Data Protection Legislation   

Fraud Advisory Panel

At a meeting of the Fraud Advisory Panel (FAP) on Wednesday 15th December the Information Commissioner addressed a number of issues regarding private investigators, and what follows is a precis of his comments.

Covert Surveillance

The Commissioner was quite adamant that organisations can put their employees/customers under covert surveillance, as long as they can justify it and that they have taken less intrusive action prior to conducting the covert surveillance.

The previous Commissioner had said that with covert surveillance you should involve the police, and the argument had been that the police will not get involved until such time as you have some evidence. You could not get the evidence because you considered covert surveillance was necessary, and the Commissioner was saying that you needed police involvement, so it was a catch 22 situation.

The current Commissioner strongly recommends that you conduct an impact assessment prior to covert surveillance, and that this assessment is used to develop the argument that surveillance is the last resort. This would tend to imply that an insurance company should have exhausted all other methods of validating the insured's claim before engaging an investigator to put him under surveillance. It would also imply that the investigator should have knowledge of other less intrusive investigation techniques, such as knowing that you can access the director's database to obtain a home address of a director rather than following him from his place of work.

The Commissioner went on to say that covert surveillance doesn't have to relate to just criminal practice, but could relate to malpractice. He was quite adamant that surveillance should occur only in exceptional circumstances, there should be grounds for suspicion, and it should be authorised by senior management.

Destroying Information

It was discussed at some length as to whether you have to immediately destroy information relating to a suspect once he has been eliminated from the enquiry.

The Commissioner said this is a judgment call for the Data Controller, and that if he held on to it he would have to justify it.

The Commissioner's office recognise that just because you have eliminated the subject from the enquiry at an early stage doesn't mean to say that he wouldn't feature in it at a later stage, and that could be some weeks/months, if not years, later.

He recommends that if the information is held then it be reviewed on a regular basis and that the review be documented and the reasons noted for still holding it.

In 2005 the Association of Chief Police Officers will publish a new Data Protection Code which they will refer to as Police Information Handling Code, and this could be used as a benchmark by private investigators with regard to how they handle information.

Is a Private Investigator a Data Controller in his own right?

The Information Commissioner and his colleagues are of the opinion that the investigator is the Data Controller.

FAP disagreed with him and it has been decided that FAP will put together a paper addressing the role of the investigator as to whether he is a Data Controller or a Data Processor.

If the investigator is the Data Controller it imposes far more responsibility than was originally thought with regard to compliance with the Data Protection Act 1998. It also opens up the opportunity for the Data Subject to take direct action against the investigator for any breaches of Data Protection.

Any comments from readers regarding this Data Controller/Data Processor issue would be more than welcome. Please email Chris Brogan at info@securitysi.com

Obtaining information by deception (Blagging)

It is a criminal offence under the Data Protection Act to obtain information by deception. The Commissioner's office take it very seriously.

They have issued video guidance on it, and the Commissioner asked the writer to pass on his comments to the investigative world generally that he will be vigorously investigating any breaches of this part of the Act.

He has recently appointed a Chief Investigations Officer, formerly of Manchester Police, who will be undertaking these investigations.

It was suggested to him that this could be better tackled by involving the investigative trade bodies. He acknowledged that this had not been done in the past and he would pass those comments on to his Chief Investigations Officer.

The author would suggest that perhaps the trade bodies make an approach to the Commissioner's office to start a dialogue with the new Chief Investigations Officer.

Sources of Information

The previous Commissioner had asked Professor Charles Oppenheim of Loughborough University to review public sources of information that in the Commissioner's view were being used for a purpose other than was intended. For example, directors' database, Families Office, electoral register, etc. The previous Commissioner, as a result of this survey, had on a number of occasions stated that she would vigorously canvas the government to restrict access to these sources of information.

I am pleased to report that the current Commissioner said that this was now on the back burner, and went on to say that it was actually in the deep freeze. That's got to be good news to any investigator, as these sources of information are of such value to us in our daily activities.

Licensing of Investigators

The Commissioner expressed the view that he would like one of the criteria for licensing of a Private Investigator to be that he has not been prosecuted under the Data Protection Act. His argument is that investigation is all about processing personal data and if the investigator has been prosecuted for breach of that legislation then clearly he has demonstrated that he is not a fit and proper person to process ‘Personal Data’.

Background

This meeting came about because of a project that has been commissioned by the Fraud Advisory Panel, entitled ‘The Impact of the Privacy Laws on the Investigation and Prosecution of Fraud’. The results should be known in January 2005, and hopefully published in the early part of 2005, with its first public airing at a conference in April organised by the Credit Industry Fraud Avoidance System CIFAS. It is hoped that one of the results of this project would be a best practice re. the investigation of fraud, which the Commissioner would be happy to endorse.

Chris Brogan MA
Security International Ltd
130 St John's Road, Isleworth TW7 6PL, United Kingdom
Tel: +44 (0)20 8847 2111
Email: info@securitysi.com
Web: www.securitysi.com