Category: Data Protection

Council appeals taxi recording Enforcement Notice

In July the Information Commissioner’s Office (ICO) served an Enforcement Notice against Southampton City Council over its requirement that all licensed taxi cars must record both audio and visual from within its vehicles on all journeys.  The Enforcement Notice was issued by the ICO using powers conferred on the Information Commissioner under the Data Protection Act 1998.

The City Council’s policy requires that all taxis and private hire vehicles which it licenses are fitted with audio and visual recording equipment and that this is recording at all times regardless of the purpose for which the vehicle is being used.  For example, a private hire taxi driver will likely use the car to transport their family or friends in the way that most people will use their vehicles (e.g. taking their children to school or extra-curricular activities, going to visit family, going for family day trips etc.)  Even in such situations the Council’s policy mandates that the vehicle is recording visual images and audio.  The private telephone conversations of the driver and his passengers will be recorded as will private conversations between passengers and conversations between the driver and his family.  All the recordings will be stored by the Council.

Such a policy is, to any reasonable person, an extreme interference with a person’s right to a private and family life.  It affords no private space to the driver or their passengers.  The driver is unable to switch the equipment off when using the vehicle for personal use or to afford passengers privacy when making or receiving private telephone calls.

The Information Commissioner’s decision that Southampton City Council should stop the practice seemed to be a sensible one.  Certainly in my view the compulsory recording of both visual images and audio in vehicles regardless of the type of journey being made is a step too far.  It is with regret that the City Council has decided to appeal the decision to the First-Tier Tribunal (Information Rights).

The Council contends that it takes steps to protect privacy by ensuring that the data is encrypted and assuring everyone that the recordings are only looked at when a complaint is made to the City Council or the police.  In support of its policy the City Council cited a number of allegations of sexual assault made against a licensed driver in a licensed vehicle where the allegations could not be taken forward due to a lack of evidence.  The City Council intends to use this evidence as well as other examples where the cameras were in use in support of its appeal.

There is no doubt that the constant video and audio recording of the inside of taxis and private hire vehicles will produced evidence that can cast light on allegations of criminality and also complaints against drivers.  That, it would appear, is not in dispute.  It seems to me that the City Council are entirely missing the point.  The processing of data (which includes the actual recording and not just the storing and/or watching) must be fair.  While the existence of the recordings could be useful in the investigation of a complaint or an alleged criminal offence one must consider the fairness to record even the private journeys of drivers while they are not on duty.  That at least should be considered as an unfair processing of personal data even if you accept the invasion of privacy involved in recording all journeys made while a driver is on duty.

There are some arguments in favour of requiring all journeys regardless of purpose to be recorded.  For example, it would ensure that drivers cannot “forget” to turn the equipment on when they begin driving officially and it ensures that drivers cannot switch the equipment off or delete recordings in order to evade prosecution for an offence.  However, these considerations do not appear to me to be sufficient justification for a blanket policy such as the one instigated by the Council.

The City Council is entitled to appeal the enforcement notice, but I hope that they see sense and abandon the appeal.  In the event that the City Council decide to continue with the appeal I hope that the Tribunal will reject it and uphold the Commissioner’s enforcement notice.  The City Council really has gone too far with this policy.

Enforcement Notice (pdf)
Council takes ICO to Information Rights Tribunal over cameras in taxis (Local Government Lawyer)

South Lanarkshire Council v The Scottish Information Commissioner

This decision of the Court of Session (Extra Division, Inner House) delivered on 27 March 2012 by Lord Marnoch is in relation to an appeal by South Lanarkshire Council (“the Council”) against decision 056/2011 of the Scottish Information Commissioner (“the Commissioner”).  It concerns a request for information made pursuant to the Freedom of Information (Scotland) Act 2002 (“FOISA”) by Mr Mark Irvine relating to the number of individuals employed by the Council placed at specific points in the pay structure.

The full facts of the case are set out within the Commissioner’s decision.  The Council, after initially ruling Mr Irvine’s requests as vexatious, withheld the information sought by Mr Irvine on the grounds that it was personal data and to disclose the information would be a breach of the Data Protection Principles.  This exemption is provided for within Section 38 of FOISA, specifically the Council applied Section 38(1)(b) of FOISA to the information sought by Mr Irvine.  The Commissioner found that the Council had incorrectly applied Section 38(1)(b) of FOISA and he ordered the Council to disclose the information to Mr Irvine.  The Council exercised its right under Section 56 of FOISA and appealed to the Court of Session.

One of the contentions that the Council made to the Court was that the Commissioner had erred in law by failing to identify Mr Irvine’s “legitimate interest” in obtaining the information sought.  There is not normally a requirement under FOISA to consider the interests or reasons behind a request for Information under FOISA.  However, Schedule 1 to the Data Protection Act 1998 (“DPA”) places an obligation upon the “data controller” (in this case the Council) to ensure that the processing of information is fair and lawful.  It goes on to provide that the data should not be processed unless certain conditions are met.  It should be noted that in this case processing the data would be its disclosure under FOISA.  Relevant in this case is paragraph 6(1) of Schedule 2 to the DPA.  It provides that the data can be processed if it is necessary for the purposes of a legitimate interest of the data controller, or any third party to whom the information would be disclosed (in this case Mr Irvine and the world at large).   There is an exception to this and that is where the processing would be “unwarranted…by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.”  The data subjects in this case would be the employees who fall within the information sought by Mr Irvine.

In essence the Council had to, on this occasion (and unusually in FOISA requests), consider what legitimate interest Mr Irvine had to the information sought.  Furthermore the disclosure of the information had to be “necessary” for the pursuance of that legitimate interest.  The Council also contended that the Commissioner had failed to separately consider the necessity of the disclosure to Mr Irvine’s pursuance of any legitimate interest identified.

The Court of Session rejected both of these arguments.  It found that when viewing the Commissioner’s decision as a whole the Commissioner had identified a legitimate interest and the Court agreed with that legitimate interest.  Furthermore the Court also held that “the Commissioner could only have concluded that necessity was made out.”  Disappointingly, the Court of Session did not say one way or the other whether the Commissioner’s approach in deciding this was correct.  They were satisfied that even had the approach, applying a stricter test, advocated by the Council been followed, necessity would have been made out.

The Court of Session refused the appeal by the Council and upheld the decision of the Information Commissioner.  It remains to be seen whether the Council will further appeal to the United Kingdom Supreme Court.  Such an appeal would need to be filled within 42 days of the Court of Session’s decision and with the leave of the Court of Session.

POSTSCRIPT: 15/04/2013 – South Lanarkshire Council has appealed to the United Kingdom Supreme Court.  The case is due to be heard by that court on 8 July 2013.