Bill may force firms to change how they use information technology

DATA PRIVACY: Banks, phone companies and Government departments hold a huge amount of personal data about individual Irish people…

DATA PRIVACY: Banks, phone companies and Government departments hold a huge amount of personal data about individual Irish people.

Analysing this data would allow a very clear picture to be built up of the preferences, views and needs of all of them.

Such an analysis can be extremely useful. Garages, supermarkets and insurance companies could use it to identify those who might want to buy their products. Governments could use it to identify potential terrorists or drug traffickers.

But the storage and analysis of personal data also destroys privacy in a very real way.

READ MORE

For the past 15 years, the Irish solution to this problem has been the Data Protection Act 1988; this is about to change with the introduction of the Data Protection (Amendment) Bill 2002, which implements the EU's Data Protection Directive.

It will give people or "data subjects" new rights, such as the right to object to the processing of their data if it would cause them unwarranted and substantial damage and distress. This is related to the existing "right of access" to personal data but unfortunately this right can be abused.

In Britain, employers have been able to force potential employees to provide them with a copy of any records held by the police in relation to them.

If this record disclosed any criminal convictions, the potential employee would presumably not get the job.

The Bill will make it an offence to require an employee or potential employee to seek access to any records or to supply the employer with any data received in response to such a request.

The problem of convicted sexual offenders, particularly paedophiles, getting jobs that give them unsupervised access to children has been dealt with by The Sex Offenders Act 2001.

This Act requires convicted sex offenders to inform potential employers of their conviction if they are applying for such a job. Failure to do so is an offence punishable by up to five years' imprisonment.

The Bill may force changes in how companies use IT; it will limit the use of "automated decision-making", so that a computer cannot make important decisions about people except in limited circumstances.

It will also significantly expand the scope of data protection, as it will now apply to a wider variety of data including "manual data".

This is data that is recorded in a structured filing system so that data relating to an individual is readily available.

Once the Bill becomes law, paper-filing systems will be subject to the laws of data protection in the same way as their electronic equivalents.

One consequence of this provision will be that it will no longer be possible to avoid data protection laws by storing relevant information on a computer system.

The Bill has been published at a challenging time for privacy rights' issues. One challenge is posed by new technologies such as the combination of closed circuit television (CCTV) systems with facial recognition software.

This creates a powerful tool for monitoring public space, which can alert the Garda as soon as a known criminal comes into view.

A system that automatically identifies and tracks individuals is far more invasive of privacy than one that remains passive until a human operator notices something suspicious.

On the other hand, it may reduce crime. The London Borough of Newham in England has 300 CCTV cameras linked to a central database.

It matches the faces it monitors with photographs of 100 known criminals.

If it spots one of them, it notifies the police, who commence surveillance of that individual. The borough claims that crime rates have fallen by almost 35 per cent since this system was introduced.

Another challenge is posed by political sentiment. Since September 11th fighting terrorism has become a priority.

This led a group of Europe's data protection commissioners to issue an opinion expressing concern that "there is an increasing tendency to represent the protection of personal data as a barrier to the efficient fight against terrorism".

Data protection law faces the difficult task of adapting to this swiftly changing environment.

Denis Kelleher is a practising barrister and co-author of Information Technology Law in Ireland, published by Butterworths, http://www.ictlaw.com.