An International Survey of Privacy Laws and Practice
This report was written by Privacy International with a grant provided by the Open Society Institute. The primary authors of this report are David Banisar of the Electronic Privacy Information Center and Simon Davies of Privacy International. Additional research was provided by Wayne Madsen, Michael Kassner, Ronnie Breckheimer, and Shauna Van Dongen. Knowledgeable individuals from academia, government, human rights groups and other fields were asked to submit reports and information. Their reports were supplemented with information gathered from Constitutions, laws, international and national government documents, news reports, human rights reports and other sources. A list of contributors is located at Appendix D.
OVERVIEW
Privacy is a fundamental human right recognized in the UN Declaration of Human Rights, the International Convenant on Civil and Political Rights and in many other international and regional treaties. Privacy underpins human dignity and other key values such as freedom of association and freedom of speech. It has become one of the most important human rights issues of the modern age. The publication of this report reflects the growing importance, diversity and complexity of this fundamental right.
This report provides details of the state of privacy in fifty countries from around the world. It outlines the constitutional and legal conditions of privacy protection, and summarizes important issues and events relating to privacy and surveillance.
Nearly every country in the world recognizes a right of privacy explicitly in their Constitution. At a minimum, these provisions include rights of inviolability of the home and secrecy of communications. Most recently-written Constitutions such as South Africa's and Hungary's include specific rights to access and control one's personal information.
In many of the countries where privacy is not explicitly recognized in the Constitution, such as the United States, Ireland and India, the courts have found that right in other provisions. In many countries, international agreements that recognize privacy rights such as the International Covenant on Civil and Political Rights or the European Convention on Human Rights have been adopted into law.
In the early 1970s, countries began adopting broad laws intended to protect individual privacy. Throughout the world, there is a general movement towards the adoption of comprehensive privacy laws that set a framework for protection. Most of these laws are based on the models introduced by the Organization for Economic Cooperation and Development and the Council of Europe.
In 1995, conscious both of the shortcomings of law, and the many differences in the level of protection in each of its States, the European Union passed a Europe-wide directive which will provide citizens with a wider range of protections over abuses of their data.[fn 1] The directive on the "Protection of Individuals with regard to the processing of personal data and on the free movement of such data" sets a benchmark for national law. Each EU State must pass complementary legislation by October 1998.
The Directive also imposes an obligation on member States to ensure that the personal information relating to European citizens is covered by law when it is exported to, and processed in, countries outside Europe. This requirement has resulted in growing pressure outside Europe for the passage of privacy laws. More than forty countries now have data protection or information privacy laws. More are in the process of being enacted.
Reasons for Adopting Comprehensive Laws
There are three major reasons for the movement towards comprehensive privacy and data protection laws. Many countries are adopting these laws for one or more reasons.
- To remedy past injustices. Many countries, especially in Central Europe, South America and South Africa, are adopting laws to remedy privacy violations that occurred under previous authoritarian regimes.
- To promote electronic commerce. Many countries, especially in Asia, but also Canada, have developed or are currently developing laws in an effort to promote electronic commerce. These countries recognize consumers are uneasy with their personal information being sent worldwide. Privacy laws are being introduced as part of a package of laws intended to facilitate electronic commerce by setting up uniform rules.
To ensure laws are consistent with Pan-European laws. Most countries in Central and Eastern Europe are adopting new laws based on the Council of Europe Convention and the European Union Data Protection Directive. Many of these countries hope to join the European Union in the near future. Countries in other regions, such as Canada, are adopting new laws to ensure that trade will not be affected by the requirements of the EU Directive.
Continuing Problems
Even with the adoption of legal and other protections, violations of privacy remain a concern. In many countries, laws have not kept up with the technology, leaving significant gaps in protections. In other countries, law enforcement and intelligence agencies have been given significant exemptions. Finally, in the absence of adequate oversight and enforcement, the mere presence of a law may not provide adequate protection.
There are widespread violations of laws relating to surveillance of communications, even in the most democratic of countries. The U.S. State Department's annual review of human rights violations finds that over 90 countries engage in illegally monitoring the communications of political opponents, human rights workers, journalists and labor organizers. In France, a government commission estimated in 1996 that there were over 100,000 wiretaps conducted by private parties, many on behalf of government agencies. In Japan, police were recently fined 2.5 million yen for illegally wiretapping members of the Communist party.
Police services, even in countries with strong privacy laws, still maintain extensive files on citizens not accused or even suspected of any crime. There are currently investigations in Sweden and Norway, two countries with the longest history of privacy protection for police files.
Companies regularly flaunt the laws, collecting and disseminating personal information. In the United States, even with the long-standing existence of a law on consumer credit information, companies still make extensive use of such information for marketing purposes.
THREATS TO PRIVACY
The increasing sophistication of information technology with its capacity to collect, analyze and disseminate information on individuals has introduced a sense of urgency to the demand for legislation. Furthermore, new developments in medical research and care, telecommunications, advanced transportation systems and financial transfers have dramatically increased the level of information generated by each individual. Computers linked together by high speed networks with advanced processing systems can create comprehensive dossiers on any person without the need for a single central computer system. New technologies developed by the defense industry are spreading into law enforcement, civilian agencies, and private companies.
According to opinion polls, concern over privacy violations is now greater than at any time in recent history. [fn 2] Uniformly, populations throughout the world express fears about encroachment on privacy, prompting an unprecedented number of nations to pass laws which specifically protect the privacy of their citizens. Human rights groups are concerned that much of this technology is being exported to developing countries which lack adequate protections. Currently, there are few barriers to the trade in surveillance technologies.
It is now common wisdom that the power, capacity and speed of information technology is accelerating rapidly. The extent of privacy invasion -- or certainly the potential to invade privacy -- increases correspondingly.
Beyond these obvious aspects of capacity and cost, there are a number of important trends that contribute to privacy invasion :
GLOBALISATION removes geographical limitations to the flow of data. The development of the Internet is perhaps the best known example of a global technology.
CONVERGENCE is leading to the elimination of technological barriers between systems. Modern information systems are increasingly interoperable with other systems, and can mutually exchange and process different forms of data.
MULTI-MEDIA fuses many forms of transmission and expression of data and images so that information gathered in a certain form can be easily translated into other forms.
Technology transfer and policy convergence
The macro-trends outlined above have had particular effect on surveillance in developing nations. In the field of information and communications technology, the speed of policy convergence is compressed. Across the surveillance spectrum -- wiretapping, personal ID systems, data mining, censorship or encryption controls -- it is the West which invariably sets a proscriptive pace.[fn 3]
Governments of developing nations rely on first world countries to supply them with technologies of surveillance such as digital wiretapping equipment, deciphering equipment, scanners, bugs, tracking equipment and computer intercept systems. The transfer of surveillance technology from first to third world is now a lucrative sideline for the arms industry. [fn 4]
According to a 1997 report "Assessing the Technologies of Political Control" commissioned by the European Parliament's Civil Liberties Committee and undertaken by the European Commission's Science and Technology Options Assessment office (STOA), [fn 5] much of this technology is used to track the activities of dissidents, human rights activists, journalists, student leaders, minorities, trade union leaders, and political opponents. The report concludes that such technologies (which it describes as "new surveillance technology") can exert a powerful 'chill effect' on those who "might wish to take a dissenting view and few will risk exercising their right to democratic protest". Large scale ID systems are also useful for monitoring larger sectors of the population. As Privacy International observed, "In the absence of meaningful legal or constitutional protections, such technology is inimical to democratic reform. It can certainly prove fatal to anyone 'of interest' to a regime."
Government and citizen alike may benefit from the plethora of IT schemes being implemented by the private and public sectors. New "smart card" projects in which client information is placed on a chip in a card may streamline complex transactions. The Internet will revolutionize access to basic information on government services. Encryption can provide security and privacy for all parties.
However, these initiatives will require a bold, forward looking legislative framework. Whether governments can deliver this framework will depend on their willingness to listen to the pulse of the emerging global digital economy and to recognize the need for strong protection of privacy.
DEFINING PRIVACY
Of all the human rights in the international catalogue, privacy is perhaps the most difficult to define and circumscribe. [fn 6] Privacy has roots deep in history. The Bible has numerous references to privacy. [fn 7] There was also substantive protection of privacy in early Hebrew culture, Classical Greece and ancient China. [fn 8] These protections mostly focused on the right to solitude. Definitions of privacy vary widely according to context and environment. In many countries, the concept has been fused with Data Protection, which interprets privacy in terms of management of personal information. Outside this rather strict context, privacy protection is frequently seen as a way of drawing the line at how far society can intrude into a person's affairs. [fn 9] It can be divided into the following facets :
- Information Privacy, which involves the establishment of rules governing the collection and handling of personal data such as credit information and medical records;
- Bodily privacy, which concerns the protection of people's physical selves against invasive procedures such as drug testing and cavity searches;
- Privacy of communications, which covers the security and privacy of mail, telephones, email and other forms of communication; and
- Territorial privacy, which concerns the setting of limits on intrusion into the domestic and other environments such as the workplace or public space.
The lack of a single definition should not imply that the issue lacks importance. As one writer observed, "in one sense, all human rights are aspects of the right to privacy." [fn 10]
Some viewpoints on privacy:
In the 1890s, future U.S. Supreme Court Justice Louis Brandeis articulated a concept of privacy that urged that it was the individual's "right to be left alone." Brandeis argued that privacy was the most cherished of freedoms in a democracy, and he was concerned that it should be reflected in the Constitution. [fn 11]
The Preamble to the Australian Privacy Charter provides that, "A free and democratic society requires respect for the autonomy of individuals, and limits on the power of both state and private organizations to intrude on that autonomy . . Privacy is a key value which underpins human dignity and other key values such as freedom of association and freedom of speech. . Privacy is a basic human right and the reasonable expectation of every person." [fn 12]
Alan Westin, author of the seminal 1967 work "Privacy and Freedom," defined privacy as the desire of people to choose freely under what circumstances and to what extent they will expose themselves, their attitude and their behavior to others. [fn 13]
According to Edward Bloustein, privacy is an interest of the human personality. It protects the inviolate personality, the individual's independence, dignity and integrity. [fn 14]
According to Ruth Gavison, there are three elements in privacy: secrecy, anonymity and solitude. It is a state which can be lost, whether through the choice of the person in that state or through the action of another person. [fn 15]
The Calcutt Committee in the UK said that, "nowhere have we found a wholly satisfactory statutory definition of privacy." But the committee was satisfied that it would be possible to define it legally and adopted this definition in its first report on privacy:
The right of the individual to be protected against intrusion into his personal life or affairs, or those of his family, by direct physical means or by publication of information.[fn 16 ]
THE RIGHT TO PRIVACY
Privacy can be defined as a fundamental (though not an absolute) human right. The law of privacy can be traced as far back as 1361, when the Justices of the Peace Act in England provided for the arrest of peeping toms and eavesdroppers. [fn 17] In 1765, British Lord Camden, striking down a warrant to enter a house and seize papers wrote, "We can safely say there is no law in this country to justify the defendants in what they have done; if there was, it would destroy all the comforts of society, for papers are often the dearest property any man can have." [fn 18] Parliamentarian William Pitt wrote, "The poorest man may in his cottage bid defiance to all the force of the Crown. It may be frail; its roof may shake; the wind may blow though it; the storms may enter; the rain may enter -- but the King of England cannot enter; all his forces dare not cross the threshold of the ruined tenement."
Various countries developed specific protections for privacy in the centuries that followed. In 1776, the Swedish Parliament enacted the "Access to Public Records Act" which required that all government-held information be used for legitimate purposes. In 1792, the Declaration of the Rights of Man and the Citizen declared that private property is inviolable and sacred. France prohibited the publication of private facts and set stiff fines in 1858. [fn 19] In 1890, American lawyers Samuel Warren and Louis Brandeis wrote a seminal piece on the right to privacy as a tort action describing privacy as "the right to be left alone."[fn 20]
The modern privacy benchmark at an international level can be found in the 1948 Universal Declaration of Human Rights, which specifically protected territorial and communications privacy. Article 12 states:
No-one should be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks on his honour or reputation. Everyone has the right to the protection of the law against such interferences or attacks. [fn 21]
Numerous international human rights covenants give specific reference to privacy as a right. The International Covenant on Civil and Political Rights (ICCPR), the UN Convention on Migrant Workers [fn 22] and the UN Convention on Protection of the Child [fn 23] adopt the same language. [fn 24]
On the regional level, these rights are becoming enforceable. The 1950 Convention for the Protection of Human Rights and Fundamental Freedoms, [fn 25] Article 8 states:
(1) Everyone has the right to respect for his private and family life, his home and his correspondence. (2) There shall be no interference by a public authority with the exercise of this right except as in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health of morals, or for the protection of the rights and freedoms of others.
The Convention created the European Commission of Human Rights and the European Court of Human Rights to oversee enforcement. Both have been particularly active in the enforcement of privacy rights and have consistently viewed Article's protections expansively and the restrictions narrowly.[fn 26] The Commission found in its first decision on privacy:
For numerous Anglo-Saxon and French authors, the right to respect "private life" is the right to privacy, the right to live, as far as one wishes, protected from publicity . . In the opinion of the Commission, however, the right to respect for private life does not end there. It comprises also, to a certain degree, the right to establish and develop relationships with other human beings, especially in the emotional field for the development and fulfillment of oneís own personality.[fn 27]
The Court has reviewed member statesí laws and imposed sanctions on several countries for failing to regulate wiretapping by governments and private individuals. [fn 28] It has also reviewed cases of individuals access to their personal information in government files to ensure that adequate procedures were implemented. [fn 29] It has expanded the protections of Article 8 beyond government actions to those of private persons where it appears that the government should have prohibited those actions. [fn 30] Presumably, under these combined analyses, the court could order the imposition of data protection laws if data was improperly processed to the detriment of the data subject. [fn 31]
Article 11 of the American Convention on Human Rights sets out the right to privacy in terms similar to the Universal Declaration. [fn 32] In 1965, the Organization for American States proclaimed the American Declaration of the Rights and Duties of Man, which called for the protection of numerous human rights including privacy. [fn 33] The Inter-American Court of Human Rights has also begun to addresses privacy issues in its cases.
The Evolution of Data Protection
Interest in the right of privacy increased in the 1960s and 1970s with the advent of information technology (IT). The surveillance potential of powerful computer systems prompted demands for specific rules governing the collection and handling of personal information. In many countries, new constitutions reflect this right. The genesis of modern legislation in this area can be traced to the first data protection law in the world enacted in the Land of Hesse in Germany in 1970 This was followed by national laws in Sweden (1973), the United States (1974), Germany (1977) and France (1978). [fn 34]
Two crucial international instruments evolved from these laws. The Council of Europe's 1981 Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data [fn 35] and the Organization for Economic Cooperation and Development's Guidelines Governing the Protection of Privacy and Transborder Data Flows of Personal Data [fn 36] articulate specific rules covering the handling of electronic data. The rules within these two documents form the core of the Data Protection laws of dozens of countries. These rules describe personal information as data which are afforded protection at every step from collection through to storage and dissemination. The right of people to access and amend their data is a primary component of these rules.
The expression of data protection in various declarations and laws varies only by degrees. All require that personal information must be:
- obtained fairly and lawfully;
- used only for the original specified purpose;
- adequate, relevant and not excessive to purpose;
- accurate and up to date; and
- destroyed after its purpose is completed.
These two agreements have had a profound effect on the adoption of laws around the world. Over twenty countries have adopted the COE convention and another six have signed it but have not yet adopted it into law. The OECD guidelines have also been widely used in national legislation, even outside the OECD countries.
The European Telecommunications Directive and the European Data Protection Directive
In the past three years, the European Union has enacted two directives which will provide citizens with a wider range of protections over abuses of their data. The Directives set a baseline common level of privacy which not only reinforces current data protection law, but which extends it to establish a range of new rights. The Data Protection Directive sets a benchmark for national law which will harmonize law throughout the European Union. [fn 37] Each EU State must pass complementary legislation by October 1998, though it is more likely that not all will have completed the process until the early part of 1999. The Telecommunications Directive [fn 38] establishes specific protections covering telephone, digital television, mobile networks and other telecommunications systems.
Several principles of data protection are strengthened under the Directives, namely the right to know where the data originated, the right to have inaccurate data rectified, a right of recourse in the event of unlawful processing and the right to withhold permission to use data in some circumstances. For example, individuals will have the right to opt-out free of charge from being sent direct marketing material, without providing any specific reason. The Data Protection Directive contains strengthened protections over the use of sensitive personal data relating, for example, to health or finances. In the future, the commercial and government use of such information will generally require "explicit and unambiguous" consent of the data subject.
The key concept in the European model is "enforceability." The European Union is concerned that data subjects have rights that are enshrined in explicit rules, and that they can go to a person or an authority that can act on their behalf. Every EU country will have a Privacy Commissioner or agency that enforces the rules. It is expected that the countries with which Europe does business will have to have a similar level of oversight.
The Directive imposes an obligation on member States to ensure that the personal information relating to European citizens is covered by law when it is exported to, and processed in, countries outside Europe. [fn 39] This requirement has resulted in growing pressure outside Europe for the passage of privacy laws. Those countries which refuse to adopt meaningful privacy law may find themselves unable to conduct certain types of information flows with Europe, particularly if they involve sensitive data.
The Telecommunications Directive imposes wide scale obligations on carriers and service providers to ensure the privacy of users' communications. The new rules will cover areas which until now have fallen between the cracks of data protection laws. Access to billing data will be severely restricted, as will marketing activity. Caller ID technology must incorporate an option for per-line blocking of number transmission. Information collected in the delivery of a communication must be destroyed once the call is completed.
Models of privacy protection
There are currently several major models for privacy protections. In some countries, several models are used simultaneously.
The regulatory model adopted by Europe, Australia, Hong Kong, New Zealand, Central and Eastern Europe and Canada is that of a public official who enforces a comprehensive data protection law. This official, known variously as a Commissioner, Ombudsman or Registrar, monitors compliance with the law and conducts investigations into alleged breaches. In some cases the official can find against an offender. The official is also responsible for public education and international liaison in data protection and data transfer. This is the preferred model for most countries adopting data protection law. It is also the model favored by Europe to ensure compliance with its new data protection regime. However, the powers of the commissions vary greatly and many report a serious lack of resources to adequately enforce the laws.
Some countries such as the United States have avoided general data protection rules in favor of specific sectoral laws governing, for example, video rental records and financial privacy. In such cases, enforcement is achieved through a range of mechanisms. The problem with this approach is that it requires that new legislation be introduced with each new technologies so protections frequently lag behind. The lack of legal protections for genetic information in the U.S. is a striking example of its limitations. In other countries, sectoral laws are used to compliment comprehensive legislation by providing more detailed protections for certain categories of information, such as police files or consumer credit records.
Data protection can also be achieved - at least in theory - through various forms of self regulation, in which companies and industry bodies establish codes of practice. However, the record of these efforts has been disappointing, with little or no evidence that the aims of the codes are regularly fulfilled. Adequacy and enforcement are the major problem with these approaches. Industry codes in many countries have tended to provide only weak protections and lack enforcement. This is currently the policy promoted by the governments of United States, Singapore and Australia.
With the recent development of commercially available technology-based systems, privacy protection has also moved into the hands of individual users. Users of the Internet can employ a range of programs and systems which will ensure varying degrees of privacy and security of communications. Questions remain about security and trustworthiness of these systems. Recently, the European Commission evaluated some of the technologies and stated that the tools would not replace a legal framework.[fn 40]
THE TECHNOLOGIES OF PRIVACY INVASION
The report found a number of technologies were causing new concerns about the protection of privacy. Many of these technologies were being adopted and implemented outside legal protections.
Identity systems
Identity (ID) cards
Identity (ID) cards are in use in one form or another in virtually all countries of the world. The type of card, its function, and its integrity vary enormously. While a majority of countries have official, compulsory, national IDís that are used for a variety of purposes, many developed countries do not have such a card. Amongst these are the United States, Canada, New Zealand, Australia, the United Kingdom, Ireland, and the Nordic countries. Those that do have such a card include Germany, France, Belgium, Greece, Luxembourg, Portugal and Spain.
ID cards are established for a variety of reasons. Race, politics and religion were often at the heart of older ID systems. The threat of insurgents, religious discrimination or political extremism have been all too common as motivation for the establishment of ID systems which would force enemies of the State into registration, or make them vulnerable in the open without proper documents. In Pakistan, the cards are used to enforce a quota system.
In recent years, ID cards have been linked to national registration systems, which in turn form the basis of government administration. In such systems - for example Spain, Portugal, Thailand and Singapore - the ID card becomes merely one visible component of a much larger system. With the advent of magnetic stripes and microprocessor technology, these cards can also become an interface for receipt of government services. Thus the cards become a fusion of a service technology, and a means of identification. At the heart of such plans is a parallel increase in police powers. Even in democratic nations, police retain the right to demand ID on pain of detention.
In a number of countries, these systems have been successfully challenged on constitutional privacy grounds. In 1998, the Philippine Supreme Court ruled that a national ID system violated the constitutional right to privacy. In 1991, the Hungarian Constitutional Court ruled that a law creating a multi-use personal identification number violated the constitutional right of privacy. [fn 41]
Biometrics
Biometrics is the process of collecting, processing and storing details of a personís physical characteristics for the purpose of identification and authentication. The most popular forms of biometric ID are retina scans, hand geometry, thumb scans, finger prints, voice recognition, and digitized (electronically stored) photographs. The technology has gained the interest of governments and companies because unlike other forms of ID such as cards or papers, it has the capacity to accurately and intimately identify the target subject.
Biometrics schemes are being implemented across the world. Spain has commenced a national fingerprint system for unemployment benefit and healthcare entitlement. Russia has announced plans for a national electronic fingerprint system for banks. Jamaicans are required to scan their thumbs into a database before qualifying to vote at elections. In France and Germany, tests are under way with equipment that puts fingerprint information onto credit cards. The technology is being used in retail outlets, government agencies, child care centers, police forces and automated-teller machines.
An automated immigration system developed by the U.S. Immigration and Naturalization Service (INS) uses hand geometry. In this project, frequent travelers have their hand geometry stored in a "smart" computer chip card. The traveler places a hand onto a scanner, and places the card into a slot. More than 70,000 people have enrolled in the trial. The scheme may ultimately result in a worldwide identification system for travelers.
The most controversial form of biometrics -- DNA identification -- is benefiting from new scanning technology which can automatically match DNA samples against a large database in minutes. Police forces in several countries such as the United States, Germany and Canada are creating national databases of DNA. In the United Kingdom and the U.S., police have been demanding that all individuals in a particular area voluntarily provide samples or face being placed under scrutiny as a suspect.
Surveillance of Communications
Nearly all countries have established some form of wiretapping capability over telephone, fax and telex communications. In most cases, these intercepts are initiated and authorized by law enforcement agencies. Wiretapping abuses have been detected in most countries, sometimes occurring on a vast scale involving thousands of illegal taps. The abuses invariably affect anyone "of interest" to a government. Targets include political opponents, student leaders and human rights workers. [fn 42]
Law enforcement agencies have traditionally worked closely with telecommunications companies to formulate arrangements that would make phone systems "wiretap friendly." Such arrangements range from allowing police physical access to telephone exchanges, to installing equipment to automate the interception.
The U.S. has led a worldwide effort to limit individual privacy and enhance the capability of its police and intelligence services to eavesdrop on personal conversations. The campaign has had two legal strategies. The first made it mandatory for all digital telephone switches, cellular and satellite phones and all developing communication technologies to build in surveillance capabilities; the second sought to limit the dissemination of software that provides encryption, a technique which allows people to scramble their communications and files to prevent others from reading them. [fn 43]
At the same time, the United States has taken a lead in promoting greater use of electronic surveillance and the weakening of bank secrecy laws. FBI Director Louis Freeh has traveled extensively around the world, promoting the use of wiretapping in newly free countries such as Hungary and the Czech Republic.
Internet and email interception
Over the past decade the Internet has become an important tool for communication and research. The technology is growing at an exponential rate, with millions of new users going on line each year. The Internet is also used increasingly as a tool for commercial transactions. The capacity, capability, speed and reliability of the Internet is constantly improving, resulting in the constant development of new uses for the medium.
But this fluid structure has not protected the Internet from interception and control by authorities. Because the medium is new, it often lacks the protections found in conventional telephone systems. Law enforcement and national security agencies throughout the world have moved swiftly to establish default capabilities to intercept and analyze email and Internet traffic. Law enforcement agencies in the United Kingdom have argued that interception of email traffic should be permissible through agreements between police and Internet Service Providers (ISPs), the conduits for Internet traffic. The move has caused alarm, with rights groups demanding that email interception should not be treated differently than telephone interception. In Singapore, all ISPs are operated by government-controlled or related organizations and reportedly provide information on a regular basis to government agencies. In Russia, a proposal that all ISPs place a black box and high speed link connected to the Federal Security Service is currently being debated.
"Anonymous remailers," which strip identifying information from emails, can stop traffic analysis. They are the Internet equivalent of PO Box addresses. They have also generated opposition from police and intelligence services. In Finland, a popular anonymous remailer had to be shut down due to legal challenges that forced the operator to reveal the name of one of the users.
Encryption has become the most important tool for protection against surveillance. A message is scrambled so that only the intended recipient will be able to unscramble, and subsequently read, the contents. Pretty Good Privacy (PGP) is the best-known encryption program and has over 100,000 users, including human rights groups such as Amnesty International.
The recording of information about specific Internet activities has become one of the biggest emerging threats to Internet privacy. Every time a user accesses a web page, the server holding the page logs the user's Internet address along with the time and date. Some sites place "cookies" on a users machine to help track people's activities at a much more detailed level. Others ask for the users name, address and other personal details before allowing access. Internet purchases are similarly recorded. On-line stores value such data very highly, not least for the potential to sell the data on to marketers and other organizations.
Some technical solutions have been devised to counter such activities. "Anonymising" software allows users to browse the Web without revealing their Internet address. "Cookie cutter" programs stop sites from putting cookies on a users machine, and are now built into most browsers. Anonymous digital cash lets consumers make payments without revealing their identity.
National Security and the ECHELON system
Immediately following the Second World War, in 1947, the governments of the United States, the United Kingdom, Canada, Australia and New Zealand signed a National Security pact known as the "Quadripartite," or "United Kingdom - United States" (UKUSA) agreement. Its intention was to seal an intelligence bond in which a common National Security objective was created. Under the terms of the agreement, the five nations carved up the earth into five spheres of influence, and each country was assigned particular targets. The UKUSA Agreement standardized terminology, code words, intercept handling procedures, arrangements for cooperation, sharing of information, and access to facilities. One important component of the agreement was the exchange of data and personnel. The link means that operatives from the New Zealand signals intelligence agency GCSD could work from the Canberra facilities of Australiaís Defense Signals Directorate to intercept local communications, and pass on the contents to the Australian intelligence agencies without either nation having to formally approve or disclose the interception.[fn 44]
The strongest alliance within the UKUSA relationship is the one between the U.S. National Security Agency (NSA) and Britain's Government Communications Headquarters (GCHQ). The most important facility in the alliance is Menwith Hill, in the north of England. With two dozen radomes and a vast computer operations facility, the base has the capacity to eavesdrop on vast chunks of the communications spectrum. With the creation of Intelsat and digital telecommunications, Menwith and other stations developed the capability to eavesdrop on an extensive scale on fax, telex and voice messages. It is widely believed that Menwith Hill has around 40,000 lines connected to it, through which access could be gained to much of European and Soviet communications.
A report published in late 1997 by the European Parliament has confirmed that "Project Echelon" gives the NSA the ability to search nearly all data communications for "key words." Messages are not currently analyzed for overall content, nor is the scanning done in real time, but daily reports provide "precursor" data which assists intelligence agencies determine targets. Automatic scanning of voice communications may not be far behind. A voice recognition system called "Oratory" has been used for some years to intercept and analyze diplomatic phone calls. [fn 45] The report -- "Assessing the Technologies of Political Control" -- states, "Within Europe all email telephone and fax communications are routinely intercepted by the United States National Security Agency transferring all target information from the European mainland via the strategic hub of London then by satellite to Fort Meade in Maryland via the crucial hub at Menwith Hill in the North York moors in the UK." The report sparked a wave of concern in Europe which led on September 14, 1998, to a debate in the European Parliament. A "compromise resolution" framed that day by the four major parties called for greater accountability and "protective measures" over the activities of security agencies.
Video Surveillance
In recent years, the use of video surveillance cameras (also called Closed Circuit Television, or CCTV) throughout the world has grown to unprecedented levels. In the UK alone, between 150 and 300 million pounds per year is now spent on a surveillance industry involving an estimated 200,000 cameras monitoring public spaces. [fn 46] Most towns and cities are moving to CCTV surveillance of public areas, housing estates, car parks and public facilities. Growth in the market is estimated at fifteen to twenty per cent annually. Many Central Business Districts in Britain are now covered by surveillance camera systems involving a linked system of cameras with full pan, tilt, zoom and infrared capacity. Their use on private property is also becoming popular. [fn 47]
These systems involve sophisticated technology. Features include night vision, computer assisted operation, and motion detection facilities which allow the operator to instruct the system to go on red alert when anything moves in view of the cameras. Camera systems increasingly employ bullet-proof casing, and automated self defense mechanisms. The clarity of the pictures is usually excellent, with many systems being able to read a cigarette packet at a hundred meters. The systems can often work in pitch blackness, bringing images up to daylight level. The technology will ultimately converge with sophisticated software programs that are capable of automated recognition of faces, crowd behavior analysis, and (in certain environments) intimate scanning of the area between skin surface and clothes. The power and capabilities of cameras will continually increase, while the cost and size will decrease. It is reasonable to assume that covert visual surveillance will in some environments be ubiquitous.
The CCTV trend is not confined to Britain. Sweden -- once strongly opposed to such surveillance -- is considering relaxing its privacy laws to permit public surveillance, while CCTV activity in Norway has prompted specific inclusion of such surveillance in the data protection act. Meanwhile, CCTV activity has grown markedly in North America and Australia to monitor public squares. In Singapore, they are widely employed for traffic enforcement and to prevent littering.
Some observers believe this phenomenon is dramatically changing the nature of cities. The technology has been described as the "fifth utility." CCTV is being integrated into the urban environment in much the same way as the electricity supply and the telephone network in the first half of the century. CCTV is profoundly changing the nature of the urban environment, and is now an important part of the core management of cities. Visual surveillance is becoming a fixed component in the design of modern urban centers, new housing areas, public buildings and even the road system. CCTV images may in the future be viewed as just one more type of necessary data, and considered a "value added" product.
Workplace surveillance
Employees in nearly every country are vulnerable to comprehensive surveillance by managers. Legal protections are generally more lax in such circumstances because surveillance is frequently imposed as a condition of employment. In many countries employers can tap phones, read email and monitor computer screens. They can bug conversations, analyze computer and keyboard work, peer through CCTV cameras, use tracking technology to monitor personal movements, analyze urine to detect drug use, and demand the disclosure of intimate personal data.
The technology being used to monitor workers is extremely powerful. It can analyze "keystrokes" on a terminal to determine whether employees are making efficient use of their time between telephone conversations. Software companies call this process "performance monitoring." Even in workplaces staffed by highly skilled information technology specialists, bosses demand the right to spy on every detail of a workers performance. Modern networked systems can interrogate computers to determine which software in being run, how often, and in what manner. A comprehensive audit trail gives managers a profile of each user, and a panorama of how the workers are interacting with their machines. The software also gives managers total central control over the software on each individual PC. A manager can now remotely modify or suspend programs on any machine.
The technology being used extends to every aspect of a worker's life. Miniature cameras monitor behavior. "Smart" ID badges track an employee's movement around a building. Telephone Management Systems (TMS) analyze the pattern of telephone use and the destination of calls. Psychological tests, general intelligence tests, aptitude tests, performance tests, vocational interest tests, personality tests and honesty tests are all electronically assessed. Surveillance and monitoring have become design components of modern information systems.
While companies assert that all surveillance is justified, it is clear that not all uses of monitoring are legitimate. Following some organizing activity by a local union, one U.S. employer installed video cameras to monitor each individual workstation and worker. Although management claimed that the technology was being established solely for safety monitoring, two employees were suspended for leaving their workstations to visit the toilet without permission. According to a 1993 report of the International Labour Office, the activities of union representatives on the floor was also inhibited by a "chilling effect" on workers who knew their conversations were being monitored.
A spate of well publicized cases of similar abuses of visual surveillance has prompted concern in the workplace. A 1991 survey of employees throughout the U.S. revealed that 62 per cent disagreed with the use of video surveillance (including 38 per cent who "strongly disagreed"). Nevertheless, a recent report by the American Management Association revealed that two thirds of American bosses spy on their workers, often through email and phone interception. [fn 48]
In a report entitled Job Stress: The 20th Century Disease, the ILO "points to growing evidence of problems around the world, including developing countries, where . . companies are doing little to help employees cope with the strain of modern industrialization." The report also says that "[a]s the use of computers spreads throughout the world, workers in many countries are being subjected to new pressures, including electronic eavesdropping by superiors. . ." A 1990 survey of telecommunications workers sponsored in part by the Communications Workers of America revealed that 84 percent of monitored employees complained about high tension as opposed to 67 percent of unmonitored workers. A later study by the U.S. Office of Technology Assessment also found that workplace monitoring "contributes to stress and stress-related illness." [fn 49]
In Britain and the United States, there are few legal constraints on video surveillance, unlike the laws of Austria, Germany, Norway and Sweden, under which employers are obliged to seek agreement with workers on such matters.
This situation has been challenged in the European Court of Human Rights. Former British Assistant Chief Constable Allison Halford had complained that following her sex discrimination complaint against the police, her office phone had been bugged. While the British government asserted that this was an entirely lawful and proper activity, Halford maintained that it breached the right of privacy contained in the European Convention on Human Rights. The court agreed, and ruled that the police had acted improperly in bugging Ms Halford's phone. [fn 50]
The practice is likely to breach laws which form in the wake of the European Telecommunications Directive. Currently, however, the court's decision appears to do little more than oblige bosses to notify workers that they should have no expectation of privacy on the phone. And accordingly, most businesses are moving to routine monitoring of phone calls.
_________________
Footnotes
1. Directive 95/ /EC of the European Parliament and of the Council of On the Protection of Individuals with regard to the processing of personal data and on the free movement of such data.
2. Simon Davies "Re-engineering the right to privacy : how privacy has been transformed from a right to a commodity", in Agre and Rotenberg (ed) "Technology and Privacy : the new landscape", MIT Press, 1997 p.143.
3. Simon Davies and Ian Hosein, "Liberty on the Line" in Liberating Cyberspace, Pluto Press, London, 1998.
4. Big Brother Incorporated, Privacy International site: <http://www.privacy.org/pi/reports/>.
5. Published by Science and Technology Options Assessment (STOA). Ref : project no. IV/STOA/RSCH/LP/politicon.1
6. James Michael, Privacy and Human Rights, UNESCO 1994 p.1.
7. Richard Hixson, Privacy in a Public Society: Human Rights in Conflict 3 (1987). See Barrington Moore, Privacy: Studies in Social and Cultural History (1984).
9. Simon Davies "Big Brother : Britain's web of surveillance and the new technological order", Pan, London, 1996 p. 23
10. Volio, Fernando. "Legal personality, privacy and the family" in Henkin (ed) The International Bill of Rights, New York : Columbia University Press, 1981.
11. Samuel Warren and Louis Brandeis, "The right to privacy", Harvard Law Review 4, 1890 pp 193 - 220.
12. "The Australian Privacy Charter", published by the Australian Privacy Charter Group, Law School, University of New South Wales, Sydney 1994.
13. Alan F Westin, Privacy and Freedom, Atheneum, New York p. 7.
14. Privacy as an Aspect of Human Dignity, [1964] 39 New York U. L.R. 962 at 971.
15. 9 Privacy and the Limits of Law, [1980] 89 Yale L.J. 421, at 428.
16. Report of the Committee on Privacy and Related Matters, Chairman David Calcutt QC, 1990, Cmnd. 1102, London: HMSO, page 7.
18. Entick v. Carrington, 1558-1774 All E.R. Rep. 45.
19. The Rachel affaire. Judgment of June 16, 1858, Trib. pr. inst. de la Seine, 1858 D.P. III 62. See Jeanne M. Hauch, Protecting Private Facts in France: The Warren & Brandeis Tort is Alive and Well and Flourishing in Paris, 68 Tul. L. Rev. 1219 (May 1994 ).
20. Warren and Brandeis, The Right to Privacy, 4 Harvard L.R. 193 (1890).
21. Universal Declaration of Human Rights, <http://www.hrweb.org/legal/udhr.html>
22. A/RES/45/158 25 February 1991, Article 14.
23. UNGA Doc A/RES/44/25 (12 December 1989) with Annex, Article 16.
24. International Covenant on Civil and Political Rights, <http://www.hrweb.org/legal/cpr.html>
25. .Convention for the Protection of Human Rights and Fundamental Freedoms Rome, 4.XI.1950. <http://www.coe.fr/eng/legaltxt/5e.htm>.
26. Nadine Strossen, Recent US and Intl. Judicial Protection of Indvidual Rights: A comparative Legal Process Analysis and Proposed Synthesis, 41 Hastings L.J. 805 (1990).
27. X v. Iceland, 5 Eur. Commín H.R. 86.87(1976).
28. European Court of Human Rights, Case of Klass and Others: Judgement of 6 September 1978, Series A No. 28 (1979). Malone v. Commissioner of Police, 2 All E.R. 620 (1979). See Note, Secret Surveillance and the European Convention on Human Rights, 33 Stanford Law Review 1113, 1122 (1981).
29. Judgement of 26 March 1987 (Leander Case ).
31. Rolv Ryssdal, Data Protection and the European Convention on Human Rights in Council of Europe Data protection, human rights and democratic values, XIII Conference of the Data Commissioners 2-4 October 1991 41-43. (1992).
32. Signed Nov. 22, 1969, entered into force July 18, 1978, O.A.S. Treaty Series No. 36, at 1, O.A.S. Off. Rec. OEA/Ser. L/V/II.23 dec rev. 2.
33. O.A.S. Res XXX, adopted by the Ninth Conference of American States, 1948 OEA/Ser/. L./V/I.4 Rev (1965).
34. An excellent analysis of these laws is found in David Flaherty, "Protecting Privacy in surveillance societies", University of North Carolina Press, 1989.
35. Convention fn the Protection of Individuals with regard to the Automatic Processing of Personal Data Convention , ETS No. 108, Stasbourg, 1981. <http://www.coe.fr/eng/legaltxt/108e.htm>.
36. OECD, Guidelines governing the Protection of Privacy and Transborder Data Flows of Personal Data , Paris, 1981.
37. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.<http://www.odpr.org/restofit/Legislation/Directive/Directive_Contents.html>.
38. Directive Concerning the Processing of Personal Data and the Protection of Privacy in the Telecommunications Sector (DIRECTIVE 97/66/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 15 December 1997). <http://www2.echo.lu/legal/en/dataprot/protection.html>.
39. Article 25 of the Directive stipulates that in many circumstances, the level of protection in the receiving country must be "adequate" - an expression which is widely accepted to mean "equivalent". Article 26 lays out certain options for tranfering data out of Europe in circumstances where the level of protection is not deemed adequate. These include consent and contracts.
40. .Opinion 1/98: Platform for Privacy Preferences (P3P) and the Open Profiling Standard (OPS). <http://europa.eu.int/comm/dg15/en/media/dataprot/wpdocs/wp11en.htm>.
41. Constitutional Court Decision No. 15-AB of 13 April 1991. <http://www.privacy.org/pi/countries/hungary/hungarian_id_decision_1991.html>.
42. U.S. Department of State Singapore Country Report on Human Rights Practices for 1997, January 30, 1998.
43. See Banisar and Davies, The Code War, Index on Censorship, January 1998.
44. James Bamford, The Puzzle Palace, Penguin Books, 1981.
45. European Parliament, Scientific and Technological Options Assessment (STOA), An Appraisal of Technologies of Political Control, 6 January 1998. <http://jya.com/stoa-atpc.htm>.
46. House of Lords, Science and Technology Committee, Fifth report, "Digital images as evidence", 3 February 1998, London.
47. Stepehen Graham, John Brooks, and Dan Heery ìTowns on the Television : Closed Circuit TV in British Towns and Citiesî; Centre for Urban Technology, University of Newcastle upon Tyne
48. American Management Association, Report on Electronic Monitoring & Surveillance, 1997. <http://www.amanet.org/survey/elec97.htm>.
49. Office of Technology Assessment, New Technology, New Tensions, September 1987.
50. Halford v United Kingdom (Application No 20605/92), 24 EHRR 523, 25 June 1997.
Title:
Issue:
Date:
Palash Biswas
Pl Read:
http://nandigramunited-banga.blogspot.com/
No comments:
Post a Comment