Information Commissioner's Office Research Articles

Access to the health records of deceased patients: Why the law is in need of review

A glance at the cases that came before the UK Information Commissioner's Office (ICO) in the period between 2005 and 2008 immediately shows that a consistently high number relate to access to the health records of deceased patients. What accounts for this interesting state of affairs? This paper aims to demonstrate that the law regulating this increasingly important area is a patchwork of case law, statutes and professional guidelines that do not always lend themselves to a congruous and seamless amalgamation. This has in turn resulted in the need for creative interpretation and at times legal gymnastics on the part of the ICO and medical professionals. We argue that in an age where allegations of medical negligence are proliferating (and access to the health records of the deceased could help confirm or dispel suspicions of wrongdoings leading to the death) and where genetic information about a deceased relative could offer valuable support to a living patient's preventative care, diagnosis and treatment plans, the law regulating access to the health records of deceased patients in the UK can no longer afford to be unclear and confusing. There is, therefore, an urgent need for review.

Some socio-technical aspects of intelligent buildings and pervasive computing research

You had to live—did live, from habit that became instinct—in the assumption that every sound you made was overheard, and…every movement scrutinized. (George Orwell, 1984) Recent reports from the European Parliament Technology Assessment unit and the UK Information Commissioner's Office have highlighted the need for debate on how society should balance the convenience that new technology affords with the need to preserve privacy. To date, most of the debate has addressed the more visible aspects of technology and privacy such as surveillance cameras, identity/loyalty cards, internet search engines and radio frequency identification (RFID) tags. In this article we seek to use our experience as computer scientists to advance this debate by considering issues arising from our research related to intelligent buildings and environments, such as the deployment of autonomous intelligent agents. Intelligent buildings and environments are based on the use of numerous ‘invisible’, omnipresent, always-on, communicating computers embedded in everyday artefacts and environments. While most current intelligent building technology is based around automated reactive systems, research is under way that uses technology to gather personal information from people and use this information to deliver personalized services to them. While promising great benefits, this technology, by being invisible and autonomous, raises significant new dangers for individuals and society as a whole. Perhaps the most significant issue is privacy—an individual's right to control the collection and use of personal information. Rather than focusing on the ‘here and now’, this article looks forward to where this research could lead, exploring the issues it might involve. It does this by presenting descriptions of current work, interleaved with a set of short vignettes that are intended to provoke thought so that developers and the population at large might consider the personal and regulatory needs involved. We end this article by offering a conceptual framework for situating multidisciplinary socio-technical research in intelligent buildings.

Data protection: Tougher enforcement and increased power for the Information Commissioner?

Database marketers, more than most, should be aware of their obligations as regards protection of data and the role of the Information Commissioner's Office. The perception of those who hold personal data, so-called ‘data controllers’ under the Data Protection Act, has been affected by headline news in the past year or so. Various committees and independent reviews are investigating the relevant legal provisions in light of recent breaches of data security and in particular HMRC's loss of data, reportedly comprising the banking details of 25 million recipients of child benefit. Here we assess the various calls for changes to the law and what tightening of the rules might mean for database marketers.

Privacy Impact Assessments: International experience as a basis for UK Guidance

In July 2007, the UK Information Commissioner's Office commissioned a team of researchers, coordinated by Loughborough University, to conduct a study into Privacy Impact Assessments (PIAs). This was with a view to developing PIA guidance for the UK. The project resulted in two key deliverables: a study of the use of PIAs in other jurisdictions, identifying lessons to be learnt for the UK; and a handbook that can be used to guide organisations through the PIA process, taking into account the provisions of the UK Data Protection Act (DPA) 1998. This paper draws on the original research undertaken as part of that assignment to provide an overview of the ICO-funded project and the extent to which PIAs can be used in the current UK context. Firstly, the authors consider the findings of the comparative study and how the UK experience can be informed by developments overseas. Secondly, the paper outlines the development of the handbook during the course of the project and the extent to which it has been influenced by the overseas experience and the current UK political context. Thirdly, aspects of the handbook itself are considered and explained. Particular attention is paid to: its format; its key features; and feedback received on an interim version from a focus group of experienced data protection and project management practitioners. Finally, the paper concludes by stating why the study and the handbook provide appropriate tools for guidance in the current UK context, and how they can be developed further.

Don't bin your Data Protection responsibilities

Database marketers being ‘data controllers’ within the meaning of the Data Protection Act ought to be aware of the UK's data protection legislation and may even have had dealings with the UK regulator, the Information Commissioner's Office (ICO). This paper describes some recent enforcement action taken by the ICO, including action taken in relation to unsolicited marketing mailings, and looks in detail at how the approach adopted seeks to ensure compliance.

Stolen Identity: Regulating the Illegal Trade in Personal Data in the ‘Data-Based Society’

In May 2006, the UK Information Commissioner's Office (ICO) presented a report to Parliament entitled What Price Privacy? The report highlighted the extent of the illegal trade in personal data. Arguing that the risk of security breaches had increased largely as a result of the rise of the ‘data-based society’, the ICO called for a change in the legislation to permit jail sentences of up to 2 years. In February 2007, the UK government stated its intention to adopt that recommendation. This paper examines the current UK policy approach to regulating the illegal flow of personal information, and the lead taken by the UK Information Commissioner. Reference is made to the ‘privacy toolbox’, where data protection legislation is combined with measures such as codes of practice and privacy impact assessments (PIAs). Comparisons are made with the work of overseas regulators. In addition, the current regulatory framework regarding section 55 offences is examined, with the author attending an ICO prosecution hearing in December 2006. The paper concludes by arguing that a greater emphasis needs to be placed on the assessment of privacy risks posed, in particular, by the expansion and proposed merger of government databases. Adoption of PIAs could help achieve this.

Data protection legislation in the United Kingdom

This paper is primarily concerned with development of data protection legislation in the United Kingdom from the late 1960s through to the enactment of the 1984 Data Protection Act. Following a series of private members' bills calling for varying degrees of privacy legislation, the UK government commissioned two significant reports in the 1970s. The first, the Younger Report on Privacy (1972), established 10 principles for the handling of personal data that were to influence data protection statutes in Europe. The Lindop Report on Data Protection (1978) examined public- and private-sector computer systems, recommending a flexible legislative environment – with a set of broad principles guiding a data protection authority in its development of codes of practice aimed at various sectors of the economy. The far-reaching nature of those recommendations can now be appreciated in the work of the modern Information Commissioner's Office, 25 years after the publication of the Lindop Report. However, the momentum created by the two studies faded during the period 1979–82. Labour and Conservative governments respectively consulted further and objected to additional bureaucracy involved in creating a data protection authority. During this period of entropy, unpublished memoranda and correspondence demonstrated how former members of the Lindop Committee maintained the pressure on government, ensuring that their work was not forgotten. Eventually, overseas legislation and the need for the UK to maintain its position at the ‘crossroads of the information highway’ ensured that the UK, albeit grudgingly, enacted a Data Protection Act in 1984. By that time, the UK had lost the lead in defining data protection law and policy established by the Reports of Younger and Lindop. In highlighting findings from the Committees and efforts by dedicated individuals in lobbying successive governments in the late 1970s and early 1980s, the authors demonstrate the importance of preserving historical memory.

Implementation of the Right to Know

Victoria Moody of the Information Commissioner's Office considers the regulatory framework of the right to know. It focuses on the public/private interface of information held by public authorities in the outsourcing of their functions.