Today of all days...

Today is the 8th of May. Which for most people educated in Europe during the last 60 years should mean something. It is the day on which, in 1945, the Allies accepted the unconditional surrender of the German armed forces and the day on which WWII in Europe officially ended. It is a day that, in Germany, is not celebrated (for obvious reasons) but that is nonetheless branded into the consciousness of every German school child (at least of Matron's generation) as the day when the most terrible phase of our history finished and the building of our current democratic, federal and social republic began. As much as any country can ever have a "Ground Zero", for Germany, this is it.

As far as Matron can tell, rebuilding a people and a country from the rubble that was bombed-out cities and bombed-out minds after six years of war and 12 years of fascist indoctrination was never an easy task. It was a task that took time and that had to overcome a hell of a lot of obstacles. But through the changing approach from the schoolbooks used by Matron's mother (where history effectively ended in 1933) to Matron's own educational experience in the 80s (Fascism as a topic not only in history, but in RE, sociology, German literature, biology and art), one can track the effort Germany made at facing its history, discussing it, insisting that it was absorbed by every descendant of those involved in making it, to ensure that it would never be repeated.

Many of these efforts had to be made on a personal level. Being blessed with grandparents who were respectively a member of the Wehrmacht, a leader of the local chapter of the "Bund Deutscher Maedel" (the female equivalent of the Hitler Youth) as well as two people who merely did nothing as they watched their Jewish neighbours disappear without explanation, Matron went through the same process that nearly every German child of her age had to go through. Asking people she loved and who loved her why they took part in these atrocities, why they looked the other way, what exactly it took for them to suppress that part of their own humanity that should have forced them to oppose the Nazi regime and its despicable actions. And getting no answers.

After over 40 years of pondering these questions, Matron managed to get no further than these realisations:

• That the reasons for joining or not opposing the regime were as numerous as there were people in Germany at the time. Some did it for ideological reasons, some did it for power and material gain, some did it to escape poverty and lack of opportunities, some did it because they grew up in the system and never knew anything else and some did it out of fear for themselves and their loved ones.



• That each one of these reasons is as individually understandable as the next one, but that none of them are in any way able to excuse the things that happened.

And this is where her experience and that of her compatriots differs from the experience of British citizens of the same age who rightly see the defeat of Nazi Germany by their own grandparents as one of their country's finest hours. Where most German citizens of Matron's age feel guilt, most British citizens feel a sense of pride.

And that is how it should be. Matron has no patience with those who say that none of us should feel in any way implicated in any of this given that it wasn't us who either committed the crimes or fought against those who did. In Matron's opinion, we both need to remember our countries' and families' role in this - one of us to remind ourselves that we must never act like that again, the other to remind themselves that, if necessary, they must act exactly like that again. But we must also take on the other's mantle: be prepared to do the right thing in a difficult situation and be aware of what we may be capable of given the right (or wrong) circumstances.

Because if Matron has learned one other thing, it is that the ability to commit atrocities is not limited to the German people but that it can happen anywhere and to anyone. There but for the grace of whatever goes my country and my people and my family and me. A little humility on this score goes a long way and acts as better protection against the forces of evil than any pride in national habits of resistance could ever do.

Which is why Matron - who left her country over 20 years ago with no great love for many of its cultural and political habits - is finding it more and more difficult to tolerate the extreme anti-German sentiment that can errupt in her chosen home at a moment's notice - often fuelled by a particularly vile kind of self-righteousness that is, in her opinion, not only misplaced but downright dangerous.

Most commonly, that inexplicable need for British one-upmanship arises in the context of football, where it can easily be ignored or looked upon with feelings of "bless'm" (after all, one 5:1 victory in 35 years no footballing superpower makes). But more recently, Merkel's actions in Europe have started to draw the kind of comments that used to be reserved as a reaction to stupid remarks by the German national squad and this is where Matron feels it is starting to become perilous. Because if we are taking this unforgiving and combative stance to Germany's position in the EU, we are risking much more than a bit of a pub brawl on a Friday night.

What got Matron scared, today of all days, was the comments on this Guardian article reporting Angela Merkel's call for continued austerity in France and Greece following election results in both of those countries that clearly denounced that kind of policy. Now, Matron is no fan of either Merkel or the austerity regime she preaches and if those election results mean that maybe there will have to be a rethink at EU level about the best and fairest way to approach the financial crisis so much the better (Cameron and Co, take note!).

But these comments weren't in the first instance about that. They were comments that clearly suggested that Germany is still seen by some in the UK as a country that is just waiting for an opportunity once again to goosestep over its European neighbours. Comments like "The Germans never were that keen on democracy" and "The gloves are off... and the jackboots are on..." recall a kind of war language that - 67 years on - should really have died out. They belittle historical events and they ignore any of the evolution that Germany and its people have undergone in the meantime. But more importantly, they signal to the German people that whatever they do and however hard they try to become model European citizens, their country's redemption is impossible to achieve and the sins of their fathers (and mothers) will haunt them forever. So they might as well not try?

Lets recap why Germany joined the European Union in the first place. Some may argue it was for the economic benefits, but Matron herself has always secretly favoured Sir Humphrey's assessment that "they went in to cleanse themselves of genocide and apply for readmission to the human race".

Whatever people say, economically, modern Germany seems to Matron quite equipped to look after itself and it could probably exist without the EU much better than the EU could exist without it. In Germany itself, there has never been any doubt that the EU project was a political one. From Adenauer (the new Republic's first Chancellor) via Schmidt, Kohl and Schroeder to today's leader Merkel, German leaders have worked on the base assumption that Germany and German democracy are safer inside the EU than out. It is at least partly for this reason that Germany is willing to pay vast amounts of cash into the EU's rescue fund despite the fact that this measure is wildly unpopular with the German voters and may in fact cost Merkel the next election. The only reason why it may not cost her that election, as far as Matron can see, is that any other democratic German party would be doing exactly the same. Politically speaking, there is no alternative to this approach unless you count the parties on the far left and the far right.

So riddle me this, dear Reader: for the price of a cheap joke about the folk with the Stahlhelms and their everlasting desire to rule the world (no harm in a joke, is there?), do you really want to further alienate a populace that already feels like it's the paymaster general of Europe and where people increasingly think that "they've done enough" and that Germany, should be allowed "to look after its own first"? (Sound familiar? Then you probably read the Daily Mail or the Telegraph).

For the record, Matron does not think that Germany will ever have "done enough", but then she also doesn't agree with the Daily Mail readership that in this day and age any European country has the right to just "look after its own". As far as European political stability is concerned, we really "are all in this together" because the political fallout from a disintegrating European economy doesn't bear thinking about. And as much as she disagrees with Merkel on almost every aspect of policy, she must acknowledge that, like all other German chancellors before her, Merkel is keenly aware of that. And that as the ruler of a country that shares rather a lot of borders she is probably slightly more worried about taking that risk than the ruler of a country that is divided from the rest of Europe by a stretch of water currently seems to be.

Today is the 8th of May. It is a day for remembering the total and utter horror in which a misplaced sense of inherent superiority and a focus on national self-interest can result. It is not a day for engaging in cheap shots over the bonnet that have almost nothing to do with the real issues we are facing and that, in fact, merely allow those targeted in this way to assume an air of victimhood and to continue doing the things that we should actually be criticising them for in the first place. None of this is in any way useful to anyone, almost nothing of it accurately reflects the rationales for what is actually going on over there on "that Continent" and a lot of it is downright offensive.

British people have many charming and enviable quirks including self-deprecation, irony, rationality and critical reserve. But as far as Matron's fellow country people are concerned, many Brits have a weird and totally behind-the-times mental black spot that urgently needs to be fixed if we ever want to move on. To appropriate one of Stonewall's recent slogans:

Some people are German, get over it!

And now for something completely different...

Some of Matron's readers may remember that she deviated from the path of privacy (self-)righteousness a few weeks ago, when she ranted about the Catholic bishops' open letter on gay marriage which had to be read out in churches all over the land. Alhough that blog post is by now one of her most visited, Matron was fully intending to leave it at that until this morning when she woke up to the news that the Catholic church apparently didn't stop there. Instead, it has now apparently written to every state-funded Catholic secondary school in England and Wales asking them to encourage pupils to sign their petition against gay marriage. At the risk of invoking Godwin's Law, this put Matron in mind of Martin Niemoeller's famous poem "First they came.." which charters the way in which the Nazis made progress in their quest to silence dissent group by vulnerable group.

Now, it may be obvious by now that Matron is not herself a "person of faith", that, indeed, she considers much of conventional religious teaching to be some kind of "intellectual curare" designed to paralyse an individual's power to think for themselves and to critically analyse a given situation. As such, she has long-held and cherished believes about the separation of churches and the state (yes, please!), the role churches should take in the education of young, impressionable minds (none!) and the moral justification for the state-funding of so-called "faith schools" (there isn't one).

The discussion of the issue of funding has, of course, become particular relevant since current Education secretary Michael Gove embarked on his despicable scheme of turning as many schools as possible into privately run Academies, as this has given faith groups of any denomination an easy way to buy themselves into the hearts and minds of the nation's children. One of the unintended (?) consequences of this development is likely to be the increased exposure of children to the various churches' attitude towards homosexuality or, to use the more PC term, LGB, as is exemplified by this morning's news.

By some "happy" coincidence, Matron has just finished reading a very interesting paper which Mrs Matron - a state-funded educator and Catholic school survivor herself - has recently submitted as part of research she is conducting on social justice and sexual equalities in schools. In light of current events, some of its findings probably deserve a slightly wider distribution if we want to understand the damage that the exposure to the Churches' teachings in this area can do to young people.

1. Before we get to that, it must first be noted that ever since the sad demise of section 28 of the Local Government Act 1988 which prohibited the "promotion of homosexuality", the topic of homosexuality in a school environment is largely determined by the rules governing sex education. In particular, section 403 (1) of the Education Act 1996 provides that any kind of sex education must encourage pupils to have due regard to "moral considerations and the value of family life". Section 403(1A) then states that the Secretary of State must issue guidance on the matter and that that guidance must make sure, among other things, that pupils are protected "from teaching and materials which are "inappropriate having regard to their religious and cultural background". The practical result of this can be seen in classrooms all over the country where teachers are finding it difficult to even mention the possibility of LGB lives for fear that some rabid parent may rant them out to the head teacher as exposing the little dear to culturally and religiously inappropriate propaganda.
2. Ignoring for the moment the ludicrousness of the notion that homosexuality is something that would benefit from a sleek advertising campaign (as people said in the context of the section 28 debate, "If we could turn people gay, don't you think there'd be more of us?"), this has dire consequences for children that are actually LGB themselves or that are at least wondering about whether or not them may be. Studies have found that pupils identifying as LGB are more likely to experience feelings of depression and suicide by several orders of magnitude. Rather than this being "innate' to the misfortune of identifying as LGB - as the churches would have us believe - research has shown quite clearly that these feelings are much less likely to developed where LGB pupils are allowed to operate in an open and supportive environment.
3. At the same time, the complete and utter lack of positive LGB role models in schools and the refusal of schools to depict LGB as a valid identity leads to feelings of isolation and makes it more difficult for LGB students to come to terms with their own sexuality. According to a study supported by Stonewall, seven in ten pupils say that this affects their school work and 60% report that there is no adult in their lives in whom they feel comfortable confiding about their sexuality.
4. This atmosphere of ignorance, neglect and barely disguised intolerance also leads to increased incidences of homophobic bullying. Again, the Stonewall study found that 65% of LGB students has experienced homophobic bullying - ranging from name-calling to physical assault - rising to 75% in faith schools. Students report that even where they report the bullying to teachers and other educators, in many cases nothing is done. Indeed, teachers are often the perpetrators when it comes to making homophobic remarks about their pupils with another study finding that 43% of secondary school teachers have overheard homophobic comments being made by colleagues and 30% describing how colleagues in their school have themselves been responsible for homophobic bullying.
5. Against this backdrop consider Michael Gove's recent announcement that the Equality Act does not extend to schools and that faith schools therefore have a right to distribute what can only be described as homophobic material.

As anyone who has ever attended or visited a school will know, what schools and teachers do matters. The behaviour they expect from you, the values they try to install in you, matter. They have a much bigger chance to take hold precisely for the fact that not only are you exposed to them for seven hours every day during a period of your life when you are trying and learning to make sense of the world, people, society, yourself and what it all means; they also carry with them the authority of being handed down "by those who know" and who have - albeit a limited amount of - power over you.

Schools also have unprecedented access to children that is only matched by the access that parents themselves have. If schools are allowed to create an environment where one type of sexuality is understood as unacceptable, less acceptable or even less deserving of the rights that those with a different sexuality expect as a matter of course, it is bound to have an impact not only on the attitudes of the majority group but on the self-image and self-esteem of those trying to develop their own identity within the minority group.

The original impetus for Mrs Matron's paper was her realisation in her own school environment that sexual orientation is the only "equality factor" that is in open conflict with another, namely "religion". This means that only with regard to sexuality do schools seem to feel duty-bound to consider whether equality of treatment by means of appropriate support of students on all sides of the sexuality divide interferes with other students' religious freedom. It has been said before, but it may need to be said again:

We wouldn't tolerate this type of argument with regard to race and - as the discussions about the treatment of women in Muslim society or around female circumcision show - we at least have trouble tolerating it with regard to gender. We have made great strides in the last couple of decades in examining our attitudes towards cultural relativism and the extend to which this may merely be an excuse for reaffirming existing prejudices in our own society. With so much harm clearly already being done to young people guilty of nothing more than desiring a relationship with someone of their own gender, why can we not work a little bit harder to protect them from "attacks" like this?

Mr Gove, your turn!

Curbing unwholesome desires

Despite her various extracurricular activities - some of which find an outlet on this blog - it cannot be disputed that Matron is first and foremost a lawyer. This means that sometimes, when a particularly complex legal issue comes along, she can't help abusing blogger's privilege for a proper, in-depth legal analysis. So this post comes with the health warning that it is likely to put anyone in deep slumber who isn't similarly freakishly endowed with what Tom Hanks, in the movie Philadelphia, vomit-inducingly called "a love for the law".

Having given those who come out in bumps at this thought the opportunity to google something more interesting, let us have a look at an extremely interesting decision by the EU's Court of Justice that was published yesterday*. The case of Bonnier Audio and others v Perfect Communication Sweden AB concerned claims by several Swedish publishing companies against a Swedish ISP, ePhone, for disclosure of the name and address of ePhone users who were suspected of illegal filesharing. As is common in these cases, the publishers had collected the users’ IP addresses by monitoring activity on certain filesharing sites and required ePhone to disclose the users’ identity so that they could bring infringement proceedings against them. In the UK, such claims for information disclosure would be made through a legal instrument called a Norwich Pharmacal Order, in Sweden, this is permitted on the basis of section 53(c) of the Swedish Copyright Law.

In reality, in many cases, ISPs will willingly hand over the data once a court order is made as they have nothing to gain from opposing it other than incurring unnecessary legal costs. However, in this case, ePhone challenged the order on grounds arising under the 2006 Data Retention Directive.

ePhone argued that the Directive specifically prohibits the disclosure of retained communications data (because that is what this information is) to anyone for purposes other than the prevention, detection, investigation and prosecution of serious crime. In particular, Article 4 of the Data Retention Directive requires member states to ensure that data retained in accordance with the Directive are provided only to the competent national authorities (mainly security and law enforcement agencies) in specific cases and in accordance with national law.

However, this defence was ultimately unsuccessful and instead, the Swedish court of first instance granted the publishers’ application. Both, ePhone and the publishers appealed the case at various stages in the proceedings until the Swedish Supreme Court decided to make a reference to the ECJ. In particular it asked the ECJ for guidance on two questions:

1. Does the Data Retention Directive preclude the application of a national provision (in this case section 53(c)) under which ISPs may be ordered to disclose communiations data about their users to rightsholders for the purpose of IP enforcement?

2. Does it matter that the member state in question has not yet implemented the Data Retention Directive?

In brief, the ECJ ruled that (a) the Data Retention Directive (2006/24/EC) does not prevent member states from enacting such laws and that (b) it was irrelevant to the main proceedings that Sweden had not yet transposed the Data Retention Directive.

On first reading, Matron was extremely disappointed by this decision, which seemed a step back after rather encouraging recent rulings on ISPs’ role in the monitoring and filtering of online activity, for example in SABAM v Netlog. On second reading, Matron began to wonder whether the court could in fact have decided in any other way. But on third and most recent reading, questions are beginning to crop up, of which Matron wondered whether they should have been answered, even if they weren’t asked.

Lets tackle it step by step:

1. The thing that can be ascertained most clearly is that the ECJ is not going to depart from its 2008 decision in Promusicae any time soon. In that case, it had ruled that while Community law does not require member states to oblige internet service providers to disclose details of suspected file-sharers to enable a copyright owner to bring civil proceedings, it does also not prevent them from doing so, provided that the law in question allows the national courts to strike a fair balance between the IP rights of rightsholders and the privacy rights of individuals. In the Bonnier case, the ECJ examined the Swedish law and found that section 53(3) fulfilled the Promusicae requirements.

2. The ECJ’s ruling that the Data Retention Directive would not have precluded member states from adopting section 53(c) (or from permitting rightsholders to use it to obtain communications data from ISPs) even if the Directive had been implemented in Sweden was probably – technically – also correct. Even the Advocate General, who in his own opinion on the Bonnier case has taken a much wider view of the issues in question, had come to that conclusion. The Data Retention Directive clearly only envisaged disclosure of communications data to public authorities so that it could be argued, as the ECJ did, that the disclosure to private entities does not come within its remit.

3. This means that the ECJ’s ruling, at least in this respect, cannot be blamed on the quality of its interpretation of the law, but on the quality of the law itself. Maybe, just maybe, lawmakers should have asked themselves whether or not a provision should have been included in the Data Retention Directive that would have limited access to the retained data to access by law enforcement agencies solely for the purposes of law enforcement. But the truth, of course, is that campaigners DID in fact ask for such a provision at the time, but that they were widely ignored, with the then UK Home Secretary, Charles Clarke, admitting openly in Parliament that he saw no reason why such data, once retained, should not be available to rightsholders for IP enforcement purposes. Going forward this means that member states are still free to adopt similar laws – mainly on the basis of Article 8 of the 2004 IP Enforcement Directive – without having to fear that the ECJ will use the Data Retention Directive to strike them down.

4. The question the ECJ has not answered is whether this means that the ECJ has now given card blanche to rightsholders to make applications for the disclosure of any kind of data held by ISPs, including data that are in existence solely because the ISP is required to retain them by EU or national laws (rather than because they need them for their own business purposes). This is a question of “landgrabs” where the mere existence of a data pool generates unwholesome desires in third parties, who would enthusiastically like to get their mittens on that data, if only they could find a legal way to do so. This is a point that has exercised Matron for several years now and where she has come to the firm conclusion that the only way to protect personal data from those “landgrabs” is by making sure that the data pools do not come into existence at in the first place. In her opinion, any arguments – including arguments put forward by members of the tech community – that data protection law should only concern itself with regulating the use of personal data and not its collection, fall at that initial hurdle. "Build it and they will come", as they say, and anyone who argues otherwise is highly likely to be unpleasantly surprised a few years down the line.

5. So how should the ECJ have addressed this question in the context of Bonnier and has it really made such a fist of it? Well, yes and no. And yes again. At first glance, the court does not seem consider at all the purpose for which the requested data was initially retained as a factor in its decision on whether or not member states should have the right to grant rightsholders access to that data. This could suggest that it does not care and that the right it has granted to member states is wide-ranging.

6. On the other hand, as the German civil society organisation AK Vorrat points out on its blog (in German), the ECJ has made it clear in its decision, that it “is starting from the premiss that the data at issue in the main proceedings have been retained in accordance with national legislation, in compliance with the conditions laid down in Article 15(1) of Directive 2002/58”, and that “this is a matter which it is for the national court to ascertain”.

7. This list is enumerative, meaning that any national laws granting rightsholders access to communications data must comply not only with the conditions laid down in Article 15(1) of the E-Privacy Directive (which includes the right to derogate from the general requirement to erase communications data when they are no longer required by ISPs for their own business purpose – this is the derogation on which the Data Retention Directive was based), they must also comply with other national laws! And EU member states must, of course, have national laws in place that implement the 1995 Data Protection Directive. In order to determine whether national laws that allow rightsholders access to retained communications data comply with the EU legal framework, we must therefore examine whether those laws comply with the provisions of the Data Protection Directive.

8. The way Matron sees it, a core principle of the Data Protection Directive is that the processing of personal data is only permitted for “specified, explicit and legitimate purposes” and that it must not be “further processed” in a way “incompatible with the original purpose” (Article 6(1)(b), Data Protection Directive). This “purpose restriction principle” applies to all forms of processing except where the further processing is for “historical, statistical or scientific purposes”. Member states are only permitted to impose restrictions on this general rule in very limited cases when such a restriction constitutes a “necessary measures to safeguard” an important public interest (national security, defence and public security, to name but a few, see Article 13, Data Protection Directive). The protection and enforcement of IP rights is specifically not included in that list of public interests, so it is difficult to see how a member state can justify adopting a law that allows the “further processing” by ISPs or rightsholders of data for IP enforcement purposes, when that data was originally collected by ISPs for purposes of billing and traffic management.

9. Some may argue that Article 7(c) of the Data Protection Directive permits a data controller to process data if such processing is necessary for "compliance with a legal obligation to which the controller is subject". This, they say, leaves the door open for member states to adopt all kinds of laws that legitimise “futher processing”. However, as the Article 29 Working Party has pointed out on several occasions, ontologically, Article 7 is merely setting out the conditions on which the first data protection principle (to process data fairly and lawfully, see Article 6(1)(a), Data Protection Directive) is met. That principle and the purpose restriction principle contained in Article 6(1)(b) stand side by side. One does not override the other. A legal obligation referred to in Article 7(c) should therefore merely legitimise the first instance of processing, i.e. the collection of the communications data by the ISP, but not any “further processing” by him or any third party.

10. This is an unpopular interpretation of Articles 6 and 7, and indeed the recently proposed Data Protection Regulation that is designed to replace the Data Protection Directive includes a provision that would permit member states to legitimise “further processing” through national laws (see Article 5(4) of that draft Regulation). However, it is almost impossible to say at this stage whether Article 5(4), which would effectively remove the purpose restriction principle from the EU data protection framework, will make it into the final version of the Regulation given that it is strenuously opposed by the EDPS, the Article 29 Working Party and many privacy advocates. In addition, for the time being courts would still have to decide cases on the basis of existing law.

11. On an objective reading of the Data Protection Directive, it therefore seems to Matron that any member state trying to adopt a law that mandates the disclosure (i.e. further processing) for the purpose of IP enforcement of communications data initially collected for billing purposes would fail to implement the Data Protection Directive correctly and would (or at least should) have to expect a legal challenge before the ECJ on that basis.

12. As for the question of whether the ECJ should have made this clear, well, in the court’s defence, this wasn’t the question the national court had asked. Already, it is obvious from the decision that the ECJ had to do a certain amount of reinterpretation of the original reference to get to the heart of the question that, in its view, the national court actually wanted to have answered. Maybe the judges felt that there was only so much they could do in this context – particularly in light of the fact that the court already receives a fair amount of stick for allegedly answering questions it isn’t asked. Judges are political animal too, after all.

13. However - and this is where the Advocate General’s opinion is much more useful than the ECJ’s decision – the court could probably have made it clearer that the national courts will have to consider the framework put in place by the Data Protection Directive when deciding whether or not section 53(c) is compatible with EU law. This is a massive oversight and may very well lead to the Swedish courts skirting this issue entirely when the case comes back to them for review. If that happens, it is impossible to say how long we would have to wait for another suitable case that would allow the ECJ to clarify the situation.

One can only hope that ePhone’s lawyers will make sure that this doesn’t happen.

* It should be stressed that this is Matron's reading of the decision and than she actively welcomes dissent on this. The judgement is a complicated piece and more may need to be said.

Jedi Knights 1 : 2 Empire

Fellow privacy advocates may agree that it was a funny old day yesterday for our lot. As the saying goes, things tend to come along in threes , and yesterday this is exactly what happened.

SfS2012

To start with the good stuff, Matron spent the afternoon at the excellent “Scrambling for Safety” conference hosted by the LSE and organised by the Open Rights Group, fipr and Privacy International to kick-start a nationwide campaign against the UK government’s latest surveillance brainchild, the Communications Capabilities Development Programme. And an excellent conference it was too despite that fact that much of the preaching was done to a very receptive choir. This was not the organisers’ fault – Matron was reliably informed that enourmous energies had been expended trying to get people from different backgrounds and with different views to speak on the subject.

But when even a senior cop (Sir Chris Fox QPM, first President of the Association of Chief Police Officer) condemns the proposals as unworkable and unnecessary, when the guys from the Home Office prefer to pull up the draw bridge, and when the Labour Party (possibly acutely aware of the embarrassing fact that the proposals are a carbon copy of the Interception Modernisation Programme they themselves proposed in 2009) fails to respond to the invitation, who else is there to speak out on behalf of a project that could cost the country billions, violate the fundamental rights of millions of citizens and have no beneficial effect whatsever? The people who are likely to make a mint from flogging the technology – first to the UK, then to other “benevolent” regimes? Well, yeah, now there’s a conversation that is likely to happen in the spirit of openness and full and frank disclosure. Not!

But leaving that aside, Matron has nothing to add to her own recent post on the CCDP and fellow blogger Paul Bernal has already expertly summarised the SfS2012 conference. The conference was the start of a campaign that, Matron still feels, at a political level in the UK is ultimately winnable. So please concerned people of all ages and political pursuasions, join the fight, support one of the groups mentioned above by giving your time, expertise or even just money and help prevent this from happening.

Come fly with me (well, maybe not…)

The second thing that happened yesterday was less enjoyable. Matron is speaking, of course, about the European Parliament's decision to approve the international agreement between the EU and the US on the collection and transfer to the US Department for Homeland Security of the passenger names records of all citizens boarding a plane to the US from an EU member state. This agreement has been controversial for years and much more information than Matron could ever provide in this short space can be found on the website of European Digital Rights (EDRi). However, a few words on the procedural aspects of this decision.

Matron can’t say that the result of the EP’s vote has come as a surprise to her. With regard to matters of privacy and surveillance a pattern has been emerging here for some time where the EP – seemingly more concerned about its own role in the legislative process than the issues at stake – makes an almighty fuss about privacy and safeguards and the impossibility of it all until someone lets it onto the playing field to kick the ball around for a bit, after which it quietly returns to the bench with a content smile and lets those who really run the show get on with it.

Of course, this damning judgement does not apply to ALL MEPs, and Matron must particularly commend the work of , and the stance taken by, Sophie In’t Veld (ALDE, NL), who was the rapporteur for the LIBE committee which had recommended that the agreement should be rejected and who reportedly withdrew her name from the report after the vote.

However, the EP’s role in these matters is becoming almost as much of a trigger for privacy campaigners’ frustration as the inevitable outcomes of the various legislative proposals, almost all of which promote what Bruce Schneier calls the false dichotomy of privacy v security. MEPs should therefore ask themselves whether they are doing their own reputation any favours in the long run, if they never grasp the opportunity to stand up – and be seen to stand up – against the whimseys of their political paymasters.

The EP’s powers in the legislative process were increased in the Lisbon Treaty specifically with the aim of ensuring democratic controll and accountabilty. It is currently quite blantantly not fulfilling that role in many, many cases.

Bonnier Audio v Perfect Communication Sweden AB

Speaking of EU institutions that “could do better”: before she swanned off to her conference yesterday, Matron had the dubitable pleasure of having to write up the ECJ’s decision in Bonnier Audio v Sweden.

This decision was expected to provide some clarity on whether IP rightsholders should be allowed to demand the disclosure from ISPs of data identifying those ISPs' users for the purpose of bringing claims for illegal filesharing against those users. The best (and briefest) answer to this question may very well be that the ECJ - unhelpfully - has left many questions unanswered. However, Matron has made a stab at a fuller account of the judgement in a separate post for those with a masochistic interest in the lengthy and complicated analysis of ECJ judgements.

The end is nigh?

So what to make of this day? Is there a clear direction discernible of whither we are headed in the area of information privacy? Is it all doom and gloom? Is the end of civilisation as we know it imminent?

Well, the best one can probably say for all these developments is that they show that legislators, law enforcement agencies, security services, rightsholders and online providers are not allowed to ride roughshot over individuals' rights without there being at least a great deal of opposition, albeit that this opposition comes from a fairly small number of people. However, as SfS panellist, David Davies MP pointed out during his panel yesterday, that small number of people is endowed with a disproportionate amount of skill, knowledge and expertise as well as the willingness to put it to good use. We are also quite stubborn.

So maybe things are not as bad as they sometimes feel and maybe that move to the Outer Hebrides can be put off for a little while longer. As any good lawyer would say, it all depends. On a bad day, the temptation to do nothing and watch reruns of the Big Bang Theory instead is amost irrisistable. On a good day, Matron tries to remember the words of her favourite philospher, Albus Dumbledore, when asked whether opposition to Lord Voldemort would necessarily be in vain:

"[W]hile you may only have delayed his return to power, it will merely take someone else who is prepared to fight what seems a losing battle next time – and if he is delayed again, and again, why, he may never return to power."

And on that note, good night and good luck, fellow conspirators!

Back to the future?

One of the “joys” of getting older is the realisation that nothing is ever really new and that almost everything that happens is bound to come round again in your lifetime. The contribution of networked technology to this time-honoured process seems to be the speed with which, these days, history repeats itself. At the same time when the average person’s memory and attention span seems to be contracting due to the overload of information to which we are all exposed, fashions - of the clothing and political type - seem to be coming full circle more quickly than ever before.

While Matron could go on about the way in which our current government seems to be obsessed with re-enacting the 80s (Royal Wedding, check; riots in the streets, check; sending visible "goodwill" in the form of aircraft carriers to small islands near South America, check), or about the horror she feels when mint green dungarees are staring her in the face from the pages of the Observer off a Sunday morning, her most recent deja vu actually stems from something closer to her own heart. Namely, the outrage caused a few weeks ago by the governments “new” proposals for extending the police and security service’ powers to carry out surveillance of electronic communications.

Snappily dubbed the Communications Capabilities Development Programme (CCDP), it proposes – in a nutshell – the expansion of existing requirements for the retention of, and access to, communications data to data generated by social media services and others. As well informed observers and privacy obsessives of any kind quickly noted, there are uncanny similarities between this project and Labour’s doomed “Interception Modernisation Programme” which had to be dumped in 2009 in the face of mounting opposition, mounting costs and an increased understanding even by politicians that the technical difficulties that developers would have to overcome would not be would not be conquered any time soon. However, what the security services want, the security services eventually get, so Matron knows very few people who were really surprised when this particular ball was fetched from its hiding place in the long grass and kicked back into play.

As those who know Matron in the flesh are aware, when stories like these break, she tends to express a desire to move to a wood cabin in the Outer Hebrides, armed only with a sawn-off shotgun and a box full of beans. It was therefore not without a certain irony that the sofa in the holiday cottage where she watched the news reports about the CCDP had a view of the Western Isles. Alas, holidays end, and it’s still bl**dy cold up there in Northern Scotland, so until it warms up a bit, Matron has opted for adding her two cents’ worth.

There is very little to be said about the CCDP that has not already been said on ORG’s most excellent wiki on the subject. Others, like Paul Bernal, have analysed the likely attitudes of the UK political parties to renewed endeavours to push through this massive expansion of surveillance. Within a UK context, both sides are busy preparing for yet another big fight and the sound of sharpening knives on Matron’s Twitter feed is almost palpable.

Matron has no idea whether this (Coalition) government stands any realistic chance of getting a law adopted that managed to defeat the previous government while it had a substantial majority. She has to admit that she is not quite so pessimistic about this as Paul Bernal, who thinks that all three parties have good reasons to vote this through. Agreed, it will take a good hard fight to prevent it, long nights spent burning the midnight oil, hours of fruitless discussions and the likely disillusionment of yet another generation of campaigners for a free and open internet. However, the crux of the matter lies in the level of attention that this proposal currently attracts. And on that count, at least, the opponents have a slight advantage as tech and law journalists seem to choose to give this matter prominence. This may even be one of the increasingly rare cases where good journalism (rather than the kind that works off the press release) prevails.

However, what if we win this? Then what? Will that stop the government – and more importantly the security services – from craving the “precious”? Will it heck. And this is where Matron thinks that we could all do with revisiting history in an attempt to prevent its repeat. In particular, the CCDP should by no means be seen solely as a UK legislative project but should be put in context of developments currently going on at European level.

Connecting the dots

As many readers will be aware, the UK government is not the only actor currently on stage pensively staring at a skull. The DG Home of the European Commission is at this very moment engaged in an impact assessment of whether or not changes should be made to the EU Data Retention Directive and what, if any, those changes should be.

The Directive was pushed through the EU legislative process – almost as an emergency measure – in late 2005 on the basis of shortcuts, backroom deals and a blatant disregard for both popular opinion and fundamental human rights. Since then, the Directive and the national laws trying to implement it have encountered numerous hurdles in the form of constitutional court judgements questioning their compatibility with the right to privacy, national parliaments refusing to transpose all or part of the Directive and a more or less obstructive tech industry. What was meant to be adopted as a harmonising measure has led to some of the most fractured legal environment ever and one that is now actively threatening to impact on the online industry.

Matron has commented on these developments several times already, but with the CCDP now on the horizon, more needs to be said:

Timing

First, the timing of the publication of the CCDP proposals (the official "official announcement" is still expected for the Queen's Speech in May) is unlikely to be a coincidence. If, as rumour still has it, the EU Commission is going to adopt a proposal for a revised Data Retention Directive as early as September of this year, the CCDP could, and should, be seen as the UK both drawing a line in the sand early and setting out their shopping list.

As many others will remember, last time round, the Labour government - having already legislated for wide-ranging access provisions in the Regulation of Investigatory Powers Act 2000 - battled to get a mandatory communications data retention requirement adopted in the UK against considerable resistance by ISPs, the Lords and the media for almost four years before they quietly policy-laundered the whole shebang in Brussels.

The advantages of this approach are clear: the British media is notoriously focused on what is going on in Westminster and almost pathologically averse to reporting anything that happens in Brussels unless it is about something like the bad Europeans dictating the shape of “our” bananas. This may therefore well happen again.

Choice of options

Secondly, the Commission has allegedly already commissioned a study as part of its impact assessment for a revised DR Directive. Among the options said to be under consideration for a revised Directive is the option of "expanding the collection of communications data". This does not bode well. Although most of us will be hoping that the review will give effect to the various constitutional court decisions across the EU that criticised the current Directive, it is always dangerous to untie a legislative bundle. Stuff happens!

This makes it even more important that we finally get an ECJ decision on the Irish High Court reference which raises the human rights implications of the existing DR laws. Fortunately, it seems as if the High Court has now finally come out of its hiatus and made the reference in January. But given the ECJ timetable, this may yet be too late.

Political will and power

Thirdly, the hard core of opposition to the DR Directive, both within and outwith the political classes, currently comes from Germany, which is also - as we are frequently reminded - the EU's biggest economy and the member state (bar possibly Austria) with the biggest privacy chip on their shoulder. It is therefore likely that the German position on this – in the European Parliament and the Council – will be of the utmost importance when this is going to be decided.

Much of the political resistance rests on the shoulders of Justice Minister Leutheuser-Schnarrenberger, a declared opponent of DR who was one of the claimants in the by now famous German constitutional court challenge before her party joined the German coalition government, but who, to her credit, has continued to man the barricades after she was appointed to her current job. Alas, she is a Liberal Democrat MP and although Matron has not lived in the country for years, from what her German friends tell her, the German Lib Dem's chances of getting enough votes to even get back into the Bundestag come the next German election (October 2013) are as slim, if not slimmer, as those of their British counterparts. Word on the street has it, they may even go the way of the dodo.

While one should never pay too much homage to the power of one single person to change the ways of the world, one should also not underestimate the problems their absence can cause. Once Leutheuser-Schnarrenberger is gone, German political resistance to DR is likely mellow considerably. There is, of course, that constitutional court decision, but that will not protect us against the collection of new traffic data, it will merely provide an upper limit for retention periods and access safeguards - in Germany, not the UK!

Timing revisited

Similarly, if the speed with which the last DR Directive was pushed through is anything to go by, the final discussions/negotiations of a revised Directive may actually coincide with both the looming end of Commissioner Malstroem's period in office and the next European Parliament elections (summer/autumn 2014).

That is never a good thing as it tends to lead to "fire sales" in the corridors of power in Brussels. We've seen this with the Telecoms Package (where, oddly enough, it worked partly in our favour) and Commission employees Matron spoke to in Brussels in January already voiced this as a concern with regard to the new Data Protection Regulation which may face a similar challenge. So this is something that we need to bear in mind from a campaigning point of view.

Overall, it is therefore most important to remember that regardless of any political wrangling that we will have to go through in the UK (and it goes without saying that we should oppose this harebrained threat to civil liberty strenuously), we should bear in mind that with a reasonably vigilant British press, the House of Lords, loud-mouthed voters and stubborn, cost-averse ISPs, the government's chances of getting anything substantial past the UK Parliament are infinitely slimmer than their chances of "outsourcing" this to the EU in what may well turn out to be a parallel legislative process.

What is more, from a political point of view, the latter is a win-win. If loose here, but are successful in Brussels, they can then come back to Westminster with hangdog eyes and say, "So sorry, chaps, but we have to implement this now, Brussels told us so".

This may make Matron sound like a cynical and disillusioned old hag, but her guess would be that there is a plan to this effect somewhere in a drawer in Whitehall, even if it is marked "Plan B". The Home Office and the security services are used to playing the long game. The fact that those involved in the pushback will be roughly the same people (at civil society level) who are also going to be engaged in fighting on several other fronts (including trying to get a decent version of the Data Protection Regulation adopted) at roughly the same time, is not helping matters either. Most human brains only have so much capacity.

So nipping this in the bud over here would be great, but it won't be enough. We need more brains, we need a wider horizon and we need to build alliances in the EU on this and quickly. For that we need individuals in the UK (including lawyers, techies, journalists, campaigners) willing to spend some time and to get their head around rather complicated technologies, legal frameworks, lobbying strategies and political tactics.

On Thursday, 19 April, the good folks at Privacy International, ORG, fipr and the LSE are organising a workshop called “Scrambling for Safety” where many of these issues will be discussed. The line-up is stellar and the need to cooperate is clear. If you are at all interested in becoming involved please register here or follow it on Twitter (#sfs2012).

Matron may even see you there.

Pastoral letter from an average lesbian to the leaders of the Catholic church

Matron initially wrote the text below as a comment on one of the many blogposts by faithful Catholics that are currently promoting the "pastoral letter" written by Archbishop Vincent Nichols and Archbishop Peter Smith on ‘gay marriage'.

As Matron has already said many a time in various fora, she is no great fan of gay marriage herself because she is no great fan of marriage. As an indoctrinated 80s feminist who grew up on a steady diet of philosophical and legal critique of the institution, she has never quite managed to overcome her resistance to a concept whose sole purpose it seems to be to privilege one way of arranging one's life over another. To her, marriage itself already always seemed to be the epitome of something that creates inequality in a society and she still wonders if gay people who want to be part of it might not maybe be selling those of us who don't down the river to some extent.

For this reason gay marriage is something that Matron has consistently refused to campaign on all her gay, adult life, preferring instead to argue for a society and a legal system where people's life choices in all their rainbow coloured variety are recognised and protected by law. She stands by that even in the face of pressure from her own community because, quite frankly, it seems a bit silly to be for something just because the Catholic church is against it.

However, it cannot be denied that:

(a) there is of course a ludicrous element of inequality in the denial of marriage to one part of society solely on the basis of the gender of the person they love,

(b) the conflation of romantic notions of love, societal objectives, religious dogma, and the law has created a myriad of messy beliefs and understandings of what marriage is and should be about, and

(c) - as the Catholic church has done - the throwing into this unholy mess of argument the imperative of marriage being solely there to enable procreation and the raising of children adds a level of irrationality and - lets face it - entertainment value to the debate that deserves its entirely separate blog post, seeing as it also seems to deny the right to marry to those straight couples who cannot have children or who definitely and freely decide not to have them.

Much has been said and argued on that latter part in particular and many examples have been cited for loving gay relationships where children are nourished, loved and cared for, versus incapable single mothers, despicable rogues of fathers, broken homes and, not least, the Catholic church's abysmal reaction to the fact of child abuse by members of its own ranks. Indeed, Matron, like almost everyone of her ilk, now has gay and lesbian friends who raise children, including a lesbian couple who is providing that loving home for a group of three siblings given up for adoption by social services after suffering physical and psychological abuse at the hands of their heterosexual parents.

But equally, Matron knows of gay and lesbian relationship breakdowns, with or without children, where the partners had to deal with exactly the same social, emotional and legal issues as their straight counterparts. The bottom line is that we are no better and no worse at this relationship and raising children thing than straights have been for millennia. Nor should we be expected to be and Matron does not believe that a "holier than though" attitude is going to help anyone even one iota.

But what she does believe is that the discourse that is currently being had openly on the letters pages of our national newspapers, blogs and social networks is deeply offensive and hurtful, showing as it does to those of us who might just have thought that this society is changing for the better and might be becoming more tolerant, what a morass of hate and prejudice still lurks beneath the surface. To this extent it is not only damaging to individuals' mental health and self esteem but it is damaging to the very fabric of our society.

And for a church that professes to have as its major tenet the commandment to "love thy neighbour" there is remarkably little of that love shown to any neighbour who doesn't play by its own restrictive, narrow-minded and, yes, openly discriminatory rules. So even if Matron could bring herself to have faith in some spiritual superior being for whose existence there is not a shred of scientific evidence, she would never be able to believe in a god this spiteful and a church this hellbent (pardon the pun) on the exclusion and damnation of significant parts of his creation. That sort of god is not a loving god, no matter what his minions preach from their pulpits of a Sunday morning.

"Sticks and stones", one could of course argue and, on the plus side, Matron has also received many messages of support from straight friends, family and acquaintences that make it clear that things are not all bad. But the sticks and stones argument never really works very well for those of us with thinner skins and for Matron this week there was the added complication that she was actually required to attend a full Catholic mass at a time when the only reason why she would ever want to go near a Catholic church would be to picket it.

So here is the comment that she posted on that other blog in which she describes just how that made her feel. It's a bit more private and personal that her usual ramblings and she will no doubt regret posting it later, but for the time being she thinks that there isn't enough out there yet about this aspect of the whole debate:

"Yesterday, I was glad enough to be there for my lesbian partner when we attended the catholic funeral mass for her grandmother, a woman who, aged 85 at the time, welcomed me into her heart and her family 17 years ago when my girlfriend and I first started going out. Walking behind the coffin into the church together with the rest of the family we had to go past a table with a neat pile of your “pastoral letters” and, next to it, a petition on the matter, signed no doubt by many of the parishioners who were sitting in the pews waiting for us to pass.

It made it clear to me once more that although everyone in my partner’s family treats me as a fully signed up member of their clan, the same way in fact, as they treat the spouses of my partner’s siblings, the church they belong to continues to see me as a second class citizen regardless of how much time, love and committment I share with their daughter, how much I get involved in their gatherings, the care for their children and their elderly. Whatever I do and however much love I show towards my partner and those she holds dear, in the eyes of their church I will never be good enough.

I am not sure, if any of those who are promoting this letter have the capacity to understand how much hurt and offence you are causing to those of us who, although we may not be religious, try to live a life in which we do the right things, love those dear to us without constraints and in return only want to get shown the same love and respect for these efforts as everybody else.

Whatever you think about marriage and the rationale for it, the public discourse church leaders are currently creating, the comparisons they are making between what, in my and most other cases, are supportive, loving and committed relationships between two (not three, four or five) people and things like bestiality and legalising slavery etc. are homophobic and show none of the love towards your fellow creature that your own church’s founder commands.

Given everything I read in the papers in recent weeks, it took all I’ve got for me to decide to even go near a Catholic church yesterday. I did it because the woman I love needed my support and because I know the woman we were burying would have wanted me to be there. Which part of that love that we share is so lacking in the necessary quality that it doesn’t make the grade in your book? If an 85 year old Irish catholic woman could accept my relationship with her granddaughter, why can’t her church?"

[Update: on the other blog, a nice Christian gentleman has now replied to my comment to tell me that my relationship "ontologically damages me". But fear not, Jesus loves all the gays and only has their happiness at heart. And according to an article to which I was kindly directed, it is my lifestyle itself, and not the discriminatory treatment by society, that makes me miserable because

"[t]he ultimate misery of homosexuality is, in fact, what every longitudinal study reveals. An active homosexual life most often results in shortened life span, prevalence of disease, drug and alcohol abuse, and relationships that are brief and emotionally hurtful, with little hope of fidelity, and a high occurrence of violent abuse. The chances of a person committing suicide are also greatly increased."

There's clearly no way of responding to this "Through the looking glass" logic" without making oneself even more miserable, so we shall leave it here.]

Rating rape

And now for something completely different...

Over the last few days, Matron has watched the unfolding of What could become a new campaign on Twitter with an increasing sense of discomfort. Calling itself the 58% campaign, it is seemingly trying to encourage women not to be deterred from reporting a rape or other sexual assault to the police because of low conviction rates.

The figure bandied about in the popular press and various studies in this regard is 6%. That is the percentage of cases where a conviction for rape is secured compared to the total number of cases reported to the police. Not so, argues the campaign, pointing out that this figure misrepresents the situation because rape is the only crime where conviction rates are calculated in this way. In all other crimes, the term "conviction rate" refers to the rate of convictions compared to the number of cases brought to trial while the rate of comparison between reported cases and convictions is called "attrition rate". Using the former method, so the campaign argues, the rape conviction rate is actually 58%, much higher than in relation to many other types of offences.

As Matron said, the campaign seems to mean well, seeing as it is trying to encourage women to report rape cases by telling them that they are in no more danger of having their attacker go unpunished than are many other victims of crime. However, from a psychological point of view, this campaign misses a few major points.

First and foremost, most women will probably agree that when it comes to evaluating whether the prospect of putting oneself through the ordeal of reporting a sexual assault (and for most victims it will be an ordeal) is worth the potential outcome, they will not really care at what stage in the proceedings their case fails. One of the most recent studies on attrition in rape cases (dated from 2005) identifies no fewer than 6 attrition points between reporting a crime and eventual conviction:

1. The victim's decision whether or not to report in the first place
2. The police's decision whether or not there is any evidence of assault or whether they are faced with a false allegation
3. The police's decision whether or not the evidence is sufficient for charges to be brought
4. The victim's decision to withdraw the accusation for whatever reason (which includes becoming aware of the practical consequences for them of seeing the case through to trial)
5. The CPS' decision of whether or not to bring the case to court
6. The court's decision whether or not to convict

If we disregard the first attrition point, that is five separate instances during which a victim will be faced with the prospect of "it all having been in vain". Five separate occasions for regret. Five separate opportunities for having additional psychological damage inflicted upon you on top of the trauma of the original offence.

Even more interestingly, all the studies that have been carried out in this area confirm "that the highest proportion of cases is lost at the earliest stages, with between half and two-thirds dropping out before referral to prosecutors". Now that is undoubtedly true for almost all criminal offences, but nonetheless Matron would be interested to see how those figures compare to rates of attrition between the reporting and the prosecution stage in relation to other crimes. If the percentage of "lost cases" is substantially higher with regard to rape and sexual assault than in respect of other crimes, this might actually also explain a slightly higher conviction rate for rape (ie, many of the main hurdles might already have been jumped in the pre-trial stages).

Given those circumstances, however, victims (and Matron includes all genders in this argument) might be forgiven if, in the case of rape, they are looking at the attrition rate rather than the actual conviction rate. In fact, encouraging women to report on the basis of an assumption that they have a good chance to have their attacker convicted might be paramount to gross misrepresentation given the 6% figure. And yes, it might be fact that the conviction rate for rape is higher than, say, for burglary. But no victim of burglary will be required to expose themselves to quite such as extent in the context of holding the offender to account, so we would be comparing the proverbial apples and pears, if we relied on that argument.

Make no mistake, Matron is all for encouraging women to report. Not ever having been a victim of any form of sexual assault, she sincerely hopes a) that it will stay that way and b) that she would have the courage to do that if it ever happened to her. But she does not kid herself that she would definitely report it, if it ever happened. You just can't know how you would react until you are in that situation yourself. Of course, increasing reporting rates is important. Until we have the real figures, the question of rape and sexual assault will never get the attention it deserves and the public perception that women are doing it in droves "to get one over a man they have some beef with with" will remain in place. But there are other ways to achieve this, most importantly by improving the way in which victims are treated by the police and the justice system. That's what people have focused on for the last decade or so and, in Matron's view, rightly so.

This campaign, on the other hand, runs the risk of doing more damage that good, not only because it may depict the actual reality of trying prosecute a rape case (and particularly what this means for the victim) in an unrealistically favourable light, but also because it suggests to the general public that our criminal justice system "works just fine" with regard to rape or at least no worse than in relation to any other crime. That's not the case yet for a number of reasons, not the least of which is that in order to reflect the additional trauma victims go through by virtue of the prosecution process alone, we should really be aiming for pre-trial attrition rates that are way below those of other crimes. Only then would the majority of victims be reassured that they and their case will be taken seriously and that they are not putting themselves through all this for nothing.

Fools rush in where angels fear to tread. So please, honourable campaigners, do your homework. Read a few studies, crunch a few numbers and speak to a few rape victims before you embark on this crusade and, above all, don't diss the use of the attrition rate without understanding what it stands for in these cases.

To Google-bash or not to Google-bash?

After months of work-induced hiatus, Matron has recently started tentatively to participate in life outside the ivory tower again. Among other things, this means that she has started to follow some of the discussions that are currently going on various "conspiracy-lists" of which she is a member. On one of those list, a very interesting question has just arisen with regard to Google's recent move to unify the privacy policy of its various services.

As many of Matron's readers will know, the EU's Article 29 Working Party has called on Google to agree to a "pause" with regard to the introduction of the new policy to give regulators across Europe the chance to review whether the new policy complies with EU data protection law. Google has so far rejected this request, pointing out that it has run the new policy by some (though admittedly not all) of the EU regulators already and that it sees no reason for further delay. It also seems convinced that the new policy does in fact comply with the law.

The Working Party is not so sure and the French data protection authority CNIL has now sent a second letter to Google on behalf of the Working Party in which it sets out its particular issues. A US-EU consumer rights organisation, the Trans-Atlantic Consumer Dialogue (TACD), has sided with the Working Party and written its own letter to Google CEO, Larry Page.

At the heart of the matter are concerns about

1. a lack of transparency of the new policy and


2. the allegation that Google may has given itself a right to combine personal data collected across all of its services that it did not have before. In particular, CNIL's preliminary investigations seem to show that it is difficult to know exactly which data is being combined between which services and for which purposes.

Never one to rely on the allegations made by others, Matron thought she might have a look and compare the new privacy policy with the last version before that (from October 2011). And indeed, there are some things that the average privacy advocate could take umbrage with.

Combination of data across services

Back in October 2011, Google's policy said:

"We may combine the information that you submit under your account with information from other Google services or third parties in order to provide you with a better experience and to improve the quality of our services. For certain services, we may give you the opportunity to opt out of combining such information."

The new policy reads:

"We may combine personal information from one service with information, including personal information, from other Google services – for example, to make it easier to share things with people you know."

To Matron the main two differences seem to be that:

• under the older version combining data across service was allowed for the specific purpose of "providing you with a better experience and to improve service quality".



• under the old policy, users were given the opportunity to opt out of having their data combined for certain services. That opt-out right now seems to have been removed across the board.

As far as the right to combine data is concerned, Matron has used this kind of wording herself many a time when drafting privacy policies for her clients. It is specifically designed to cover a wide range of processing activities, and in Google's case one could probably think of anything from improvements to the search algorithm to targeted advertising and personalisation. It was therefore a pretty wide-ranging right already and maybe we shouldn't get our knickers in a twist about this given that no one seems to have complained so far.

However, the old policy did at least tie the right to combine data to some kind of specified purpose, albeit a big and expansive one. Under the new policy, Google seems to have removed any purpose restriction whatsoever and just given itself the right to combine whatever data it holds about us as it sees fit. As a data protection lawyer, Matron would have to agree with CNIL, that that is at least questionable under EU data protection law which only allows for personal data to be processed (and combining is an act of processing) for specified purposes.

Also, in practical terms it would certainly suggest that Google is now doing something (or planning to do, or at the very least give themselves the option to do, something in the near future) that it wasn't doing before. Why else go to this length? As always, we could of course blame incompetence before looking for bad intent, but Google must be able to afford some of the best data protection lawyers in Europe, so maybe we can rule that out.

As for removing the users' right to object to the combining of their data, this is quite an important change and one whose repercussions we cannot yet really assess. For Matron personally, this means, for example, that Google may now technically be permitted to combine the data it collects about her via this blog (which one of it's subsidiaries hosts) with her search history. Because when registering with Blogger, Matron used an e-mail address that includes her real name (more fool her, many of her techie friends will say, but probably something that many other average users would have done as well) and given that this is the same e-mail address she used when opening a Google account, Google as a group of companies (not just as one or two of its subsidiaries) now knows the real name of the person who writes a formerly relatively pseudonymous blog (for Matron's feelings about this sort of thing, see here).

The question is, of course, how long it may now take until Google finds a creative use for all this combined data? For example, how long until a Google search for Matron's real name brings up this blog in the search results? Google may say that it has no plans to do this and be quite right at this point in time. But stranger things have happened at sea and on Facebook than an online provider changing its mind, business model or algorithm. They point is that it now can.

Transparency

Also, and this seems to be the main point of CNIL/WP29 criticism, it could justifiably be said that the new policy has indeed become a lot less transparent for the average user. This is because Google has now basically put up two big buckets:

• In bucket A are all the types of data Google may collect from users of any of its services.



• In bucket B are all the purposes for which Google may process personal data.

The new policy is basically construed in a way that allows Google to process any type of data from bucket A for any purpose from bucket B.

Given that in the EU data controllers are under an obligation to tell data subjects specifically in each case what type of data they are processing for what purpose, Google's approach is probably not enough to fulfil its obligation to provide data subjects with the required "fair processing information" as it's know in the trade.

Given also, that Google is likely to justify its processing activities on the basis of the user consent that it implies through the new privacy policy, users must be able to understand properly what it is that they are consenting to for the consent to be valid. And therein, as they say, lies the rub.

The "conspiracy list" on which this discussion arose consists of around 25 people, learned men and woman all, with backgrounds and tertiary degrees in law, IT, politics and many other cognate areas. After several rounds in the ring, members seemed to be unable to agree on what the new policy actually means. If it is ambiguous enough so that this type of user can't figure it out, the "normal" Internet user (as in most of Matron's examples consisting of a sample n=2, being Matron's and Pangloss' mothers) stand no chance. So, Matron can't help agreeing with CNIL that on the facts, at the very least, the latest development in Googleland warrants closer inspection and maybe the requested "pause".

To Google bash?

However, for Matron the most interesting and most frustrating aspect of the discussion on her list was not whether or not Google's latest peccadillo was of sufficient quality to finally taint the "don't be evil" image, but whether or not we, as a group of critical individuals, should be drawn into this affair (and a number of other affairs which involve Google, like, for example, the issues with the security gap in the Safari browser's cookie preferences) in the first place.

The reasons given for "not jumping on the Google-fear bandwagon" went along the following lines:

• We shouldn't get caught up in a campaign to "take down Google", that was effectively organised and financed by a group of competitors.



• There are other organisations who do the same or worse and so we need to be even-handed in our criticism.



• We should focus on the principles and not on individual companies and single cases.



• We should stick to our work and avoid chasing headlines.

None of this is easy to argue against, and yet the fact that we had this discussion in the first place and that we had it (it felt like) because this concerned one of the tech community's beloved darlings, left a bad taste in Matron's mouth.

That very same group of people has in the past both co-operated with and criticised companies, institutions and organisations like BT, Microsoft, Virgin Media, Phorm, the Information Commissioner's Office, the Home Office, the European Commission, O2, the UK security services, several rightsholders and their associations and even Apple (until recently another "Untouchable") without having had similar discussions about whether or not we should "single them out" for their transgressions. So why was this different?

And even if in this case Google's approach is specifically selected for criticism and comment, is this really so unjustified? If a country like, say, the US were to start violating certain human rights - lets assume for a moment that one day they may decide to detain certain undesirable individuals in prisons without a fair trial for an indefinite period of time - would we really bellyache about whether or not we can criticise the US for that just because any number of tin pot dictators all over the world have done the same for decades without us making a big deal about it?

Contrary to all the constant affirmation given to men by women all around the globe, size does matter. Reach matters. And relative and absolute power matters. If a big and powerful country like the US does something that flies in the face of a general feeling of what is right or wrong, this does two things:

• its actions alone are likely to affect a massively larger number of people than the actions of smaller, less powerful countries.



• its actions set a standard that other, smaller and less powerful players will adopt as soon as they get the chance.

It used to be said that if the US sneezes, the world catches a cold. On the internet, it seems - to Matron at least - that the same now applies to Google and a handful of other players. Those are the companies with the money, know how and lobbying power to shape both the technology we will be using in the future and to influence the way in which that technology will be regulated. Those are the companies that - everyday - test the boundaries of what users, competitors and regulators will allow them to get away with (see also Facebook for the "two steps ahead, one step back" approach to user conditioning). And once these companies have established the new "normal" and made it part of their established business model, others will follow.

The only way to counteract this, is for those of us with the relevant skills to pick them up on any transgressions as and when they happen. We must do this by analysing their actions; by bringing any unlawfulness to the public's and the regulators' attention; by working with regulators and other stakeholders in relation to enforcement and by trying to shape policy designed to address and/or prevent future transgressions.

And at no point in this process should we ever ask ourselves, "Should we be doing this because it could be construed as Google (or Apple, or Microsoft) bashing?"

Just saying...