Sorting out smart surveillance

Computer Law and Security Review

Volumn 26, Issue 4, 2010, Pages 343-354

  Wright, David ^a   Friedewald, Michael ^b   Gutwirth, Serge ^c   Langheinrich, Marc ^d   Mordini, Emilio ^e   Bellanova, Rocco ^c,g   De Hert, Paul ^b   Wadhwa, Kush ^a   Bigo, Didier ^f  

^a Trilateral Research and Consulting LLP: Trilateral Research Ltd   (United Kingdom)

^b FRAUNHOFER INSTITUTE FOR SYSTEMS AND INNOVATION RESEARCH ISI   (Germany)

^c VRIJE UNIVERSITEIT BRUSSEL   (Belgium)

^d UNIVERSITY OF LUGANO   (Switzerland)

^e Centre for Science Society and Citizenship   (Italy)

^f KING'S COLLEGE LONDON   (United Kingdom)

^g FACULTÉS UNIVERSITAIRES SAINT LOUIS   (Belgium)

Author keywords

Privacy; Privacy impact assessments; Security; Smart surveillance; Transborder data flows

Indexed keywords

IMPACT ASSESSMENTS; PRIVACY; SECURITY; SMART SURVEILLANCE; TRANSBORDER DATA FLOW;

LAWS AND LEGISLATION; MONITORING;

DATA PRIVACY;

EID: 77955624549     PISSN: 02673649     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.clsr.2010.05.007     Document Type: Article

References (87)

1. Clarke, R., 'Information Technology and Dataveillance', Communications of the ACM, Vol. 31, No. 5, May 1988, pp. 498-512.
2. The authors note contemporary activities in bringing surveillance systems together, whether for control, governance, security, profit or entertainment, Haggerty, K.D., and R.V. Ericson, "The Surveillant Assemblage', British Journal of Sociology, Vol. 51, No. 4, 2000, pp. 605-22.
3. By "banalisation", we mean making surveillance commonplace (banal), so that it becomes something we as a society do not care about. Banalised forms of surveillance enter our daily life without notice, so that they become a common part of our sociopolitical and economic relations, so that we become acclimatised or accustomed to surveillance in general, even if we are not always aware of the deployment of particularly intrusive forms of surveillance. The term is used to indicate the increasing pervasiveness of surveillance, right down to the level of the individual (parents monitoring their children's whereabouts or taking pictures of what their neighbours are doing). Some examples could be the capture, storage and processing of fingerprints of frequent costumers of sporting complexes, in order to ease their access to and use of facilities, or the processing of large amounts of personal data in social networks for running "small entertaining applications". In the field of law enforcement, it could be represented by the disproportionate retention of DNA in cases involving petty crimes. This idea partially resonates with the concepts of "soft surveillance", developed in Marx, G.T., "Soft Surveillance. The Growth of Mandatory Volunteerism in Collecting Personal Information", in T. Monahan (ed.), Surveillance and Security, Technological Politics and Power in Everyday Life, Routledge, New York, 2006, pp. 37-56.
4. For more on banalisation, see Bellanova, R., P. De Hert and S. Gutwirth, "Variations sur le thème de la banalisation de la surveillance", Mouvements, No. 62, 2010.
5. Festinger, Leon, A theory of cognitive dissonance, Stanford University Press, Stanford, CA, 1957.
6. As defined in the Merriam-Webster Online Dictionary, http://www.merriam- webster.com/dictionary/surveillance. The English word originates from the French verb "surveiller", which, literally translated, means "to watch over".
7. Jenness, V., D.A. Smith and J. Stepan-Norris, "Taking a Look at Surveillance Studies", Contemporary Sociology: A Journal of Reviews, Vol. 36, No. 2, March 2007, pp. vii-viii.
8. This is a quote from the full title of Bentham, Jeremy, Panopticon, 1787, a copy of which can be found at http://cartome.org/panopticon2.htm.
9. Foucault, M., Discipline and Punish: The Birth of the Prison, Vintage Books, New York, 1995, p. 195.
10. Giddens, A., "Surveillance and the capitalist state", in A Contemporary Critique of Historical Materialism, Macmillan, London, 1981, pp. 169-176.
11. Bauman, Z., Globalization: The Human Consequences, Polity Press, Cambridge, 1998.
12. Foucault, M., Histoire de la sexualité 1. La volonté de savoir, Gallimard, Paris, 1976;
13. Foucault, M., Sécurité, territoire, population. Cours au Collège de France. 1977-78, Gallimard/Seuil, Paris, 1997.
14. Marx, G.T., "La société de sécurité maximale", Déviance et société, 1988, pp. 147-166.
15. See also Deleuze G., "Contrôle et devenir" and "Post-scriptum sur les sociétés de contrôle" in Pourparlers, 1972-1990, Minuit, Paris, 1990, pp. 240-247
16. , English translation available at: http://www.watsoninstitute.org/ infopeace/vy2k/deleuze-societies.cfm.
17. Cohen, S., "The punitive city: notes on the dispersal of social control", Contemporary crises, 1979, pp. 339-63;
18. Cohen, S., Visions of social control: Crime punishment and classification, Polity Press, Cambridge, 1985.
19. Lyon, D. (ed.), Surveillance as Social Sorting: Privacy, risk and digital discrimination, Routledge, London, 2003.
20. Gutwirth, S., Privacy and the information age, Rowman & Littlefield, Lanham MD, 2002.
21. European Data Protection Supervisor (EDPS), Opinion on the Communication from the Commission to the European Parliament and the Council on an Area of freedom, security and justice serving the citizen, Brussels, 10 July 2009. http://www.edps. europa.eu/EDPSWEB/edps/Home/Consultation/OpinionsC/ OC2009.
22. House of Lords Select Committee on the Constitution, Surveillance: Citizens and the State, Vol. I: Report, The Stationery Office Limited, London, 6 Feb 2009, p. 5. http://www.parliament. the-stationery-office.com/pa/ld200809/ ldselect/ldconst/18/1802htm.
23. Lyon, D., Surveillance Studies: An Overview, Polity Press, Cambridge, 2007, p. 39.
24. House of Lords, Lyon, D., Surveillance Studies: An Overview, Polity Press, Cambridge, 2007, op. cit., p. 10.
25. The close relationship between privacy and freedom has featured in many scholarly texts, but the classic is that of Westin. He defined privacy as "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others." He goes on to say that "a balance that ensures strong citadels of individual and group privacy and limits both disclosure and surveillance is a prerequisite for liberal democratic societies". Westin, Alan F., Privacy and Freedom, Atheneum, New York, 1967, p. 7, p. 24, Privacy, as manifested in the secret ballot, is at the heart of democracy, but as Westin and others have argued it is not an absolute right and must be balanced against other values .
26. http://thepublicvoice.org/madrid-declaration. Among the civil society organisations were the Electronic Frontier Foundation, the Electronic Privacy Information Center and Privacy International. Among the experts were Colin Bennett, Roger Clarke, David Flaherty, Joel Reidenberg and Marc Rotenberg.
27. Athow, D., "Tories Promise To Slash Surveillance State Programme", ITProPortal, 17 Sept 2009. http://www.itproportal.com/portal/ news/article/2009/9/17/tories-promise-slash-surveillancestate-programme.
28. A recent report of the Interception of Communications Commissioner, compiled by Sir Paul Kennedy, has stated that one in every 78 adults in UK is under surveillance and nearly 1400 requests are made by government agencies every day to snoop on the public. Athow, D., "Personal Privacy Threatened By Snooping Councils", ItProPortal, 10 August, 2009. http://www. itproportal. com/portal/news/article/2009/8/10/personal-privacy- threatenedsnopping-council.
29. There has been a lot of debate about the effectiveness of CCTV. A UK Home Office study found that "the best current evidence suggests CCTV reduces crime to a small degree. CCTV is most effective in reducing vehicle crime in car parks, but it had little or no effect on crime in public transport and city centre settings". Welsh, Brandon C., and David P. Farrington, Crime prevention effects of closed circuit, television: a systematic review, Home Office Research, Development and Statistics Directorate, August 2002.
30. A second study for the Home Office three years later concluded that "Assessed on the evidence presented in this report, CCTV cannot be deemed a success. It has cost a lot of money and it has not produced the anticipated benefits." It did say, however, that CCTV "has potential, if properly managed... [but] ill-conceived solutions are unlikely to work no matter what the investment." Gill, Martin, and Angela Spriggs, Assessing the impact o/ CCTV, Home Office Research, Development and Statistics Directorate, Feb 2005, pp. 120-121. While CCTV may not reduce crime, it does have the merit of recording crime the images of which may be helpful in apprehending those who have committed them.
31. The term self-surveillance is typically used in a slightly different context in the existing literature. See, e.g., Vaz, P., and F. Bruno, "Types of Self-Surveillance: from abnormality to individuals 'at risk'", Surveillance and Society, Vol.1, Issue 3, 2003, pp. 272-291.
32. Hildebrandt, M., and S. Gutwirth (eds.), Profiling the European citizen, Cross-disciplinary perspectives, Springer, Dordrecht, 2008.
33. See www.google.com/health/
34. See www.healthvault.com
35. Hodges, S., L. Williams, E. Berry, S. Izadi, J. Srinivasan, A. Butler, G. Smyth, N. Kapur and K. Wood, "SenseCam: A retrospective memory aid", Ubiquitous Computing, Proceedings of Ubicomp 2006, Springer, pp. 177-193.
36. See the websites www.myzeo.com, www.directlife.philips. com and nikerunning.nike,com/nikeos/p/nikeplus/en-US/ products/sportband respectively.
37. See the websites www.foursquare.com and www.gowalla.com.
38. Council of the European Union, "A secure Europe in a better world - The European Security Strategy", Approved by the European Council held in Brussels on 12 December 2003 and drafted under the responsibilities of the EU High Representative Javier Solana, Brussels, 2003. http://www.consilium.europa. eu/ueDocs/cms-Data/docs/pressdata/EN/reports/104630.pdf
39. Group of Personalities in the field of Security Research, "Research for a Secure Europe", Office for Official Publications of the European Communities, Luxembourg, 2004. http://ec.europa. eu/enterprise/policies/ security/files/doc/gop-en.pdf.
40. European Commission, "Security Research: The Next Steps", COM(2004) 590 final, Brussels, 2004. http://cordis.europa.eu/documents/ documentlibrary/69322111FR6.pdf.
41. European Security Research Advisory Board (ESRAB), "Meeting the challenge: the European Security Research Agenda", A report from the European Security Research Advisory Board, Office for Official Publications of the European Communities, Luxembourg, 2006. http://ec.europa.eu/enterprise/ policies/security/files/esrab-report-en.pdf.
42. ESRAB, op. cit.
43. ESRAB, op. cit, European Commission, "Towards a more secure society and increased industrial competitiveness: Security research projects under the 7th Framework Programme for Research", DG Enterprise and Industry, Brussels, 2009. ftp://ftp. cordis.europa.eu/pub/fp7/security/docs/towards-a- more-secure- pdf.
44. "Towards a more secure society and increased industrial competitiveness: Security research projects under the 7th Framework Programme for Research" ftp://ftp. cordis.europa.eu/pub/fp7/security/docs/towards-a- more-secure- pdf. GoP, op. cit.
45. EC, COM(2004) 590 final, op. cit.
46. European Commission, "An area of freedom, security and justice serving the citizen", COM(2009) 262 final, Brussels, 2009. This Communication is the basis of the multi-annual programme in the area of freedom, security and justice, known as the Stockholm programme.
47. See also: http://www.se2009.eu/en/the-presidency/work-programme/the- stockholm-programme. The Swedish Presidency [of the EU] says (at the last mentioned website) that "The vision for work with the Stockholm Programme is a more secure and open Europe where the rights of individuals are safeguarded."
48. EDPS, op. cit., para 23.
49. Bunyan, T., The Shape of Things to Come, version 1.3, Statewatch, London, 30 Sept 2008, p. 7.
50. House of Lords 2009, op. cit., p. 26, p. 28.
51. Cooke, R., and K. Scruggs, "Smart Surveillance - Effective Information for Public Safety", Paper presented at: 30th Annual Law Enforcement Information Management Conference, Grapevine, TX, 5-9 June 2006. http://www.iacptechnology.org/LEIM/2006Presentations/Smart-Surveillance%20- Cooke-and-Scruggs, pdf
52. European Council, Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30 Dec. 2008, pp. 60-71.
53. The 1993 Treaty of Maastricht introduced the three pillar EU structure, The first pillar comprised European Community economic, social and environmental policies. The second pillar was that of the Common Foreign and Security Policy and the third pillar supported police and judicial cooperation. The Lisbon Treaty did away with the three pillar structure on 1 December 2009.
54. European Court of Justice, European Parliament v Council of the European Union (C-317/04) and Commission of the European Communities (C-318/04), Joined cases C-317/04 and C-318/04, European Court reports, 2006, p. 1-04721.
55. See Hijmans, H., and A. Scirocco, "Shortcomings in EU Data Protection in the Third and Second Pillars. Can the Lisbon Treaty be Expected to Help?", Common Market Law Review, Vol. 46, No. 5, 2009, pp, 1493-97;
56. De Hert, P., and M.V. Papakonstantinou, "The data protection framework decision of 27 November 2008 regarding police and judicial cooperation in criminal matters. A modest achievement however not the improvement some have hoped for", Computer Law and Security Review, Vol. 25, No. 5, 2009, pp, 403-14.
57. Actually referring to Schengen I (Agreement between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders, entered in 1985) and Schengen II or CIS (Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders, entered in 1990).
58. European Council, Europol Convention, Brussels, 26 July 1995. http://www.europol.europa.eu/index.asp?page=legal.
59. European Council Decision of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime (2002/187/JHA), OJ L 63/1, 2002.
60. European Council, Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, OJ L 210, 6 Aug. 2008, pp. 1-11.
61. European Court of Human Rights, Case of Liberty and others versus United Kingdom, Application no, 58243/00, Strasbourg, 1 July 2008.
62. European Court of Human Rights, Case of S. and Marper versus the United Kingdom, Application nos. 30562/04 and 30566/ 04, Strasbourg, 4 Dec 2008.
63. De Beer, D., P. De Hert, G. Gonzalez Fuster and S. Gutwirth, "Nouveaux éclairages de la notion de la notion de 'donnée personnelle' et application audacieuse du critère de proportionnalité", Obs. Cour européenne des droits de l'homme Grande Chambre S et Marper c, Royaume Uni, 4 décembre 2008, Revue Trimestrielle des Droits de l'Homme, no. 81, January 2010, pp. 141-61.
64. See also Gonzalez Fuster, G., "TJCE - Sentencia de 04.12.2008, S. y Marper c. Reino Unido", Revista de Derecho Comunitario Europeo, no. 33, May-Aug. 2009, pp. 619-33.
65. Travis, A., "Police routinely arresting people to get DNA, inquiry claims", The Guardian, 24 Nov 2009. http://www.guardian. co.uk/politics/2009/nov/24/dna-database-inquiry. The way in which the UK government will implement the ECtHR decision is particularly relevant in a context characterised by the proliferation of international and European legal instruments aiming at establishing DNA analysis files in each EU Member State and fostering their exchange.
66. See Bellanova, R., "Prüm: A Model "Prêtà- Exporter"? The 2008 German-US Agreement on Data Exchange", CEPS Challenge Paper No. 13, 12 March 2009.
67. EU-US Joint Statement on "Enhancing transatlantic cooperation in the area of Justice, Freedom and Security", 20 Oct 2009. http://www,se2009,eu/ polopoly-fs/1.21271!menu/standard/file/EU-US% 20Joint%20Statement%2028%20October%202009.pdf.
68. On the EU and US privacy and data protection frameworks covering security measures, see also Bellanova, R., and P, De Hert, "Protection des données personnelles et mesures de sécurité: vers une perspective transatlantique", Cultures & Conflits, Vol. 74, 2009, pp. 63-80.
69. We define "stakeholder" to mean anyone interested in or affected by an action by a third party.
70. www.european-privacy-seal.eu/.
71. The Resolution on a privacy standard governing international data transfers adopted at the 31st Annual Conference of Privacy and Data Protection Commissioners in Madrid in early November 2009 is a step in this direction.
72. EDPS, op. cit., p. 4.
73. This definition combines two: one from the Treasury Board Secretariat of Canada, Privacy Impact Assessment Guidelines: A framework to Manage Privacy Risks, Ottawa, 31 August 2002. http://www.tbs-sct.gc.ca/pubs-pol/ciopubs/pia- pefr/paipg-pefrld1-eng asp.
74. The other comes from Clarke, R., "Privacy impact assessment: Its origins and development", Computer Law and Security Review, Vol. 25, Issue 2, 2009, pp. 123-35. Clarke has also compiled a list of various definitions in Appendix 1 of his paper.
75. Clarke, op. cit.
76. Another important term to distinguish in this context is "prior checking", which appears in Article 20 of the European Data Protection Directive and which says in part that "Member States shall determine the processing operations likely to present specific risks to the rights and freedoms of data subjects and shall check that these processing operations are examined prior to the start thereof," The European Data Protection Supervisor (EDPS) has a similar power under a Regulation of the European Parliament and Council, which obliges European Community institutions and bodies to inform the EDPS when they draw up administrative measures relating to the processing of personal data. See Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, 18 Dec 2000. http://www.europarl.europa,eu/tools/disclaimer/documents/l- 00820010112en00010022.pdf
77. International Organization for Standardization, ISO 22307: 2008: Financial services - Privacy impact assessment, Geneva, 16 Apr 2008. http://www.iso.org/iso/iso-catalogue/catalogue-tc/catalogue-detail.htm?csnumber= 40897.
78. https://www.agpd.es/portalweb/canaldocumentacion/common/ estandares-resolucion-madrid-en.pdf
79. Introna, Lucas D., and David Wood, "Picturing Algorithmic Surveillance: The Politics of Facial Recognition Systems", Surveillance & Society, Vol. 2, Issue 2/3, 2004, pp. 177-198 [p.178]. http://www.surveillance-and-society.org/cctv.htm. The authors also make the useful observation that "If there is any 'law' in the history of technology it is that technologies are rarely used in ways that their inventors intended" - which is another reason why a PIA should be undertaken, i.e., so that stakeholders can give consideration to ways in which technologies might be used in addition to the way they are intended to be used.
80. Lyon has written extensively on the subject. See Lyon, David (ed.), Surveillance as Social Sorting; Privacy Risk and Digitial Discrimination, Routledge, London, 2003.
81. See also Lyon, David, Surveillance Studies: An Overview, Polity Press, Cambridge UK, 2007.
82. Graham, Stephen, and David Wood, "Digitizing Surveillance: Categorization, Space, Inequality", Critical Social Policy, Vol, 23, No. 2, 2003, pp. 227-248 [p.231].
83. De Hert, P., and S. Gutwirth, "Privacy, data protection and law enforcement. Opacity of the individual and transparency of power" in E. Claes, A. Duff & S. Gutwirth (eds.), Privacy and the criminal law, Intersentia, Antwerp, 2006.
84. Bigo, D., E. Guittet and A. Scherrer (eds.) Mobilités sous surveillance, comparaison Europe et Canada, Athena, Montréal, October 2009.
85. Page, L., "Interpol proposes world face-recognition database", The Register, 20 Oct 2008. http://www.theregister.co.uk/2008/10/20/interpol- face-scan-plan/.
86. Wright, David, "Should privacy impact assessments be mandatory?", Communications of the ACM , 2011 (forthcoming).
87. COST = Cooperation in Science and Technology. See http://www.liss-cost. eu/