Surveillance Camera Commissioner’s speech to the ANPR national user group 2015
The commissioner's speech to the automatic number plate recognition (ANPR) national user group, in York.
Throughout my first full year in office I have:
- explored ANPRs role in policing
- engaged with their senior police leaders and its national user group
- encouraged the police to publicise the efficiency and effectiveness of these systems
- listened to arguments to extend data retention and provided robust feedback
- listened to views expressed by Civil Liberties Groups as to the legality of the camera network and brought to the attention of the Home Office
- pressed the police to enumerate the exact numbers of ANPR cameras operating in England and Wales
Association of Chief Police Officers (ACPO) has now been disestablished – it is the National Police Chief’s Council (NPCC) that now oversees the development of ANPR strategy. New strategy? New structure?
But I am here not to provide a consensual pat on the back to the police. I am here to present 3 challenges!
ANPR in UK must surely be one of the largest data gatherers of its citizens in the world. Mining of meta-data – overlaying against other data bases can be far more intrusive than communication intercept. Drawing as my previous experience in the police, retiring as a Commander National Coordinator Pursue for the police service throughout the Olympics, I get operating in a benign environment and also consequence management – policing by consent or as my code refers to surveillance by consent. I think it’s arguably the police service’s greatest priority to get this right
So what organisation has responsibility for ANPR?
The NPCC is not a legal entity in its own right, but a collaboration between British police forces, who collectively run and fund it under the terms of section 22a of the Police Act 1996. It is hosted by the Metropolitan Police Service.
Given we have legislation progressing through parliament relating to other forms of surveillance – are you happy that you, the police, have done everything in you power to establish a governance structure that reflects the current public mood? Where do I go to understand the layers of responsibility?
Given that the Surveillance Camera Code of Practice refers to transparency guiding principle 3 of the code refers to ‘as much transparency in the use of a surveillance camera system as possible’ – are you, the police, happy that your consultation and engagement with the public is thorough, robust, informed and informative? I’m not talking about signage – I’m talking about genuine stakeholder support? Most areas of policing benefit from Independent advisory groups – where are they in this important policy area?
Given the hugely successful ANPR operation are you, the police, happy that it should continue to operate outside of any legislative framework?
Well, hey, it’s after lunch so I thought I may as well wake you up!
For those of you that don’t know, here is a brief summary into my role as Surveillance Camera Commissioner:
- it was created under the Protection of Freedoms Act 2012
- I was appointed by the Home Secretary but am independent from government
- the role covers England and Wales
- I’m entrusted to ensure that surveillance camera systems are used to support and protect communities – not spy on them
- amongst other things body worn video (BWV), CCTV, Drones and ANPR is specifically highlighted as falling within the surveillance systems captured within act.
My role is threefold, to:
- encourage compliance with the code
- review the operation of the code
- advise on any amendments to how the code should develop
My powers:
- no powers of enforcement, sanction – just to advise
- submit annual report to parliament
- soft powers – engaged with forces to publicise Privacy Impact Assessments (PIA’s) re BWV and complete Self Assessment Tool (SAT) – engage with local authorities around compliance – similar to HMIC and Office of Surveillance Commissioners – through persuasion, argument and support. I guess the ultimate weapon is the power of embarrassment but that is the nuclear option in the face of recalcitrant relevant authorities
- engage with president of parking tribunal to ensure local authorities comply with code
- engage other regulators Office of Surveillance Commissioners (OSC) and Information Commissioner’s Office (ICO) to mutually support where our missions cross and also a developing engagement with HMIC
Me:
- retired as Assistant Chief Constable/Commander Counter Terrorism at the 2012 Olympics
- recognise value of a benign operating background
- hugely supportive of systems that protect us but well run systems with good governance
- it has been said by a Guardian journalist that putting an ex CT Commander in charge of this agenda is ‘like putting dracula in charge of a blood bank ‘
- I have said “fully support good surveillance and fully support the idea of consigning bad surveillance to the waste pile’’
Catalyst
The incident which was probably a contributing factor to the creation of my role was project champion – most of you may have heard about this. A ‘ring of steel’ erected in a predominantly muslim area of the Birmingham to monitor a terrorist threat. There was no consultation with the local community who were outraged to discover they were all being monitored as potential terrorists. The system of around 200 cameras was never switched on and it cost around £3 million and severely damaged the community’s relationship with the police.
It feels like we are a long way from there but in a world where resources are stretched and threats are real and action is necessary, you should still be mindful of your responsibilities to the communities that you serve.
The code – what is that?
The Surveillance Camera Code of Practice contains 12 guiding principles, which if followed will mean cameras are only ever used proportionately, transparently and effectively.
The code also covers your obligations as data controller under the provisions of the Data Protection Act. And as relevant authorities under the Protection of Freedoms Act, you must show the code due regard.
I have recently released a certification mark – a third party certification system that is being taken up by local authorities – my ambition is to achieve 100% success rate. I will also be looking as to how this same approach can cross transfer to police. There are also visible signs of take up from non relevant authorities – universities, banks, transport authorities and so on
ANPR use in the UK
Example of news re ANPR:
- a transparency market research report states the global ANPR market is estimated to rise from US $415.5 million in 2013 to US $1.023 million by 2020 UK market being the biggest in Europe
- concern over transfer of ANPR between TfL and Metropolitan Police (TfL storing data for 28 days and Met for 2 years) and more if extensions are granted
- staff police release ‘Cars behind Bars’ figures -engaging with public around efficiency/effectiveness of ANPR – seized 3500 vehicles
- Dorset release information about a new network – general locations of the network and what they will achieve
Legislative framework
There was an important issue covered in last year’s speech that I think it is topical to revisit. It covers the legality of use. There is an argument that goes something like this: article 8 refers to the qualified privilege regarding interference into a person’s privacy by lawful use. Because there is no law that enables ANPR, does that make the use unlawful?
I am delighted the ICO is also now offering to support the police in relation to this issue if required. Now I have been liaising with the Home Office on this particular point. They inform me that ANPR is just another tool in the policing toolkit and so does not require a statutory authority. So, as long as National ANPR Standards and Procedures (NASP) offers sufficient safeguards to protect against the article 8 right against intrusion into privacy, then any legal challenge is set to fail. Or is it?
The challenge may be more successful if it comes from a perspective of retention. Is it necessary or proportionate to retain the data of innocent citizens for the current retention period of 2 years, if at all? Any work being taken forward to extend the retention period of ANPR data, should be mindful of this point.
An associated point concerns data mining. I have been challenged by an academic as to whether data mining of ANPR is directed surveillance and thus requires a RIPA authorisation.
I have been liaising with the Office of Surveillance Commissioners. They have quoted their views in their 2014 guidance – in summary, “ if there is a systematic trawl through recorded data (sometimes referred to as “data-mining”) of the movements or details of a particular individual with a view to establishing, for example, a lifestyle pattern or relationships, it is processing personal data and therefore capable of being directed surveillance”
The flipside is “The checking of CCTV cameras or databases simply to establish events leading to an incident or crime is not usually directed surveillance”.
The reason why I raise this is to raise awareness of this particular issue. You will note the vagaries in the language – but you should not ignore the steer that general use of surveillance to identify what happened is part of wider policing. Once you start using it to delve deeper into an individual, you might need a RIPA authorisation.
The regulatory landscape can be confusing and it is important that you receive the right knowledge and training in order to fulfill your duties to your citizens.
Governance
I have specified some concerns about transparency of a governance framework – how are decisions made, how are stakeholders involved -this will be my mantra through 2016.
The history of development of ANPR is complex – it grew from an ad-hoc amalgamation of policing initiatives – largely unregulated and lacking any clear vision about future direction.
Responsibility shifting from ACPO and National Police Improvement Agency (NPIA) to National Police Chiefs’ Council (NPCC) supported by a Home Office Support Team. ANPR Working Groups were key in developing standards and informed the Surveillance Camera Code of Practice. Co-ordinated 43 police forces and acts as the hub for a host of law enforcement agencies and end users (DVLA etc). The policy is held by an NPCC lead – Paul Kennedy – with support from a National User Group) do the public understand this? Is it fit for purpose?
Is there scope to draft out the decision making and functionality of this very important area of law enforcement? Argument about necessity and proportionality – underpinned by evidence of civil commentators supporting the approach!
I have been forwarded correspondence from an ‘interested observer who, despite repeated requests was compelled to submit an FOI request asking ‘for records about the governance of the ANPR system’ effectively he wanted; structure of governance committees, membership and papers.
The response from NPCC was - “there is no record which details the structures and governance of the ANPR system”.
Journalists get really annoyed that they can’t access simple data – I think this approach is changing under Paul’s leadership but there is much to do to deliver true, meaning full transparency
My correspondent says and I quote:
“ANPR could be one of the worlds largest non military surveillance systems and probably contains more data about people than the NHS. Governance of such a system is central to its safe operation. Governance should be broadly based, expert, involving lay votives with clear lines of accountability and where possible takes place in public”
I have difficulty arguing with any of that. Overlay this uber system with a desire to increase its retention from 2 years to 7 or 10 and my correspondents arguing comes into even sharper focus.
I also want to touch on collaboration. There are 2 drivers – austerity and effectiveness. There are currently NPCC leads in CCTV, body worn video, drones and ANPR. My question and challenge to you is: would closer working between each strand of surveillance, lead to better outcomes?
More often than not systems are used in the same areas independently of each other, covering the same space, using different networks or fibre and for the same purpose. So, if we’re all doing the same or similar things why aren’t we doing it together? Why aren’t we streamlining, collaborating and learning from one another?
Whilst most of the collaboration I’ve seen is within a region, there is a real opportunity for NPCC leads to make a difference across different types of surveillance. Particularly as modern technology links across the disciplines automatic facial recognition and BWV and so on.
Her Majesty’s Inspectorate of Constabulary (HMIC)
I would also like to mention an exciting development from my point of view. You will all be familiar with HMIC and the peel inspection regime. I have been having conversations with them about including the police use of ANPR within their legitimacy strand. There is more work to be done but it will be exciting to have the tooth of the inspectorate look at the use of ANPR surveillance systems and ensure the processing of personal data is in line with the code.
Finally, a reminder on the key issues in relation to the code – proportionate, transparent and effective use.
Proportionate – have you established a legitimate need for your camera system? Do you undertake an annual review to establish that your camera system meets its stated purpose? Do you know that it meets its stated objective?
Transparent – how much do the public know about the outcomes delivered by your use of ANPR? Do you publish the use of ANPR by crime types in concluded cases?
Effective – are you confident that your system is working as intended? Are your cameras of the required standard? What about your maintenance arrangements? Are your installers versed in managing the mobile arrangements? Are your operators trained and aware of the systems and processes?
One question that has been posed to me is do the general public really understand what ANPR is? When body worn video was introduced in Hampshire, they launched a public awareness campaign that informed members of the public of their use of the cameras.
Whilst ANPR is not a new technology, the way policing uses it has changed. What are you doing/have you done to make people aware of how it is used? I accept that you don’t want to give away the information that helps you to capture criminal gangs to the criminals, but that is not an excuse for doing nothing.
A last word from me – before I overstay my welcome. I still believe that the public must be informed of as much information as possible if trust is to be maintained. For example, why can’t you let the public know how many ANPR cameras there are? It is already public information but it is not readily accessible and should be.
I look forward to working with you to ensure that police use of ANPR continues to be proportionate, effective and transparent.