Protection of Freedoms Bill

Lord Haskel Excerpts

Tuesday 13th December 2011 Grand Committee

[Lord Lucas]

My Lords, if I may start off with a general remark, let me say that I suspect that I will end up preferring the amendments of the noble Lord, Lord Rosser, to mine. My purpose in tabling these amendments is to give us a good chance to discuss this part of the Bill, which I think has gone too far in trying to apply to schools special arrangements for dealing with biometric data that are neither required nor sensible.

In the wider world, letting one’s biometric data go is perhaps frightening. What Facebook is up to at the moment—for example, allowing people to tag photographs, such that I can be identified from photographs on other people’s websites because they are tagged with my name and details and the way in which that allows information about me to spread around the world—is worrying enough in our society but would be extremely worrying in, say, Syria. One should be aware of the dangers posed by the widespread ability to identify people remotely. If it became possible at a distance to pick up people’s identity as they passed shop-fronts and gazed into window displays and to have information on fingerprints widely available so that, for example, as soon as I touched a door-handle the store would know who I was, that would, to my mind, be a fairly nightmarish world to be part of. I am very grateful that our Government show no inclination to go down that road and, indeed, at an early stage abandoned identity cards, which would have been a step in that direction.

However, to my mind, in a closed community like a school, those worries do not apply. The school is supposed to know where each kid is all the time. I remember getting terribly upset when a friend of mine had their child knock on the door, having walked a mile home from school without the school having known that the child was absent. You expect a school to know where the children are, you expect it to know what they are doing and you expect it to be in control of them. Within a closed arrangement like a school, having one’s biometric information available is not such a big thing. Within this community of the House of Lords, the place is full of people—thank goodness—who know who we are. That is a biometric recognition system. One of the reasons why this place is secure is that it is full of doorkeepers who would recognise someone who did not belong. Within a school, an automatic system does no more than that, and it is fundamentally no more frightening than that.

A school has a lot of information on the pupils under its charge. A lot of that information is much more sensitive than a hash of some fingerprint—something that would take a great deal of ingenuity to make any real use of if it escaped. A school has information on what children have done in terms of their academic endeavours, what special needs they have, what mischiefs they have committed and people’s opinions of them, which could be extremely sensitive if they appeared in later life. Schools are used to guarding a lot of data about their charges. Whether they do that as perfectly as possible, I do not know, but one very rarely comes across occasions when this information has escaped to people’s embarrassment—when it does, it has usually been released by their mothers who are so proud of the reports that their children have received at school.

This is the context within which we must think about the sort of information which will be available as a result of a biometric recognition system. All that it is doing is scanning the proportions of a face or taking a few data points from the ridges of a fingerprint—but not as many as you would take if you were doing a proper security scan because you want something that works fast rather than completely accurately. There is no common storage format or easy way of that data being made use of by outside people even if they did discover it.

In these circumstances, as I say, you are supposed to know everything that is going on—knowing whether a child is in a classroom is something that a school is supposed to know. By and large, it is quite rare that these systems are used even to that extent. Mostly, they are used just for tagging library books to see who takes them out and to see who is entitled to free school lunches in order to avoid the use of cash and people being labelled as free school-meal kids. There is no identification—they are in a way disguising someone’s identity and protecting their information when used as meal systems. Fundamentally, though, biometric systems are used because they enable a school to do what it should be doing more efficiently and more cheaply than it could without them.

I agree that there is some basis for asking for parental consent. I probably do not naturally start out from that position, but I am convinced of it by what the Government have said, and by things that have been said to me in a long e-mail correspondence with some of the people promoting this side of the Bill. There are a lot of things that parents are asked to consent to, and it is quite reasonable that a school should explain why it wishes to use these systems and get general parental consent for it. If a parent wishes to say no, the school should make arrangements for that particular child to be excepted. I go along with that.

However, I really want the systems and rules that we put in place for schools to fit in with all the other rules that are there for asking parental consent for this, that and the other—whether it be religious observance, sex education or whatever else. These are taken seriously by schools and there are ordinary systems for them, the basis for which is single-parent consent. If two parents are involved and one objects, that nullifies the consent, but if you are seeking consent all you need is the consent of one parent. With a lot of schools, for parental arrangements it is really hard enough to get that; to go beyond that, in what seems to be an entirely ordinary matter for schools, does not seem sensible.

The other aspect that I want to look at is where facial recognition systems in particular, and other forms of ID, are going to be built into the systems that kids are using. If they are accessing Facebook from school—as many will be, because it is a common way of finding out information and communicating with other children who are collaborating on a project—there will be biometric information systems built into that software that will not be within the school’s power to disable. That will be within the individual child’s power to deal with, and the school will not have responsibility for it. If the school is using Windows 8—not yet out, but in beta form—there will be facial recognition systems built into that, so that when you sit down, your computer knows that it is you; if someone else sits down at your computer, it does not turn on. That, again, is a personally activated system. A school can disable that on school computers, but if the school is allowing children to access laptops and to take them home, as many secondary schools now do, then you would expect the child to be in control of the system and it would not be reasonable to require the school to impose or be responsible for the way in which biometric recognition systems are used without the school’s own systems. Some of the wording that we have at the moment crosses those boundaries.

On my individual amendments, Amendment 85 is completely garbled and I have no idea what it means. It may be that my noble friend’s officials have been able to decipher it, but I think it must have been my handwriting and I cannot now work out what the amendment means. I apologise to him and to the Committee for that.

Amendment 87 is a version of the amendments tabled by the noble Lord, Lord Rosser. It is really saying that you must have single-parent consent and that an objection by the other parent nullifies that, but otherwise you only need one parent’s consent. Amendment 88 is another way of saying that, while the second part of Amendment 87 deals with the point that I made about some bits of biometric recognition being outwith the school’s control. Amendment 90 covers that same point, as does Amendment 92.

Amendment 94 is a worry about the wording in that part of the Bill. There are a lot of schools with these systems in place—several thousand of them, probably including the large majority of secondary schools and quite a lot of primaries. The wording of that part of the Bill might be used to allow a school not to go for retrospective parental consent. My view is that, if we are to have parental consent, all those schools that have the system should write to parents asking for their consent, rather than that consent being assumed or being taken to be too difficult—an exception being claimed under this subsection.

Amendment 97 reduces the age limit to 16, which I think is the common age within schools at which pupils should be allowed to take responsibility, while Amendment 98 questions the width of “equipment”, which in common parlance has animate as well as inanimate means. I beg to move.

[The Deputy Chairman of Committees (Lord Haskel)]

I have to tell your Lordships that, if Amendment 85 is agreed, I cannot call Amendments 86 to 88 because of pre-emption.

[Lord Rosser]

My Lords, we have four amendments in this group: Amendments 86, 89, 93 and 96. Amendments 86, 89 and 93 would simplify requirements for consent for the processing of biometric information. In particular, Amendment 86 would establish an opt-out rather than an opt-in system and remove the requirement for both parents to consent; instead, it would require notification from just one parent to withdraw consent. Amendments 86 and 89 remove the current provision allowing children of any age to override parental consent, and instead permit only children above the age of 16 to object. Amendment 93 makes consequential changes to requirements for parental consent while—although I will leave this to the end—Amendment 96 establishes a new duty upon schools to consult the views of teachers, parents and pupils before introducing biometric recognition systems into schools.

Our amendments in this group, as I have said, seek to simplify requirements around consent for schools and to prevent new rules from rendering costly, high-tech equipment in schools defunct. There are apparently no official figures on how many schools use biometric systems, but there are estimates. There was an estimate in a House of Commons Library note earlier this year that 30 per cent of secondary schools and 5 per cent of primary schools use them. Perhaps the Minister could tell us what he thinks the figures are.

The Home Secretary’s description of the Bill's provisions as a double lock on the processing of biometric information in schools is a tellingly accurate reflection of the regulatory bulwark that schools will in future come up against in order to use existing biometric processing systems. By requiring both parents of every child to provide written consent, the Government are creating a potential bureaucratic nightmare for schools that use these systems. In the words of the Association of School and College Leaders:

“What is proposed here is a very burdensome and bureaucratic new regulation that will address no significant problem. In short, it is exactly the kind of legislation that the present government promised to repeal, not enact”.

--- Later in debate ---

[Baroness Miller of Chilthorne Domer]

My Lords, the first seven amendments in this group would enable the Committee to examine a little further the existing complicated system for administrative authorisation. Where the Bill refers to judicial authorisation, one imagines that somebody from the judiciary will authorise whichever investigatory power is being used. However, in the section in the Bill to which my amendments apply, the administrative officer and his superior agree that surveillance is necessary, and the initial authorisation remains an administrative decision that does not come into effect until the approval of a magistrate is given. However, the magistrate will not examine why authorisation is being applied for or anything about the individual concerned; it will be just a review to make sure that the process has been reasonable.

The amendments examine whether the Bill will make the system any more transparent and whether it will be any easier to challenge unfair applications through the Investigatory Powers Tribunal. They examine also whether the system will become more efficient or cheaper. I welcome the Government’s desire to bring judicial authorisation more into the system, but I wonder whether it is sufficient.

Amendment 128 is much wider. I heard the Minister reply to the previous amendment to the effect that the misuse of the Act has been sufficiently addressed, but Amendment 128 has been tabled to probe the Committee’s view on the urgency of reviewing the whole RIPA fabric. This is for several reasons. First, since RIPA was conceived back in the late 1990s, technology has moved on enormously and things are able to be done now which were unimaginable then. It has nothing to do with phone hacking and the News of the World issue—which is still illegal—but with technical and storage capacity. In the 11 years since RIPA was passed, both of those areas have changed out of all recognition.

On re-reading that Act, there appears to be an enormous patchwork of different authorisation schemes, of which this is just one example. That does not seem an efficient way to proceed. The Minister referred to the expense of reviewing. There may be an expense in the inefficiency and patchwork of systems, but what concerns me most is that there are sufficient safeguards against unnecessary and disproportionate use of the surveillance powers.

As to the sheer scale of the use of the powers, we have come to accept that their use is necessary for serious crime and terrorism issues. However, since the Bill was passed, there have been some 3 million decisions made under it by public bodies; 20,000 warrants; 4,000 authorisations for intrusive surveillance and 30,000 for directed surveillance—and that does not include the intelligence services because those figures are not made public. So there is an issue with the scale of what is happening.

The Minister may feel that an inquiry will be expensive and he may be correct—obviously it will incur some expense—but there may be savings to be made if we consider whether the kind of umbrella that RIPA provides is adequate for purpose. It seems to be an umbrella that is full of holes, not only in the authorisation process but in its classification of the different kinds of intrusions—for the sake of the Committee’s time I shall not go into them—which are immense. For example, a phone call that is listened to from outside a house and one that is listened to from inside a house with a bug are different kinds of intrusions and carry different authorisations. As far as the public are concerned, that is a complicated regime—it may be necessarily complicated—and it can pose enormous problems in the complaints procedure if an individual has been subject to that intrusion.

If, as a member of the public, you want to complain about unfair investigatory powers, it is obviously extremely difficult. I have mentioned the figure of 3 million. Out of that, 1,100 complaints have been heard by the Investigatory Powers Tribunal, of which only 10 have been upheld. That tends to suggest that there is a problem.

I am sure that many Members of the Committee have seen the thorough Justice report, Freedom from Suspicion: Surveillance Reform for a Digital Age, which lays out the issues in a detailed manner and gives all the references. Given the evidence that is presented in that report alone, Parliament has a duty to hold the kind of inquiry that Amendment 128 seeks. I beg to move.

[The Deputy Chairman of Committees (Lord Haskel)]

Perhaps it will be for the convenience of the Committee if I explain that in an earlier edition of the groupings all the Amendments 115 to 128 were grouped. In a later edition there are two groups: first, Amendments 115 and 120 to 128; and then a second group with Amendments 116, 117, 118, 119 and 122. So there are two groups.