditious Removal

Under the E-Commerce Directive, a defence is available to hosts where:

“(a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or

(b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.”

In practice, though, this defence has caused difficulties. Providers are often nervous as to what degree of knowledge is sufficient to impose liability and if in doubt will err on the side of caution and remove any material which might possibly be defamatory. This is a particular problem when complainants make vague complaints about material hosted by the provider, without specifying the precise material alleged to be defamatory, where the only solution may be to remove all material making reference to the complainant. In addition, providers have often complained that the requirement to expeditiously remove material precludes full examination of the facts of a particular case.

The Legal Advisory Group has recommended that these difficulties should be addressed by providing that a court, in deciding whether or not a provider had actual knowledge, can take into account whether written notice was given, such notice to include the full name and address of the sender of the notice, the location of the information, and details of the defamatory nature of the information. The Group also recommended that the requirement to act expeditiously should be defined so as to allow the provider time to carry out “an investigation as to whether there would be liability in defamation in respect of the matter complained of”. These provisions would, if implemented, significantly improve the position of internet hosts. However, to fully safeguard online speech against baseless threats of legal action it would be desirable to put in place a more detailed “notice and takedown” and “counter notice and put-back” system, along the lines of that established by the US Digital Millennium Copyright Act.

Innocent Publication

Online intermediaries will also be very interested in the proposals for a new defence of “innocent publication”. This would replace the defence of innocent dissemination and would also tie in with the E-Commerce Directive mere conduit, caching and hosting defences. The Legal Advisory Group recommended that this defence should be available to a person who:

(a) is not the author, editor or publisher of the statement;
(b) took reasonable care in relation to its production; and
(c) did not know, nor had reason to believe, that what they did caused or contributed to the publication of a statement for which there would be liability in defamation.

Surprisingly, though, the Legal Advisory Group appears to recommend that this defence should not be available to the “operators of, or providers of access to, a communication system”, who would be left to their E-Commerce Directive defences only (Head 29 of their Draft Bill). The provision in question is ambiguous, but if this is in fact the case, then this recommendation was presumably motivated by a desire to avoid conflict with the Directive. However, if followed it will strip online intermediaries of their existing innocent dissemination defence and may lead to unusual gaps in the law.

For example, suppose that an ISP puts in place a system blocking access to IP addresses said to be associated with child pornography (as British Telecom is doing with its “Cleanfeed” policy). That ISP then transmits material (produced by a third party and hosted elsewhere) which is alleged to be defamatory. The automated filtering would take the ISP outside the “mere conduit” defence, while the ISP would be denied any innocent dissemination or innocent publication defence under the Legal Advisory Group proposals, notwithstanding that it is not in any way responsible for the material. It would be desirable, therefore, for the Bill to explicitly specify whether online intermediaries can rely on the defence of innocent publication in addition to their E-Commerce Directive defences, or whether these are intended to be mutually exclusive.

Conclusion

On balance the Defamation Bill appears likely to be a welcome development for online publishers. However, the devil is in the detail here, particularly when it comes to the effect on the Internet of measures drafted with the traditional media in mind. We await the Minister’s proposals with interest.

8 comments April 13th, 2006

Data Protection Commissioner says data retention must be limited to serious crime

At the launch of the Data Protection Commissioner’s 2005 Annual Report today Mr. Billy Hawkes, the Commissioner, strongly criticised the current Data Protection laws and suggested in his report that the implementation of the European Data Retention Directive into Irish law ought to be used by the government as an opportunity to revisit some of the provisions passed last year.

Specifically, the Data Protection Commissioner suggested that

“it would be helpful if the revised Irish legislation limited the right of Garda access to cases of serious crime and if the safeguards against potential abuse of such access rights were strengthened.”

The significance of this was made clear today when Mr. Hawkes revealed that the call details of hundreds of calls were being accessed by the Gardaí every month.

This is worrying. The data retention legislation was introduced on the basis that it was necessary to deal with serious crime and terrorism and would be used sparingly. Instead, the Data Protection Commissioner’s comments suggest that it’s being used as a matter of course.

In fact, as the law stands Gardaí do not require even to be investigating a specific crime to gain access to call data under these provisions. Access to the call records of everyone in the state is granted on the basis that it may be needed to prevent crime. This is an issue which affects the personal privacy of everyone in the state.

In a press release in response we said:

“Under Irish law, your telephone records are being stored for three years. This includes the location of your mobile phone at all times. The Garda can find out who you rang or where you were up to three years ago without any approval from a judge: all that is required is the signature of a senior garda. The comments of the Data Protection Commissioner about the manner in which this power is being used are worrying. The law must be changed to limit disclosure to serious offences only and to ensure that information is only disclosed where it is genuinely necessary. We must make sure that the phone records of innocent citizens are not revealed indiscriminately.”

7 comments April 11th, 2006

Questionable Phone Tracking Proposal “Premature”

DRI today became aware of a plan to introduce a commercial mobile phone tracking service. Although marketed as being intended for parents to keep track of their children, this was also open to allow any phone user to being tracked by anyone else who had access to their phone for a short period.

The Irish Times report on this service from today can be found here and a Guardian report on some of the potential abuses of this kind of service can be found here. In addition, it is clear that this service is a breach of the spirit and letter of the Data Protection Acts at multiple levels.

That information is being passed by the mobile operators to this service is one breach. There are protections in place precisely to prevent personal private data being sold for third party profit in this way. The failure to provide a method of providing ongoing consent, or a method of withdrawing or withholding consent is another.

It should also be noted that even in the case of the suggested use of this service children have privacy rights, albeit ones circumscribed to varying degrees depending on their age and vulnerability. It may be presumed that children with mobile phones are not infants and will therefore have a reasonable right not to have their data protection rights abused, and their private information sold, without their knowledge or consent.

In response to this story, DRI released the following press release.

FOR IMMEDIATE RELEASE

Digital Rights Ireland today wrote to the Data Protection Commissioner
to express its concern at the introduction of mobile phone tracking
services in Ireland.

‘Mobile phone tracking services have clear potential for abuse and
comprehensive safeguards need to be in place to ensure that the tracked
person has given full, ongoing, informed consent to being tracked’ said
TJ McIntyre of Digital Rights Ireland.

ENDS.

We also, as it says, contacted the Data Protection Commissioner. We heard back from the Data Protection Commissioner’s office this afternoon. Apparently, following our highlighting of the issue, the DPC had been in contact with Top Security, the company identified as planning the introduction of this service. The announcement of this service was described as having been premature.

If we do hear of such a tracking service being launched by either Top Security or any other company, including the mobile operators themselves, it will be particularly interesting to see how it remains within the terms of the Data Protection Acts.

13 comments April 5th, 2006