Privacy Commission Day 5, Witness 3: Christopher Graham

The PM Privacy Commission spoke to the Information Commissioner Christopher Graham on Wednesday June 22, 2011. The commissioners are Sir Michael Lyons, Lord Faulks QC and Baroness Liddell.

Please note the PM programme, BBC Radio 4, must be credited if any part of these transcripts are used.

NB: This transcript was typed from an audio recording. The views expressed by the witness are their own.

Because of the possibility of mis-hearing and the difficulty, in some cases, of identifying individual speakers, the BBC cannot vouch for their accuracy.

ML: Well let me welcome our next witness and that's Christopher Graham the Information Commissioner. Thank you for coming to join us.

CG: Thank you Sir Michael.

ML: Could you just give us a short summary of your role and your involvement in the debate about the balance between freedom of the press and the rights of individual privacy?

CG: Well getting the balance between the right to know and the right to privacy is absolutely what the Information Commissioner does. I've been the Information Commissioner for two years. Before that I was the Director General of the advertising standards authority and before that I was a BBC lifer, do I have to declare an interest? I was a producer on the PM programme, many decades ago. Our job at the Information Commissioners office is as we say to uphold Information rights in the public interest, promoting openness by public bodies and data privacy for individuals. We run the freedom of information Act and the Data Protection Act. Our particular involvement in the controversy about what the media should be publishing - it's a little tangential actually because most of our work is in the much wider sphere of people's personal data, their bank account, their phone account and so on but in 2006 my predecessor Richard Thomas published a couple of reports to parliament called What Price, Privacy which was reporting to parliament which we'd discovered through a raid we did on a private investigator where it was clear that the customers of this individual who specialised in blagging information from databases phone companies I think mainly. The main customer was the press; we discovered that 305 journalists were involved covering 32 titles. 26were national newspapers and the other 6 were magazines. So it's a subject that we're very interested in because the work that we do has to find this balance between freedom of information and data protection, where does the public interest lie. I'll give you an example it's not about the press but it shows how we have to make this judgements. Today, we've ordered the disclosure of the names of public sector employees earning over 150,000 pounds whose salary details haven't been in the public domain up to now because the Cabinet Office respected their wish that that information should remain confidential and at the end of a Freedom of Information process I've come to the conclusion that if you're earning over 150,000 pounds, working for a body that's funded by the public purse then there is a legitimate expectation that your name and salary details will be disclosed. Being open and transparent is an integral part of being accountable to the taxpayer and like it or not this level of disclosure goes with the territory. Now that's an example where the Information Commissioner has had to say - now here is the public's expectation of the right to know, here is the individual's expectation of their privacy, where does the balance lie and it seems to me that those are the decisions that the courts are having to take, about should this story be published, shouldn't this story be published.

ML: Thank you, I think we'll want to go over some of those issues in a little more detail. Let me just deal with the legislation on which you work - Data Protection Act and the Freedom of Information Act. In both of those, they seek to balance the rights of the individual and the freedom of expression of the press.

CG: There are special provisions for the press in the Data Protection Act for example - journalism, literature and the arts. If you can show that you're working for publication and that you had a reasonable belief that what you were doing was in the public interest, then some of the restrictions on some of the data protection about fair processing don't apply so there is special treatment I think for the press and of course the press are major users of the Freedom of Information Act so they are on the side arguing for disclosure and of course are very resistant of any prior restraint.

ML: And how is public interest defined there?

CG: Well it's a balance; it's a sum in the end you've got to see whether the rights of the individual are more or less than the publics, the interest of the public. That's not, I'm sure you've got very bored of people saying it's not the same as what interests the public but somebody's got to make a decision about where the public good is best served. These are very difficult judgements and I'm not surprised that judges sometimes get criticised for making what are subjective judgements and very fine judgements that wouldn't have got to the court if the answer was obvious. So we are in a rather similar business of trying to come to a decision about whether the balance of the public good lies.

ML: One listener responding to earlier PM coverage of the commission suggested that people concerned about press intrusion should more regularly use section 10 of the DPA. Is that true? Is there...protection there that's not fully exploited?

CG: Well, there are, there are, there are, there are protections that enable people to find out what a data controller, what information a data controller has on them but as I say there is a get out clause for the press if they are able to establish that they have a reasonable belief that what they're doing is in the public interest. I think the difficulty for the Information Commissioner is that it's very difficult for us from the outside to establish whether or not there was a reasonable belief if you don't know what the story was or is the story likely to be that's going to be published and we do rather have to wait for organisations like the Press Complaints Commission or the BBC Trust to give a view about whether the journalistic activity fell within the recognized codes - the producers guide of the BBC, the Press Complaints Commission code so we're not the most active and obvious agency to go to. Where I think we can reasonably claim to be very much involved in, in this debate is the very firm action we've taken looking at the sourcing of private information, the obtaining of private individual....of private information. Not from hacking which is a matter for the police and the Regulation of Investigatory Powers Act which I don't have any say over but this very pernicious practice of blagging information. It's all too easy to ring up the doctor's surgery, representing yourself as somebody else and just saying casually over the phone oh it's about those tests and you'll get the result. It's all too easy to get information from rogue employees; it's all too easy to get information from British Telecom I regret to say, or from the Driver and Vehicle Licensing Agency. That's what we discovered in 2005 when we raided the offices of Steve Whittamore and found these 305 journalists who were customers of somebody who would get you any information for a fee. Now that's a breach of section 55 of the Data Protection Act. And we've had an incident very recently in the North West of an employee working for an NHS direct walk in centre whose then partner was working for a claims management company and he persuaded her to pass on the details of anyone who came into the walk in centre with a broken leg and then surprise, surprise you get a call from the claims management agency saying you know can we help you. So I think, we're acting on the supply side, we're not so involved in decisions about publication.

ML: We'll go into the Motorman case in just a moment but let me just ask you a last question about I think you described it as a more passive role. Is that by design or is that by, as a policy decision on your part about where you allocate your resources?

CG: I suppose it's a bit of both, the, the, the design of the legislation make it clear that there are lead authorities for example the lead on hacking is that the police, because it's a criminal offence under the Regulatory and Investigatory Powers Act so they obviously take precedence. Where there's a matter of judgement to be made about which side of the line some editorial practices fall and then we look to the experts to take a decision umm and the press complaints commission and the BBC Trust and whoever are best placed to conduct that sort of enquiry. We've seen it very recently, a long drawn out enquiry, over the authenticity of footage in a Panorama programme now we're not geared to conduct that sort of investigation um and I don't think it's shameful to say that regulators do have to be um I think the phrase is selective to be effective. If you go into battle on every issue that comes up, you don't get very far but if you concentrate on the wins that you can make, you can then make progress in those areas and I don't think it's fair to suggest that the information commissioner hasn't had a lot to say about this issue, I mean we were the first back in 2006 to flag to parliament and to the media community what was going on in terms of blagging information and the unlawful trade in personal data. I can't say that parliament did very much about it and I can't say the press did very much about it either but we decided that that was the route to go and I continued to call for eh a custodial penalty for section 55 offences as a deterrent to something that is a modern scourge of which the red top press are a tiny part. It's about private investigators, it's about witness tampering, jury knobbling, insurance companies, claims management companies, prize mail scams, it's a really nasty business of which, on which I think the tabloid press um dishonourably prays but they're not the whole of the problem.

EF: Yes you've been very helpful about blagging it's obviously a general word to describe all sorts of behaviour which em involves unlawfully obtaining information. Have there been a lot of prosecutions under section 55?

CG: Umm, there've not been as many as there might have been, sometimes it's because the sentence that's available in the Magistrates Court is really nothing to write home about. I mean the legislation at the moment provides for a maximum fine in the Magistrates Court of £5000. The Bury case of the NHS drop in centre attracted a fine of just over a thousand I think and then an additional costs charge, an additional compensation charge didn't amount to very much because the individual involved didn't really have any means. If we can get things into the Crown Court then the fine is unlimited and the T Mobile case where rogue workers were selling customer information to rival companies umm attracted a very significant fine including a confiscation element of about 70,000 pounds for 2 individuals - that was progress. But um it wasn't widely reported, tabloids didn't seem to be interested and one wonders why. Um, I must say in addition to having the deterrent of a custodial penalty available for this pernicious practise would also help us to investigate things and to bring things to court much more quickly if it was a serious arrestable offence. What happens at the moment is my people raid a private investigator but they can't make an arrest, we can't go in with a police man so the private investigator whose livelihood is then at stake is immediately on warning, hires a smart lawyer and you then...I mean T mobile has taken us very nearly two years to get to the sentencing. So there are not as many of these prosecutions as there should be. But also there's not the deterrent affect of knowing there could be a serious penalty, I'm a strong believer of the big stick in the cupboard but at the moment the cupboard is bare. If it was even um a reportable offence so it was on the police national computer that would be better than the situation we've got at the moment. One private investigator who was done in the Magistrates Court, rang us up the next day and said by the way is my name on the PNC, the police national computer and we said well no not really because it's not a reportable offence and he said good! Because we're off to Disneyland tomorrow and I was worried that we might be turned back at the airport. So I could even do with that deterrent which I don't have at, at, at the moment so I know that umm the Ministry of Justice is seized of this, they're talking about umm uh giving advice to the sentencing council who in turn will give advice to the judges. The trouble is, it isn't seen, it's seen as a victimless crime, it's seen like pinching the office stationery or making long distance phone calls at the end of the day from the office phone. A crime against the boss, it isn't a crime against the boss, it's a crime against people's privacy, it's a about your identity, you might be, you might be, your credit card details might be compromised, your identity might be stolen and your most intimate secrets laid bare. I know some of your witnesses have talked about how when they've made hospitals visits or the police has been involved the information has mysteriously got to the tabloids, now that is a breach of the data protection act and that's a section 55 breach that I wish people would take more seriously. So instead of agonising about should this story be published or not why don't we spend more time thinking about the sources of some of these stories that probably aren't in the public interest and have certainly been pulled together through unlawful acts.

EF: I suppose a journalist would say that it's axiomatic in their job that you don't disclose your sources and that umm this is going to make it very difficult to actually trace sometimes where they're getting this information.

CG: Umm, well if we were all better at um observing the Data Protection Act and keeping private information private and data controllers accepting their responsibilities, we've got to cut it off at source. There's always the human factor, people will do silly things, they'll leave a laptop on the bus or something but there is evidence that it's so lucrative this trade that people can very easily be bought. If you were a low paid employee in we'll say the Department of Work and Pensions it'd be very tempting to make a bit more by making available some of the information that crosses your desk and that's what we've got to - that's what we've got to work on. Now occasionally there might be a public interest defence because a journalist is onto a story of such massive significance that nobody is going to turn around and say you indulged in some fairly dodgy practices to get that. The classic case is the Guardian some years ago entrapping em a Minister who denied that he had been in a particular hotel and who was paying it - the Jonathan Aiken case and the Guardian got that story by subterfuge, by sending what they call the cod fax, sending the fax to the hotel get the confirmation of the bill and so on. Now I don't think anyone's wasted a lot of time in saying The Guardian shouldn't have done that, that was an example of the dark arts. Sometimes the dark arts are employed in sort, in searching out and proving a story of undoubted public interest. Where it's more dodgy is where somebody is just for money getting my private medical history say.

EF: Yes, I mean you; you said that it's sometimes a good idea to be selective in areas that you're concentrating on so do you think for example that the obtaining of medical records by claims firms is a good example of where you perhaps might concentrate particularly which would help to expose that and hopefully stop it.

CG: Well you'll be pleased to know that we are. And I can't be, can't be specific because these investigations are ongoing but we've got a couple of projects on at the moment dealing with some private investigators who are dealing in some pretty difficult stuff and we're also exploring what's going on in the insurance industry and the relationship between insurance companies and claims management companies, I can't be more specific than that cause otherwise I will ruin the investigation but we're active all the time on issues like that.

ML: Now we've concentrated quite a lot in our evidence on people who say their privacy has been invaded by the press and that may cover all sorts of areas but sometimes it may include records for example Hugh Grant complained about his medical records and he said the Information Commissioner told me I was hacked and told me he'd come back to me but never did. I don't know whether you're in a position to comment on that.

CG: Well I saw the transcript of his evidence and I think he did say blag, blag and that's something that we would have something to say about it but hacking, as I explained....yes.

(background noise)

CG: Well the way, the way, the way we tackled this back in 2005 and 2006 was to piece together from the evidence we'd got from the Motorman raid what we were dealing with and that certainly did involve talking to a number of people whose names were recognizable from the list. I noticed that in his evidence Hugh Grant said that the Information Commissioner had never come back to him. I just don't know about that because it was way before my time. But what I do know is that the office took the view faced with this mass of material was what we could best do was to make a report to parliament and sound the alarm and that's what we did in What Price Privacy in 2006 and in the 2nd report What Price Privacy Now 6 months later, we named the newspaper titles who had been customers of these people and we identified that there were 305 journalists involved. What we didn't do was to go back to every body who was listed in the files, there were vast number of them and in many cases there wasn't much we could have said to them. We couldn't have said to them we think this is the breach of the Data Protection Act because we didn't know why their names were on the list so I think all we would have been doing was saying you should know your name is on a list but more than that we can't tell you and I do know in one case where an individual was said to be incandescent that he hadn't been told, this came up in a parliamentary committee, I was embarrassed about this and I went to check back, it turned out this was somebody who'd been a minister and his name was on the list, he'd been a cabinet office minister and he thought that it was obvious that the Information Commissioner should have told him that he was listed. When I looked at the details, the request by a newspaper for this MP's home number was over the weekend when he had just resigned from the government and it seemed to me that it would be very easy for a newspaper to establish that there was a public interest in finding the number of the minister and asking why he'd resigned from the government. And I wrote to him and said you're very welcome to come and see the file um but you, I can tell the date in question was the date you resigned from the government didn't hear anything more from him - so just because you're listed on the Motorman file doesn't mean that the journalist was behaving badly in getting that information.

ML: Do you think ordinary members of the public should know more about what you do and would you welcome more contact from ordinary members of the public?

CG: Well we have contact from ordinary members of the public. We're dealing with 30 thousand applications to the Information Commissioner under the Data Protection Act every year and 5 thousand Freedom of Information cases. Um but I think all regulators need to be better known and better understood and people need to understand the routes to access their information rights whether its going straight to a bank, building society or whatever and saying what have you got on me? Or complaining to the Information Commissioner when you think something's gone wrong. We've got a very good website, we've got a very good customer helpline which is very widely used I'm sure we could improve one area where I think we ought to improve and I'm taking initiative with colleagues is to get better co-ordination between the various commissioners working in the privacy area so that we've got a surveillance commissioner and a CCTV commissioner and a interception of communications commissioner and at least we ought to have proper memorandums of understanding so people know where to go for what and that's something I'm working on. But I hope that what the Information Commissioner can do is reasonably clear from the website and certainly the traffic that we get and the contact that we get suggests that people are using our services.

ML: Can I just get back to your recommendation that there should be criminal sanctions supporting the Data Protection Act. Following the 2006 reports and the Motorman investigations are you satisfied that Parliament has taken them seriously enough?

CG: Well Parliament hasn't done anything. There is, there is a suspended provision in one of the acts of parliament dealing with criminal justice and ministers could at the stroke of a pen introduce the criminal sanction, that the - just an order making power and I think they didn't do it because there was tremendous hue and cry from the tabloid press that we were wanting to jail journalists and this would be an attack on investigative journalism and have a chilling effect and I mean this is just complete nonsense because the press would be able to make a public interest case and I'm not interested in jailing journalists, I've been a journalist myself as I said earlier. But I do want to stop the nasty side of private information, very often very sensitive private information going missing. It's not all going in the direction of the tabloids. A fair amount of it does but I, I don't want to see vulnerable old people for example who are the victims of prize mail scams, if I can do anything to stop that nasty trade and very often this sort of activity helps build lists which is then sold for mailings to people over a particular age and so on. I want to get some impact in that area and I'm frustrated by the tabloid press saying oh this is terrible, terrible oh you're trying to jail journalists and close us down. I'm absolutely not; there must be a way through this. We must be able to have strong investigative journalism, a free press, a press that operates decently which operates decently with good codes of practise. I'm a strong supporter of self regulation but we can have that and have effective action against people who are selling patient information from doctors' surgeries. It seems to me there's a false dichotomy and the resistance - and politicians are notoriously frightened by the media in full cry - it's a great shame that politicians have backed away from this. I know, this government hasn't until very recently been a fan of custodial sentences so I wasn't pushing cause I thought this isn't flavour of the month but perhaps it is flavour of the month again now in view of what we've heard. Certainly my view, the view of the Information Commissioner is that there should be a custodial penalty for section 55 offences but short of that there's quite a lot that can be done and I believe is being done by the Ministry of Justice to raise the profile of the crime and to encourage the confiscation orders under the Proceeds of Crime Act. We've really got to tackle this and the tabloid end of it is only a small part of it.

ML: And the more recent discussion about phone hacking, have you had - although that's primarily the responsibility of the police. Have you had some involvement in that?

CG: Only tangentially, it is a police matter. Sometimes, it's just that I'm called before a parliamentary committee and asked what I'm doing about it and I say look this is really a police matter and it's the Regulation of Investigatory Powers Act. I've had to do that several times to get the point across but even though the police are now investigating Operation Weeting and so on, we've been very co-operative, made available the Motorman files of that investigation. The Motorman files are being drawn on by various other celebs who've been suing News International. Where there's a court order instructing me to make that information available, I do. I am myself subject to some fairly scary restrictions under Data Protection Act; I can't just scatter this stuff around. Information that comes my way in the course of my investigations is itself protected under the Data Protection Act so we are, we're on board but we're not major players in the hacking issue.

ML: Can I just take us tangentially onto regulation of the press. Do you have a relationship with the PCC, the press complaints commission?

CG: I've uh, I've been to see them. We've, I've compared notes when we've both been going before parliamentary committees. Certainly there was a lot of contact after the publication of What Price Privacy and there was some changes made to the editors' code as a result of that. I'm, I am a strong supporter of self regulation as you'd expect the former secretary of the BBC governors and as a former director general of the Advertising Standards Authority I believe in effective self regulation and it's a question of how that's organised. Drawing on my experience from the Advertising Standards Authority I think what makes the Advertising Standards Authority effective and I think that people these days do accept that it is effective is because although the rules are drawn up by the committee of advertising practise, the advertisers, the agencies and the media; the adjudication is by the Advertising Standards Authority council which is two thirds independent. You don't have the equivalent of the big beasts of the newspaper world sitting on the adjudicatory body but the industry absolutely signs up to the code that they devise and I think that's what is necessary with self regulation to win public confidence. If the public feels that self regulation is just a cosy arrangement by practitioners, it's never been credible; it hasn't been credible with the doctors or the lawyers and the press has been on warning for a long time that they're drinking in the last chance saloon and the Press Complaints Commission was very much structured on the old Advertising Standards Authority but perhaps some of the changes that were made at the Advertising Standards Authority to separate out rule making from adjudication haven't been replicated at the PCC. But, it's not something I know an awful lot about and I know that there's been a constitutional review. The chairman Lady Buscombe is somebody who I know well and have worked with and she's, she's absolutely excellent and they've made some very strong appointments so I think there are things happening but I think its wake up time for the editors and the proprietors. If they want to hang onto self regulation they've got to give the PCC the space to do what the PCC can do otherwise the public will not be convinced.

EF: I mean just looking at the breadth of your career it seems appropriate to ask you the question that of course broadcasters, including the BBC are subject to external regulation particularly on harm and offence.

CG: You've got OfCom and you've got the BBC Trust which is a slightly different relationship to the programme makers than the old governors had and certainly in my day as a BBC journalist, the producers' guidelines were the bible. And your editor made sure that you followed the producers' guidelines and if you didn't you then were in trouble were the controller of editorial policy or the managing director or you had the complaints unit crawling all over you so we just understood that you worked within the context of rules.

EF: So internal governance is as important as regulation.

CG: Well yes because having the right culture in a newsroom and the lead from the top, we want scoops but they've got to be bomb proof, they've got to be lawyer proof and they've got to be regulator proof was just the way we operated. We've got to get back to that. There's obviously been a fair amount of cowboy activity and the public won't, won't tolerate that.

ML: Thank you very much Christopher, I think we've come to the end of our questions. Is there anything that you'd believe that we should have covered with you that we haven't touched upon?

CG: Well I don't know whether you should have covered it, but I would just offer a view I mean I observed the debate about privacy law and it seems to me that the people that are arguing for a privacy law always want a privacy law that suits them. It's either going to be Max Moseley or Zac Goldsmith wanting a privacy law which emphasises article 8: the right to be left alone and respect for family life in the European Convention of Human Rights. And then if you're a tabloid editor you emphasise Article 10 which is the right to free, freedom of expression. However the law is framed, somebody's got to decide what the balance is between those two dimensions. And if you create a new privacy law and you create a Privacy Commissioner and please don't send it my way, you're going to have exactly the same choices that the judges are having to make at the moment. These things are difficult because the choices are, by their nature, difficult and each situation will demand a slightly different judgement. We can't magic this all away by saying oh well if only we had a different law and a special commission and a tribunal it will be easy. It'll never be easy, there's always going to be a tension between the right to privacy and the right to know.

ML: Well thank you very much; I'm going to take that as a sort of closing statement very helpfully winds things up for us, thank you for joining us.