During a six-month period this year, an estimated 15 million people were caught by CCTV images at Manchester’s iconic shopping precinct, the Trafford Centre. Anyone who has visited the centre will readily see the obligatory notices warning that the use of CCTV was in operation. No great surprises: the United Kingdom is, unenviably, a world leader in the use of overt (and for that matter covert) surveillance. In 2016, London had, reportedly, an estimated 14,000 CCTV cameras in use. But more sinister uses of the technology have recently emerged. Greater Manchester Police (GMP) has been “piggybacking” on the back of the technology used at the Trafford Centre for the purposes of live facial recognition. This is problematic for a whole range of reasons. The Manchester Evening News published an opinion piece by Big Brother Watch’s indefatigable Director, Silkie Carlo (found here) which summarised its on-going legal challenge to the use of the technology by other police forces, in different circumstances. The Security Camera Commissioner, Tony Porter, has also written about his concerns (see his blog on the subject here). Mr Porter’s jurisdiction was triggered, not because of the use of CCTV per se, the Trafford Centre, is a commercial entity, but because of GMP’s exploitation of the technology, which had the potential to place the activity under this purview. His message:
“My fellow regulators and I need work together to help guide organisations in what is becoming an increasingly complex issue. The risk of well-intended but badly executed practice may form within the regulatory gaps and overlaps which exist and more examples may come across my desk”.
The use of the term “fellow regulators” is an interesting one. It had no obvious reference point in the text of an otherwise useful narrative about the issue. There is mention of the Data Protection Acts (and therefore impliedly, a role for the Information Commissioner) but notable by its omission was the Regulation of Investigatory Powers Act 2000 (RIPA 2000).
RIPA 2000 has been somewhat overshadowed by the Investigatory Powers Act 2016 but large parts of it remain in force, including the provisions relating to directed and intrusive surveillance. The starting point is s 26(2). Insofar as relevant, this provides:
(2) …surveillance is directed for the purposes of this Part if it is covert but not intrusive and is undertaken—(a) for the purposes of a specific investigation or a specific operation;(b) in such a manner as is likely to result in the obtaining of private information about a person (whether or not one specifically identified for the purposes of the investigation or operation); and(c) otherwise than by way of an immediate response to events or circumstances the nature of which is such that it would not be reasonably practicable for an authorisation under this Part to be sought for the carrying out of the surveillance.
The use of the term “covert” is defined in s 26(9):
(9)For the purposes of [s 26] —(a) surveillance is covert if, and only if, it is carried out in a manner that is calculated to ensure that persons who are subject to the surveillance are unaware that it is or may be taking place.
At first glance, CCTV would not appear to constitute covert surveillance; it is after all demonstrably overt. However, the (recently) Revised Code of Practice on Covert Surveillance and Property Interference has contemplated this and provides in paragraph 3.39:
“However, where overt CCTV, ANPR or other overt surveillance cameras are used in a covert and pre-planned manner as part of a specific investigation or operation, for the surveillance of a specific person or group of people, a directed surveillance authorisation should be considered. Such covert surveillance is likely to result in the obtaining of private information about a person (namely, a record of their movements and activities) and therefore falls properly within the definition of directed surveillance. The use of the CCTV, ANPR or other overt surveillance cameras in these circumstances goes beyond their intended use for the general prevention or detection of crime and protection of the public.
It is reasonable to assume therefore that GMP should have sought a directed surveillance authorisation for the Trafford Centre operation. Whether it could ever have satisfied the threshold for doing so is highly questionable. The inexorable conclusion if no such authorisation was obtained: 15 million people (including children) were the subject of a wholly non-compliant directed surveillance operation”.
But it doesn’t end there.
First, which, if any, of the “fellow regulators” has primacy to investigate this highly troubling activity? Prior to 2017, reference could have been made to the novel “Surveillance Road Map”, now withdrawn. Surprisingly, this was not published, at least primarily, for the benefit of members of the public but for regulators, so that they could understand where the lines of demarcation existed. Now, it is necessary to dig a little deeper. In an impact assessment for the then Data Protection Bill (later the 2018 Act) dated 26 October 2017, the Home Office appeared to accept, albeit in the context of the Investigatory Powers Act 2016, that any breach should be reported to the Investigatory Powers Commissioner Office (IPCO). That the present issue resides with IPCO is an argument that has therefore strong analogical force.
Second, in theory, every one of the 15 million people subjected to non-compliant directed surveillance has a right of action against GMP to the Investigatory Powers Tribunal (IPT), under s 65 of RIPA 2000. The IPT has the power to order compensation and the destruction of any surveillance product that may have been retained.
Other questions inevitably arise about operational planning, understanding the legal position, what happened to the data and where is it now, should oversight and regulation be clearer – what happens when the state and the private surveillance industrial complex collide. Sadly, few of these will be answered in the aftermath of the Trafford Centre covert surveillance controversy.
NOTE
© Simon McKay (2018). As a general rule, I have no problem with third parties using my material but please ask for my permission before using or copying the material contained in this blog. If you do use it, attribute it to me with a link to the original content where possible. This is opinion, not legal advice.
I have covert surveillance and CHIS training scheduled in November. If you would like details, email me via the contact page on this website.