ICO says UK surveillance bill is a risk to data security and privacy

The IP bill is the government’s attempt to update and extend the surveillance capabilities of the security and intelligence agencies — replacing the long-in-the-tooth patchwork of legislation currently used to authorize intercepts with a clearer legal framework. It is aiming to have a new law passed by the end of this year when emergency surveillance legislation, DRIPA, expires.

Parliament needs to recognize that the various data protection rights afforded to individuals, and be wary of signing off a blank cheque in regards to the security services’ appetite for information — arguing instead there should be a system of ongoing proportionality reviews, once the legislation has passed, to ensure data protection obligations continue to be met.

Asked by the committee what sort of sanctions could be put in place to mitigate the risk of misuse of retained data by “rogue” individuals, such as within police forces or other organizations storing the data, the ICO suggested parliament could enact a more deterrent-based penalty — such as a prison sentence, rather than the fine-only regime afforded by current legislation that pertains to this area.

On encryption, in its written evidence to the committee, the ICO also warns that notices requiring the removal of electronic protection should not be permitted to lead to the removal or weakening of encryption, given the risk to the security of personal data generally.

Apple also raised concerns about the IP bill’s implications for encryption. Five other internet companies — Google, Microsoft, Twitter, Facebook and Yahoo — have also raised concerns about the implications of the proposed legislation on encryption, calling for more clarity in the language used in the bill in their own joint written submission.