Population Register - Data Protection Commissioner - Transcript - 20 December 2007

STATES OF JERSEY

Corporate Services Migration Policy Sub-Panel (Population Register)

THURSDAY, 20th DECEMBER 2007

Panel:

Deputy P.J.D. Ryan of St. Helier (Chairman) Deputy G.P. Southern of St. Helier

Deputy C.H. Egré of St. Peter

Deputy J.A. Martin of St. Helier

Mr. P. Boden (Adviser)

Witnesses:

Ms. E. Martins, Data Protection Commissioner

Deputy P.J.D. Ryan of St. Helier (Chairman):

So good morning to the Data Protection Commissioner, Ms. Martins.

Ms. E. Martins: Good morning.

Deputy P.J.D. Ryan:

I do not think I need to read you out the standard form of because we have been through this before, have we not? I think you are familiar -- have you met Peter Boden before?

Ms. E. Martins:

Hi, no, I do not think we have met before. Hi, nice to meet you.

Deputy P.J.D. Ryan:

And I think you are familiar with everybody?

Ms. E. Martins: Yes.

Deputy P.J.D. Ryan:

So we have just had a long and very detailed question session with the Migration Board. They did not

exactly answer yes or no to whether they were happy with they were confident now that they had addressed all of the concerns that you originally had with their proposals so I need to ask you the same questions. Have your original concerns regarding the verification of identity when registering been addressed sufficiently by the Migration Advisory Board?

Ms. E. Martins:

Well, firstly, if I can be so bold, I would like to firstly thank you for the opportunity of speaking today. I think one of the most important things from my perspective is that the full range of benefits and risks are clearly articulated and debated. That is not to say that I am for or against, or it is right or it is wrong, but it is to ensure that we establish what the objective is and only then can we really assess the benefits of both an individual and a collective level and establish whether they are balanced properly against the risks, so to move to your first question. I think the point is that there are rules that must apply if these projects go ahead. It is not a question of the law does not prohibit this sort of data collection but it means that there are very clear rules, such as security, must apply and those are enshrined in the Data Protection Law. I think it is too early in terms of the actual document to say it has absolutely been addressed, because there are a number of issues that it talks about committing to security, for example. I can go on to that later on. Exactly how they do that is going to be important, so if they do it properly, the answer is they are going to comply with the law. If they do not do it properly, then the answer is they will not comply with the law, so we are early days but I welcome the input that I have been allowed to have in the process up to now and I am grateful to the officers for allowing that input and for taking a lot of comments I have given to them on board. In terms of your first question; the original concerns regarding the verification of identity when registering. The passports, as I understand, are going to be what they call the gold standard of identity verification, and I think there are some allowances made in cases where individuals do not have passports and that is something, I think, to be discussed. I am not sure if that has been clarified exactly but things like utility bills and so forth I imagine is what they are going to use. I note on page 10 of the consultation - I am not sure I have got the same page numbers - but A2, second page, it says: "It is important to note that the new card is not intended to be used as an identity card. It is intended to demonstrate social security, housing, employment status only. It will not be used to manage access to any other public service or entry into the Island." So the point there is that it cannot do anything much, unlike the proposals I think originally where it would allow you to access or -- I think it is purely, as far as I can tell, an ability to demonstrate your Social Security number or your residential status. So it cannot do anything else other than that. So in terms of verification standards, I think that is acceptable now.

Deputy G.P. Southern of St. Helier :

Can I follow on from that? In terms of the passport and absence of a passport, they are talking somewhere between one per cent of the population which, is around 800 to 8,000 people, who may not have a form of identity with a picture on, so that represents perhaps a significant number of people who

typically find it hard to open a bank account because bank managers in particular

Ms. E. Martins:

Well, I think the question to put to them: "What standards will you expect in the absence of a passport?" Now, that has to apply already in departments that have a statutory basis for the collection such as social security or tax. They have to have some standards so the question can be for them. I do not know what they are. Those departments or M.A.G. (Migration Advisory Group) presumably will know what those standards already are and it makes sense to say are those standards working in establishing identity? If they are, we can take those standards on board and if they are not working, why are they not working and what can we do to make sure that they do? I think it is a question for the project rather than for me, but I think the point is that the less power the card has to access or to enable, the less the verification question is important. The more the card can do, both for good and for harm for the individual, the higher the level of verification would be expected.

Deputy G.P. Southern :

Absolutely. And can I also take you on to this whole issue of the index versus the register, 2 different things. It seems to me that that is the way in which they have tried to accommodate in many of your objections in terms of who is going to use it, who is going to access it. It seemed to me from what we heard in the previous session that while the card is not a form of identity, it does, nevertheless, enable 2 very significant transactions to take place, one where you live and, secondly, to access work and therefore will effectively be used as the significant key to open those doors. Also that there seems to be this establishment of an index which is a thin database, not a register. Now, you just read out a statement there that said that we will only do these and establish where you live and where you work, it will not be used for anything else. Yet, on the register, there will be the provision for any number of departments or bodies to have access to that register. Again, in terms of the who has access to individuals' data? Again, does that look like it is going to need this fundamental issue around data?

Ms. E. Martins:

Well, I think one important point here is not to merge those 2 quite separate databases because, as far as I can see, we have a central government database with names and addresses, a very thin set of data. On the periphery of that, almost as a client of, we have States departments. Now, one of those States departments will be the Population Office acting as they do now with their statutory basis, another will be Income Tax, another will be our department. States departments around the edge accessing and using the names register and address register so that is how it should work. To look at the data the Population Office are using on their own specific database confuses the matter somewhat, I think, because the issue is a centralised government database with names and addresses for the purposes of better government services, is what is said in here, and better statistical information on population. That is what I am gathering from the document. On the outside of that are clients, if you like, such as Population Office,

who will populate the database as they already have, as they do now, as will every other department. The concern I had very originally years ago was that the central database had all sorts of other bits of data in it so that we have a centralised model, other departments accessing, so if you have things like health data or education data, that suddenly opens up but potentially opens up the security and privacy angle. But to have a very thin set in the centre does go a long way to address the privacy concerns of a centralised database with all sorts of other data behind it.

Mr. P. Boden:

Just for clarification, do they physically exist in different locations then?

Ms. E. Martins:

I am assuming so. I do not have the answer to that.

Mr. P. Boden: Index and register?

Ms. E. Martins:

I would not like to pre-empt an answer from the I.S.D. (Information Services Department) or the Project Board but, conceptually, I see it as 2 quite distinct databases.

Mr. P. Boden: Yes.

Deputy G.P. Southern :

So the thin database and initially the Population Office has the first body that has access to the thin database for its purpose which is registration as employed.

Ms. E. Martins: Yes.

Deputy G.P. Southern :

The 3 categories of employment?

Ms. E. Martins:

Yes, so I think you could take out the index as a product in its own right to say we are setting up a names and address database of all citizens, and the progress in terms of the Population Office and their move towards better migration control is quite separate. They have been brought forward together but

Deputy C.H. Egré of St. Peter :

So in simple terms for me, what has been described is the central index, a blob, right, which can be pulled into other databases as the foundation function on which they build their own information?

Ms. E. Martins:

The technical -- how technically that works, I am not sure it is sucked into their database. I think they just use it to

Deputy G.P. Southern : No, it is separate.

Ms. E. Martins:

Yes, conceptually, that is correct. I think the individual department will not then hold name and address data. They will just link into the centre to make sure there is only one Emma Martins of St. Ouen address, whatever exists rather than a duplication, and the accuracy of that address can be better managed in that central location. But that is the way I see it, is locking in from the edges, the peripheries, other departments, as and when they are approved by regulation.

Deputy G.P. Southern :

And they are approved by regulation which comes before the States so Social Security say we want access to this thin database for the following reasons in order that we can do X.

Ms. E. Martins: Yes.

Deputy G.P. Southern :

The Tax Department says: "And we want access to the thin database, the name and address, in order that we can do Y" and in that way there is no reason why Social Security necessarily and Income Tax are sharing the same information apart from the name

Ms. E. Martins:

Basic name and address. Absolutely crucial, that is one of the really most fundamental points that I was making some years back; that the access has got to be on a statutory basis by department and they cannot be allowed -- there can be no risk of data sharing between departments unless they are a statutory authority for that sharing, and this model works with that.

Deputy C.H. Egré

There must not be any cross-down pollution?

Ms. E. Martins:

Well, there may be a statutory basis for a certain amount of sharing in the future. I know there is a project underway at the minute or a working group looking at data sharing, I do not know how far down the road they are with it, but there may be a legitimate statutory power for departments to talk to each other. It makes sense. There may be cases when it is not appropriate and that should be enshrined in law and therefore subject to proper public debate.

Mr. P. Boden:

The starting point for the creation of the register using existing databases, that is one big data sharing exercise, is it?

Ms. E. Martins:

Register, you say register. We have got to be clear here.

Mr. P. Boden: Index, sorry.

Ms. E. Martins: Index.

Mr. P. Boden:

Index, that is a big data sharing exercise in that it is bringing different databases together.

Ms. E. Martins:

Yes, I do not know whether you want to jump down to that question here because that is a specific question with which I have

Deputy P.J.D. Ryan:

Question number 3, yes, we can. We finished with the first one, will we move to that one?

Deputy C.H. Egré:

Well, one is flowing naturally into the other is it not, now?

Deputy G.P. Southern :

Yes, I think that this concept of a thin names and address register with a gatekeeper that everybody has to get past with sanction in order to perform a particular function is one thing yes, and if that is the

way forward, then that seems to fit, yes.

Ms. E. Martins:

That is certainly what I read from this.

Mr. P. Boden:

But then I think there is an issue where though conceptually it is a different -- or physically different, I think, from the physical

Ms. E. Martins:

Technically how you work that, you know, I am not a technical expert in I.T. so the structure is a technical question nonetheless they have to ensure the data has to be sitting distinctly separate and access rights and all sorts of things have to be in place, so technically that is all possible. How they go about that I am afraid it is not for me to

Deputy P.J.D. Ryan:

Okay, well, let us move to your views on the proposal to populate the database through the use of existing data.

Ms. E. Martins:

Yes, I have made a couple of notes here. So notwithstanding the proposed statutory basis - because there will be a statutory basis in the primary law for such data use - data sharing or using existing data for the purposes of the index, not the register, may create fairness implications if citizens were not made aware of the subsequent use of that data when they first provided that information, and it is very unlikely that anyone would have had any idea when they were providing their information to Social Security or to Tax or to whoever, that that information would subsequently be used for this purpose. So the statutory basis is an important point because there will be a statutory basis for this in the primary law if it goes through, but citizens should nonetheless be fully informed at the earliest opportunity of the subsequent use of their information and, again, we are talking about a very thin set of information so that the dangers are, in my view, minimised in that sense. But nonetheless, we are re-using citizen data.

Deputy C.H. Egré

It was a point that we covered in the previous conversations. Within the exemptions that are allocated within the Data Protection Law, law enforcement agencies, will they be able to access that information under that exemption?

Ms. E. Martins:

Well, the Data Protection Law could never compel disclosure. It will allow the organisation being asked

for information by law enforcement agencies to disclose in the protection of the law. They will not be subject to enforcement for breaking the law if they disclose to a police officer or to an enforcement agency. So it cannot compel, but bear in mind that police will probably get a court order anyway. The request by law enforcement agencies is relevant and one of the statements I have on here (the consultation document) is that it will not be used for any other purpose such as law enforcement, but I cannot believe that will be the case.

Deputy P.J.D. Ryan: No, I cannot either.

Ms. E. Martins:

Because I think the police will consider access desirable I can imagine situations where they will want to have access to it, so I think it is again a question for them, if they can see themselves ever, you know

Deputy C.H. Egré:

Because there is a tendency to say, well, that is a data protection issue. From what I

Ms. E. Martins:

But the law would allow disclosure.

Deputy C.H. Egré:

The law would allow disclosure to a law enforcement agency?

Ms. E. Martins: Absolutely.

Deputy C.H. Egré: Right.

Deputy G.P. Southern :

I would like to stay with the general principle rather than the specific. Let us go to the law, as you say, the data is protected in the sense that in the normal course of things, if they really want this information, they would go to court to get it so that protection is built in there. They have got to justify it and in that particular case

Deputy C.H. Egré:

Do they have to go to court? I do not believe it

Ms. E. Martins:

Only if the organisation does not want to disclose data being requested but in my experience in many years of doing this job, that has happened a handful of times. Most of the organisations are co-operative to law enforcement agencies.

Deputy G.P. Southern :

Which then brings us to the central question, the principle of who is getting access to it, and that principle that data collected for one purpose should not be used for another. Now, in collecting what I am calling "dirty data", collected for one purpose, is there not a principle that is being driven through that you should not use that, that has been given years ago for one purpose for another purpose?

Ms. E. Martins: Yes, there is.

Deputy G.P. Southern :

I mean, we are breaking that principle.

Ms. E. Martins:

With a statutory basis, you would not be. By putting this in law, you would be dealing with that. Nonetheless, that is why I talk about raising fairness implications because you -- the law talks about being fair and being lawful so you have your lawful issue addressed by putting it into final law. Your fairness issue is about informing people at whatever stage, whatever data you are collecting, whatever you are using it for, they must be informed of who you are and what you intend to do, so that would have to be addressed by the States. But we do have a principle that can only be addressed by the public debate in that, is the law acceptable that allows for what is called a purpose leap when data collected for one purpose is subsequently used for another. Now, we should not forget the fact that we are not dealing with anything other than name and address here. We are not dealing with my Social Security payments or my medical information so that again does diminish those risks quite substantially, that the information is not sensitive data but nonetheless it is data collected by one States department under a statutory basis subsequently being used for another.

Deputy G.P. Southern :

That takes us on, if I may, to the question of the means of populating the database in the first place. In an ideal world, you would populate it from scratch with fresh, clean data. The reality is, what is being proposed, is they are going to populate with -- by merging some very messy data from all sorts of sources, from several sources I would say, in order to create the new database and hopefully somewhere in that process that a reasonably reliable and accurate database emerges over time. Can you just comment on the difference between clean and non-clean data?

Ms. E. Martins:

Well, it is no secret and the project group are well aware of my view on this it has never been a secret to them that I would prefer a clean database because of accuracy and because of the purpose leap issue that I have already touched upon. Certainly my concern would be inheriting inaccurate data, data that is completely out of date or just wrong or excessive for the purposes. If you look at the databases that they stated they intend to use, the Health database, Housing, Tax and Population Office, we have some assurances in here that only the thin set of data will be extracted. Now, again, I am not a technical expert but if you are looking at a Health database, to access that and extract data from that, I need to be absolutely sure that when they are taking out Emma Martins details, name, address, they are not looking at my medical details because it will be attached to that database. So, again, that is a technical question. I am sure it can be done but we need absolute cast-iron guarantees from the I.T., the guy I have seen leaving and his team, that when they extract data, especially when it involves databases that do contain sensitive personal data such as medical records, Housing again will be processing a lot of sensitive data about individuals, about their circumstances, their financial situation, their medical situation and so forth. It is absolutely essential that only the thin set; name, address, date of birth, place of birth, is extracted. If you have a team of temporary staff coming to do this work for them, they are not rummaging through the citizens of Jersey's medical information or housing information. That is important. I am sure that, again, technically, that can be done. On page 13 - as I said, I am sorry if I do not have the same page numbers as you - but it is B5, where it does talk in more detail about the discussions they have had about whether to start with a clean database or use existing data. It talks of an expert technical advice from the States Information Services and certainly that is a document, if such a document exists, that I would like to see. I think it would be helpful for everyone to see, just to look at the cost benefit of looking at the 2 options basically because while I appreciate it will be a cost benefit decision for the States - these things always have to be and I am not oblivious to that - it is so important to see discussions of cost when you are looking at cost benefit as not simply relating to money. It relates to individuals' rights, it relates to individuals' protections, so we have to expand that discussion in our minds on cost; how does that potentially impinge on citizens as well as just costing the States money? It is a question of the whole that needs to be looked at in that way.

Mr. P. Boden:

Can I just ask a question about the validation process because there will be an element of subjectivity in assessing what is a correct record if you are bringing together these 4 different databases.

Ms. E. Martins: Absolutely, yes.

Somebody has got to make ultimately -- it may only be for a small percentage of the records but somebody has got to make a subjective judgment to say, well, that is the correct record.

Ms. E. Martins: Yes.

Mr. P. Boden:

That is one observation. Also in bringing these 4 or 5 databases together, effectively what that is trying to do is not just create an index but it is trying to produce a definitive index for all of those databases, is it not?

Ms. E. Martins:

It could do. Depends how they do it. If they purely extract this set of data, if they leave the database that is there in Health as it is, run a report to extract just names and addresses and process that separately here, it does not affect at all that database.

Mr. P. Boden:

Okay, but then if you take it forward. One of the key elements here is improvements in public services and improvements in public services is all about having the most accurate database available for Health, Tax, et cetera. Then the accuracy of the index needs to really feed into those other government databases in order to ensure

Ms. E. Martins:

Well, they will be applied on the basis that we talked about before.

Mr. P. Boden: Yes.

Ms. E. Martins:

They will be a client on the outside once they have gone through the regulation.

Mr. P. Boden:

So the ideal scenario is that every database, income tax, the register, health, is all

Ms. E. Martins:

I have a unique number.

Is all being managed on the same individuals.

Ms. E. Martins:

Absolutely but I have a unique number so I do not -- the hospital do not have a name and address for me. They just have a unique number which ties into the centre which links me to that -- links that number to that name and to that address so they do not have to manage the address details in the periphery at States department level. But, yes, I think that is the long-term in terms of efficiency, certainly.

Mr. P. Boden:

We were just talking before about the Social Security database, for example, has between 300,000 and 400,000 individual records sitting within it.

Ms. E. Martins:

That highlights the concern I have that you are talking about people that have passed away, people that have left the Island, people that have changed name. The verification process, it is again a very technical question, how are they going to do it and how is it going to be done properly.

Mr. P. Boden:

I just think that there is once the register is up and running, once the index is up and running, people are going to be asking: "Well, what is our population? You have got the index, you have got the register, tell me what the resident population of the Island is at this point in time." It is going to be quite difficult to get to that point by doing all this merging process, whereas if you go for an exercise whereby you are doing it gradually, then people cannot necessarily expect an answer to that question immediately because the process is a gradual process whereby it is -- we are taking new data into the register and it will not be until 2014 until we have got a definitive population.

Ms. E. Martins: Yes, exactly.

Mr. P. Boden:

The guys who are doing this work will be under pressure, I think, to give a number: "You tell me what the population of the Island is now because you have been merging all these data sets together."

Ms. E. Martins: Yes.

Deputy G.P. Southern :

Which then links to the main argument about the migration debate which is at issue.

Deputy P.J.D. Ryan:

What is the question of the Commissioner again?

Ms. E. Martins:

The accuracy is a requirement of the Data Protection Law, accuracy of data, so they will have to demonstrate and explain how they are going to achieve that.

Deputy G.P. Southern :

Now, when we were talking earlier, we were talking about you said 70 per cent, what are you expecting in your trawl through this. The technical person was talking about 30 or 40 per cent so we are talking about something that is initially going to require a lot of verification, in that if you only get 60 per cent clear answers out of your first trawl, somehow you are going to have to go out and say: "We think you are this person. Are you? Can you prove it?" The question is, again - I am coming to it. It is okay. Clear logic. The question is, it comes back to your cost benefit. If you are going to have to get people to physically come in, in a substantial number of cases, why do you not do the exercise and do it from scratch, which is a better way of doing it in the first place? Is the cost benefit, just in terms of monetary benefits, worth the candle to do it this way as they are proposing?

Ms. E. Martins:

I think that document, the technical advice, would help, because I do appreciate that this is also about money, and about efficiency of government spending. But nonetheless I think it should be a wider question, as you rightly say.

Deputy J.A. Martin of St. Helier :

We have seen the technical advice, and I asked them the question. Their expert information said that they would do it. If they did clean data it would be on a census basis where people were employed to go out to the population, instead of bringing people in, which I said that I did not know how they had come up with that. Then I could see that would be very costly, but also very messy, you know. Are you in? Are you out? How many times do you have to call? So, they did say they would think about that again. That was that information. They say newcomers will obviously be registering. But my question is, if you do not move or you do not change your address between now and 2014, which I would say would be probably a lot of indigenous population of over 50 who will not change their address or move, they will still have to have that verification. You know, a big splurge at the end. So, I would say that if they can do it from the beginning, in stages as our adviser said, I think it would be cleaner and better for data protection that it would probably be a recommendation. I do not think they have done a proper cost benefit of bringing people in over the next 2 years. They have talked about going out to people, and I

think that is a question that we cannot put to you, but we need them to do a proper cost benefit.

Ms. E. Martins:

I think, all I would say in very strong terms, is that I would like that discussion to be had. You need to have all that information to hand to make that decision, because the law does not prohibit the reuse of that data, if you have got a statutory basis. So, I would say that. But my recommendation - and it is no more than that - is that really proper consideration be given to a clean database. It would be my preferred option, and I think it is important that you have a debate with all the information to hand, and the cost benefit, including the rights issue.

Deputy C.H. Egré:

You have been very close to this as it has been developed - a bit closer than we have. What is your confidence level at the moment as to the quality of the data that you perceive will be available to us when we start this process?

Ms. E. Martins:

When we start this process, as in when the database is up and running?

Deputy C.H. Egré: Yes.

Ms. E. Martins:

The quality? Well, I am afraid I do not think I can answer that, because it would very much depend on how the extraction process was managed.

Deputy C.H. Egré:

I mean, the point I want to make, with the information that you have to date, how confident are you that at the end of the day, the data would be robust enough to do the job that we are asking it to do?

Ms. E. Martins:

Well, if it is done properly, and there are so many ifs here that I hesitate for a reason - because if the extraction is not done properly, if the verification is not done properly, we have got, how many, 300,000, records at Soc. Sec.? If that is weeded properly, it can be great. It could be perfect. If it is not, it will be disastrous.

Deputy C.H. Egré:

There are many ifs still to be ...

Ms. E. Martins:

There are too many ifs. I mean, I see commitment there at the I.T. level and the officer level, to get this right. So, I cannot

Deputy C.H. Egré:

Commitment is one thing. Direction is another. What direction have you seen that is to put these problems that you perceive are there, right?

Ms. E. Martins:

I have had very little to do with the I.T. questions, which are very, very significant and should not be underestimated. I saw Mr. Wells leaving, and the input that he and his I.T. team have in this is absolutely fundamental, because we are talking here, exactly what you said about the thousands and thousands of records. How that is done, in practical terms, is crucial here. If that is done properly the end result could be 89 whatever thousand people on this database, because if the system has worked you end up with a very accurate database. If it is done badly you could end up with 150,000.

Deputy P.J.D. Ryan:

Sorry. What do you mean by potential collateral impact?

Ms. E. Martins:

We are going on to using unique identifiers?

Deputy P.J.D. Ryan:

Well, using the Social Security number should not be underestimated was your statement, as I recall.

Ms. E. Martins:

Yes. That was also in the context of a heavier central database as well. So, my comments need to be looked at in that respect. Nonetheless, there are dangers in using a single, lifelong identifying number, which will inevitably be widely known. It probably already is widely known by individuals. It risks giving others the ability to access other people's information, or impersonate him or her, or update the records of him or her. Certainly, I have got a quote here from U.S.A. Today (newspaper) Stay in the U.S. the social security number is used commonly throughout, and it says here: "That experts on identity theft say a social security number is a key ingredient in an epidemic of fraud across the nation, and any form combining it with a driver's licence number, another key ingredient, is a potentially risky business practice." So, I think, again, the law does not prohibit this use, but my concern is that (a) the purpose loop: that Social Security number was created for a reason; that reason was set in statute; that is now going to be used for another reason. Secondly, what can somebody do with that number if they get hold of it, because it is a relatively well-known number? What can I realistically do? Now, the answer may be absolutely nothing, because we have secure systems in place, we have the processes in place. But those questions need to be asked, nonetheless. So, that is my concern about the

Deputy P.J.D. Ryan:

What would the alternative to that be?

Ms. E. Martins:

A number purely relating to the database, that meant nothing.

Deputy P.J.D. Ryan:

So, something that would be held in a magnetic strip or barcode?

Deputy G.P. Southern :

No. I do not think that is it. No. It is just a number.

Ms. E. Martins:

Yes. It does not relate to any other department.

Deputy G.P. Southern :

How it is technically an encoder. Done. It does not matter. But a number. Again, it comes back to the fresh data: it is a fresh number, used for the purpose of that particular card, not the old Social Security number. So, there are 2 things. It is ongoing, and perhaps it is the question I was posing before. What happens currently: you lose your social security card, you just wander in and you can get it, just like that. Right. So, that number is now going to be used for this purpose; access to housing, access to job. Now, if it was loose that compounds the ongoing problem of what happens if, for any reason, we have 2 cards with the same number on them? So, there is an ongoing problem. How do you make that secure? But also, given that you are using old numbers which were sloppy, how do you make that secure? The answer is very difficult.

Ms. E. Martins:

They have sought to address that by saying that they do not intend it to be used as an identity card, however you define an identity card. I do not know how you define an identity card. But it is a card of some sort, and you identify somebody. But nonetheless, it is clear that they do not want it to be used to access or to manage somebody's details. So, that helps lock that down. So, they have addressed that. But nonetheless, by using a number that relates to your specific departmental database, there are risks there, and they need to be discussed. They need to be looked at, and they need to be mitigated if they are going to use that. Again, I would prefer it not to be used, but the law will not prohibit it.

Mr. P. Boden:

Will it not be a form of identification? Because it is going to be: "There is your card and there is your passport." So, when you are making a transaction at some point you have got to provide both of those, so those 2 things working in combination are a form of identification.

Ms. E. Martins:

Absolutely. I am not sure the public will not maybe expect that. I mean, it will be interesting from this exercise what the public's feelings are on this. Would they prefer an all-singing all-dancing, with biometric? This is the point of the consultation, because you end up with a card. Do people want that, do they not want it? I am certain, from some of the comments we have had, is that we would quite like something to use at the airport. Can we use it at the airport, can we not? I do not have the answers to that, but I am not here to dictate to the public what they should and should not want out of this, I am here just to say: "Let us engage in the debate." Let us get as many of the public engaged in this debate as we possibly can, because ultimately it is going to affect them and all of us.

Deputy G.P. Southern :

Effectively, that Social Security number is some health card. I go into the pharmacist, he does not expect to see my passport, but he certainly expects to see my number. Bingo, and I am on the thing. That is the way it works. It certainly already accesses other services.

Ms. E. Martins:

That is the question of the function creep later on which I will talk about, but what the card will end up being used for, even though at the minute it is pretty benign, the concerns are how it escalates in the future, or how the systems change.

Deputy G.P. Southern :

No matter how often you say: "It is not an identity card", as far as a transaction is concerned, of course it will be an identity card. That does it: "Yes, there is your card. Okay, you can have that room."

Deputy C.H. Egré:

It is an access card. It gives you access to something, so therefore

Ms. E. Martins:

I do agree with that. My view is it is some form of identity card. It is all very subjective how one defines identity card. Anything that has my name on it and is used in some way with interaction with government is, in my view, an identity card. Again, the question is: "What can I do with it? What information is it holding?" It is holding minimal information, and I am very happy with that. I did not want a card with lots of private information, or a chip with lots of private information on that. It will allow access, I think, to the central database which, again, is a very thin set. So, I do not want to set the hares running on that, because we are not dealing with the ability, if I find a card I can just go in and have a look at someone's medical records.

Deputy C.H. Egré:

In effect it is a key that you are giving to somebody that will unlock other databases?

Ms. E. Martins:

I do not think so. But that may be a question better put to the officers on this one. But as far as I am aware I do not think

Deputy G.P. Southern :

I think we have got to go back to the original statement. Here is the thin database that every people have, for particular reasons, access to. It is not multiple databases. In that sense it is a central thing. We are the gatekeeper.

Deputy C.H. Egré:

I think we are all concerned that we can see as a natural result of this, a function key. The reason why I used the key scenario was that, if you are going to go to a health agency, and they want your unique identifier, that will be the key that they will use to get into their database, because it will be the entry point.

Ms. E. Martins:

I think what the paper said, it is just to prove that you have residential status. It is to prove that you have a number. So, the objective seems to be just like the card is used now and not much more than that. But I think the potential, and one of my other issues that I have had, if I may I will say it now, that in the original consultation response, I did say: "While the Registrar acknowledges that the States may only permit use of the registration cards for benign purposes, there remains the possibility that over time, and as a result of increasing political or administrative pressure or indeed financial, to make full use of an expensive infrastructure, further uses for the card and the register may be identified and subsequently added, thus increasing the scope for access to individuals' personal data." I think that applies now. We should not restrict consideration of data protection implications to those immediately arising from this proposal. The initial scheme could very easily be extended, albeit by law. But it is something we have to consider now, I think. In particular, the inclusion of additional information and advancing technologies, things will become easier and cheaper to do. So, I think we need to consider that when we are establishing the safeguards that are in place for this particular proposal, the potential in the future, and be clear about that and be clear about the risks and try and avoid that function creep, and one of those concerns in that way is the use of the card, and how that will morph in the future, or could morph.

Deputy P.J.D. Ryan:

I was going to ask the question - you have probably answered it - is there anything in the law that you administer which has the power to decree - if that is the right word - that a card such as this is active as an identity card, and therefore, on a practical level, is unlawful because it is being used for different purposes?

Ms. E. Martins:

I am very conscious here of the fact that I am unelected. I do not represent the people in the way that you do. The law sets out controls about the manner in which information is used and collected. It cannot and should not say that something is unlawful or illegal in terms of government projects. That is not the part that I play. That is a part that you play, and that the States play and, indeed, the public by voting play. I am here to say: "Let us discuss the privacy issues, the liberty issues, of government projects such as this." If they are to be put in place by statute, rules surrounding security, access to the information, et cetera, need to be applied. So, I think I need to make that very clear. While I may have concerns about the moral, philosophical questions it raises in terms of the State and the system, they are purely in an attempt to articulate those concerns for the public and for States Members to try and engage everyone in the debate. But ultimately it is a matter for the States to decide what it considers appropriate. But the law will control the manner of the processing once it is in place. All I can do is say I have concerns on privacy. But I cannot say it is unlawful. The one thing the Data Protection Law does require is, if a unique identifier is to be used on an I.D. card or some sort of card, then it will need regulations in the Data Protection Law to be drafted, and that is seen as a control mechanism of some sort, that it has to go through that hoop.

Deputy J.A. Martin:

As the Commissioner, Emma, can I ask you, let us say, the extra use of the card that will have, as proposed, the Social Security number on, giving it to individual landlords, and they will obviously have to keep this information as data which will be the name, address and the Social Security number. Obviously they will only need it to see for the residential stages, but I am assuming it will go hand in hand because that identity number is linked to that residential status. As someone who is holding data, these are people who probably just are a lot in the unqualified sector, you know, own one or 2 homes, or having 3 or 4 lodgers - lots going through their house in a year, because that sector does move quite a lot. How do you see this working under the Data Protection Law?

Ms. E. Martins:

Well, clearly, anyone processing any information about individuals is covered and is required to comply with the Data Protection Law. That does not mean that we live in an ideal society where everyone does. So you want to try and limit, the point being the data should only be disclosed if there is a need for it to be disclosed. The minimal data to fulfil the purpose should be processed, handled and disclosed. If that data is not required on that card or by that landlord, they should not be privy to it.

Deputy J.A. Martin:

If you have got the unique number, then surely the number must go back to a registered person who should not be living in licensed accommodation or entitled. So, obviously, I assume, when they make a record of this, they must record the 2, and that is an extra somebody out there, and quite a few people out there who have no

Ms. E. Martins: With that data.

Deputy J.A. Martin:

You know, I would say, who would audit this? Who is going to look at these individual landlords and how safe they keep the information, and who they do share it with?

Ms. E. Martins:

I would like to say to you that we would make sure of that, but we are a department of 4.

Deputy J.A. Martin: Very small. Yes.

Ms. E. Martins:

We try and be as pro-active as we can, to ensure people understand their rights and obligations under the law. But ultimately, we will just have to react when things go wrong.

Deputy C.H. Egré:

Unless you are reacting to a complaint.

Ms. E. Martins:

I mean, we are certainly very, very happy if this project comes on board to work with that sector to issue advisory notes, leaflets, whatever is in our power to educate people about their obligations under the law. But ultimately, the law is there for me to say: "Done something wrong", then we can take action.

Deputy G.P. Southern :

Can I come back to one of the essential factors in the Data Protection Law about the accuracy of information held? It seems to that people move, certainly in lodging houses, in the bed-sit land people move regularly, with great frequency. They do not always inform the authorities that they have moved, unless it is in their advantage to. That is one area where accuracy could be lax. It is obviously fairly easy, as people come to the Island or are born into the Island, to make sure they are on the register. But at the exit point, that is a different matter altogether, and again, how do you see, in terms of maintaining an accurate register, we are told that we will be searching the register - or the index - I do not know which one we are talking about? But never mind. Searching the index for signs of activity - no, it will be the register, for signs of activity. If somebody is inactive on all fronts for a period of between 6 and 12 months, we like to wipe them off. Again, is that a reasonable level of accuracy? How does that work?

Ms. E. Martins:

I think it very much depends on the question of what happens when that record becomes inactive, or whatever the word is. I cannot believe it would be wiped. I think it will be moved to an archive area, or an inactive area, because the stats would probably still be relevant. But also the ability - and I think I have read -- I have not read this in ever so much detail, but I have scanned it - I have been so snowed under so I do apologise - but I think what the aim is, is to move it to a secure, secondary area for archive, and then if the person begins interacting again with government then it will be reactivated. My concern originally was that, if in a central database, a citizen, for whatever reason, falls off that database, they then have trouble accessing government services. That does not seem to be what would happen here. It is purely

Deputy C.H. Egré:

What I gathered from this morning's conversation, was that the information would be deleted from the index, but kept in the archive - kept in the archive of the individual register.

Ms. E. Martins:

Oh, right. Deleted from the index?

Deputy J.A. Martin:

The index. He did say that.

Ms. E. Martins: Maintained on the register?

Deputy J.A. Martin:

Maintained on the register. So, to eliminate the fact that someone who has just been inactive and then they come back, you would then have to re-prove who you are.

Ms. E. Martins:

So, assuming if you came back and interacted, you would have to then register, would you not, with Social Security or Tax or somebody, and then that would put you back on.

Deputy P.J.D. Ryan:

If you did not, it would very quickly become apparent, because your name and address would not be on the central database.

Deputy J.A. Martin:

Well, you would not have to, if you have your card. You do not give your card in when you go away. You go away for a couple of years and come back, you would not have to re-register They would just notice somewhere along the line - I do not know how - that you are interacting again.

Ms. E. Martins:

If it is deleted from the index you would have to re-register. I do not know.

Deputy G.P. Southern :

That is one of the problems we have got now with Social Security numbers, that we cannot say what is happening, because we do not know if somebody - a foreign name - coming to the Island, is a re- registration or a new registration. People go in and get new cards.

Deputy C.H. Egré:

This is one of the technical aspects which we need to look into. Absolutely essential if this thing is going to run within the confines of data protection.

Ms. E. Martins: Yes. Absolutely.

Deputy G.P. Southern :

With a seasonal worker, the card becomes inactive. You do not know if it is because they are just out of work, or biding their time for the next job or they leave the Island. We do not know how we see it.

Deputy C.H. Egré:

It goes back to my point. As I see it, the card, in effect, is the index key to open up the registers.

Deputy G.P. Southern :

In terms of number counting, that remains a problem under whatever register you have got.

Deputy P.J.D. Ryan:

Are there questions of the Data Protection Commissioner specifically, around this area? We can certainly have discussions at another time, but I am conscious that we are taking up people's valuable time, and I do not want to do that.

Deputy J.A. Martin:

No. I do not know if Emma wants to say anymore. I think we have got more questions to go back to the authority -- to put into the law, or not.

Deputy P.J.D. Ryan:

Do you have anything that we have not touched upon?

Ms. E. Martins:

There are just 2 questions. I have written brief notes, if I may.

Mr. P. Boden:

Sorry. I just want to make one point. Are there any specific issues about adults and children - children specifically - in relation to the register?

Ms. E. Martins:

The law does not distinguish between the rights of children and adults. Everybody has the same rights. So, I think it is, again, a matter for the State to decide what they consider appropriate on moral and political grounds, in terms of

Deputy P.J.D. Ryan:

So, the head of household can operate on behalf of a minor for the purpose of data protection?

Ms. E. Martins:

Generally, a parent or parent-guardian can act for or on behalf of the child in terms of his or her rights under the laws, so just getting access to information. But certainly, I think it does raise a question for Government if you are storing, essentially, information about children. But really, again, the law applies in terms of standards that must apply to that processing. I cannot really comment on the moral question or otherwise of storage of children's data.

Mr. P. Boden:

Okay; and the holding of relationships between individuals?

Ms. E. Martins:

That was something I think that was originally mooted for the index, but I think has now been taken out

for good reason, and will probably remain on the register, because I would have thought that would have been pertinent in terms of residential qualifications, that if one family member has one status, that it will affect the other family members. I think probably there are legitimate reasons for that, but the central index, as I read it from here, will not have that data.

Deputy P.J.D. Ryan:

So, before I ask Emma for any other comments, is there anything else, any other questions that we have? Over to you, Emma.

Ms. E. Martins:

There are a couple of points I would not mind raising, that you have touched on the question, question 4. You asked me about the audit trail involved in creating - and I assume here that you mean the index, rather than the register. Is that correct? Yes. So, I would like to say that the rules on accessing and use need to be very, very clearly set out - the rules and access of the actual central index. The index has a potentially very wide access base, in terms of civil servants, and the more widespread the access, the greater the consequences for the security of the system, obviously, and therefore I would like to see all access amending, updating, printing by staff, needs to be logged to enable

Deputy P.J.D. Ryan:

Including just simple "read only" access?

Ms. E. Martins:

Absolutely; to enable checking if required, because we had a complaint in last week alleging unauthorised access from a specific database. The organisation who owned the database took 40 minutes to provide us with a printout of every single person who had accessed that data in the last year. We resolved that complaint in 2 days as a result. Incredibly efficient response to a request from us. We equally deal with databases where they have no idea - there is no control, there are no passwords. So, this needs to be top of the range security stuff.

Deputy P.J.D. Ryan:

You are highlighting both ends of spectrum, then?

Ms. E. Martins:

Absolutely. So, what I would like, as a regulator, is if I get Joe Bloggs in my office saying: "I think my data has been compromised", I want to know who has accessed it. I mean, you can imagine a case where, maybe, a female who is a victim of domestic violence and has moved to a safe house, will be on the central index, but has her name and address. For most of us we are in the phone book; it is not a problem. But there is a minority of people for whom it is a very, very big deal, and the details of her address get out somewhere. If I can go to the index and ask them who has accessed that data in the last 24 hours and get a response quickly, (a) it will be a very good deterrent for the staff to know that everything they do is being logged, which I think is incredibly important. I do not want to just react to things that go wrong. I want to be able to stop it in the first place. We all want to be able to stop it in the first place. But equally, if things do go wrong, I will have the ability then to say: "Right. That officer has accessed that data", and then go and talk to them about why, and maybe see whether the disclosure took place. That is a very important point for me.

Deputy G.P. Southern :

Again, we are talking about access within government. We are also talking about access from agencies outside of government; for example, parishes, and the stringency of the access rules must be maintained.

Ms. E. Martins:

Anyone with access. Anybody with access. It is as simple as that. Yes.

Deputy P.J.D. Ryan:

An initial observation based on today's discussion, this whole index register issue is going to be mightily confusing for the general population. If it is mightily confusing for us, as it has been this morning, then general consultation is going to be an issue for people trying to understand what is an index and what is the register.

Ms. E. Martins:

Because they are 2 quite distinct concepts.

Mr. P. Boden:

They are, essentially, the population trying to get their head round that, those issues are going to be

Deputy G.P. Southern :

Indeed, also, for the House, which is another creature altogether.

Mr. P. Boden:

Are there any more questions? You had 2 points. Second point?

Ms. E. Martins:

Was the question which I think it is very important that I raise, given the environment that we are now in, about the proposals for security of the data? I am constrained in my comments by the fact that the details are clearly yet to be finalised. It is a shame I did not hear Mr. Wells discuss it, because I am sure that is an area where he would have very strong views. But it does talk in the paper of stringent security controls which I very much welcome. I mean, clearly, no system, or indeed card, would be entirely infallible. I do believe a system could be created in a secure environment. But I would stress that the security of the system depends as much on using the proper procedures with the appropriate level of scrutiny as it does on the integrity of the actual card or the index itself. So, we have seen in the U.K. recently, it is not the system that has let them down, it is the processes, it is the people, and I think that is a lesson we should all learn as well. I mean "risk assessment" is a word bandied around a lot of I.T. projects, but I think it is essential. We have, sort of, gone through a risk assessment in the process with the officers involved throughout up to this point about looking at where the risks are and how we can mitigate them. That needs to continue throughout the process, and even when the system is up and running, because there are concerns arising from increased collection and access to personal information and centralisation of that, and data - concerns such as loss of trust and confidence in government, unauthorised use of data, exploitation of data for commercial purposes, technical security risks and poor data quality, data accuracy issues, are all areas where the public need to have confidence that the Government are taking every step possible to mitigate those risks in their minds, knowing that nothing is going to be 100 per cent safe, that we need to be up there as high as possible to that level. That will involve an incredible amount of support from Mr. Wells and his team, to ensure that those security measures are in place.

Deputy P.J.D. Ryan:

Okay. Well, we will take that on board, thank you very much, particularly your comment that it will require scrutiny, and we will certainly put that on the top of our list. That will be something that Peter will look at for us in as much detail as we can. Thank you. Are there any other ?

Deputy J.A. Martin:

No. Thank you very much.

Deputy P.J.D. Ryan:

Thank you very much for your time, Emma. It is always a pleasure to see you. We look forward to seeing you again at some future stage, no doubt.

Ms. E. Martins: Thank you.

Deputy P.J.D. Ryan: Thanks very much.