Speech on the NHS and compliance with the Secretary of State's Surveillance camera Code of Practice
Tony Porter's speech to the national NAHS conference on 21 November 2017 at Birmingham.
Well - I keep being invited back to speak at this conference despite being the purveyor of some tough messages.
That to me shows a certain determination by the organisers to afford you the delegates an opportunity;
- to achieve best practice
- to be exposed to the ever shifting regulatory environment
- to demonstrate and be accountable for compliance with your statutory and regulatory responsibilities
In the fast paced and exciting world of video surveillance - algorithms attached - on platforms that fly 400m in the air or waltzing around the wards attached to security officers on body cams- it can appear to be a complicated legal and regulatory environment but in reality - not so much.
My question to you today is this; ‘are the delegates here prepared to pick up the mantle of the challenges associated with compliance and accountability before they are told to do so?’
History
OK - Stop -I hear some people saying – ‘what’s this guy talking about?’ Fair enough. I imagine quite a few people weren’t here to hear my excellent ground breaking speeches in 2015 and 2016 - so - with the forbearance of those who were -allow me to repeat myself just a little.
Who am I - for a start?
I am the surveillance Camera Commissioner for England and Wales.
I was appointed by the Home Secretary in 2014 and have recently had my tenure extended by a further 3 years. I am independent from government
You may think from what I am about to say that I am anti - surveillance -I am not. I am anti ‘bad surveillance’ - surveillance that shouldn’t be there, is badly run, its data isn’t protected, its presence and operation isn’t reviewed frequently, or is otherwise conducted in manner which does not engender confidence in the public.. In my previous occupation I was a Commander in charge of Counter Terrorism at New Scotland yard for the Olympics and prior to that head of North West CTU. I was also the Head of Intelligence at Barclays Bank-so I really get surveillance. . I oversee compliance with the Surveillance Camera Code of Practice which is issued by the Secretary of State (the code). It contains 12 guiding principles which if followed will mean cameras are only ever used proportionately, transparently and effectively.
My remit applies to England and Wales and my role is three-fold to:
- encourage compliance with the code
- review the operation of the code
- advise on any amendments to how the code should develop
I submit an Annual Report to the Home Secretary which is laid before Parliament.
The code applies to relevant authorities (police, police crime commission-ers, local authorities and non-regular police forces) who, by virtue of section 33(1) of the Protection of Freedoms Act 2012, must pay due regard to the code.
Also, working within the Protection of Freedoms Act 2012 and the code -my role is to encourage Voluntary Adoption of the code -more of that later. This is where you come in. NHS Trusts, NAHS are not at the moment, relevant authorities but are organisations that may voluntarily adopt it, and I would strongly encourage you to do so.
And here’s the payload - if organizations follow the code, they will not only be able to reflect that they operate an efficient and effective surveillance camera system that is legitimate and transparent, but importantly it will assist with your efforts in complying with the Data Protection Act ( and our clear intent is that you will comply with the new GDPR rules), where you are at risk of extremely large fines from the Information Commissioner’s Office, and other regulatory issues such as compliance with SIA guidelines etc…
I have called however for government to expand its list of relevant authorities provided within the Protection of Freedoms Act 2012 so as to capture organisations such as this. Surveillance, in public space, where such sensitivity exists creates, in my view an overwhelming argument for requiring compliance with the code as a statutory requirement. This is a view which was shared by my colleague, the former ICO, during the Bills consultation phase.
The government has been clear in setting out that it wants an incremental approach to the regulation of surveillance cameras in England and Wales. So how does that look since introduction of my role? Here are some headlines:
-
Local authorities - have improved from a position whereby only 2% demonstrated compliance with any British Standard to 93 % compliance with the code – an outstanding achievement, and commitment by them.
-
Police forces -a relevant authority- slowly gaining traction. The Metropolitan Police Service -22000 Body Worn Cameras - and Greater Manchester Police have achieved compliance via independent certification .
- Drones -Devon and Cornwall Police have just achieved independent certification for compliance with the code, the first organisation in the UK, actually the World to do so!
-
Automated Number Plate Recognition (ANPR) - National Police Chief ’s Council has written to all police forces in England and Wales requesting that all systems demonstrate compliance with the code within 18 months.
-
Transport for London (TfL) -20000 plus Cameras voluntarily adopted the code because they recognised its importance for reputation and integrity of its operations.
-
Marks and Spencer - a voluntary adopter -have attained full and independent certification across 600 stores, distribution centres and head offices for compliance with the code.
- Universities - they get the imperative -attract students on grounds of safety and security-it sets a standard and we are seeing many Universities adopting the code.
Support
To support all this work in March this year I released a comprehensive Na-tional Surveillance Camera Strategy. Those of you shifting in your seats thinking -‘I feel uncomfortable’- I urge you to access my web site. The Strategy will inform you of developments.
The ‘Passport to Compliance’ document will guide those of you thinking of buying new systems or significantly adding to existing ones.
The ‘Self Assessment Tool’ and policy on independent certification will pro-vide a very simple guide for you to demonstrate adoption of the code.
Why is NAHS important
There is an increase in the use of surveillance technology in general across society, such as automatic facial recognition, Body Worn Video, Automatic Number Plate Recognition, Unmanned Aerial Vehicles and so on.
All of which are being used across NAHS/Trusts in some form or other
Of course the legitimate use of these systems can provide significant benefits to your organization, and to wider society in general;
- AFR -patient/ carer access to designated area
- ANPR-parking across NHS Estates?
- Body Worn Cameras-for local Security -protection again of carers and public visitors
And since last year the paradigm is shifting even further. We are now seeing all this technology becoming integrated; cameras , linked to sensors, linked to data bases -linked to managerial headaches and a requirement for legal and regulatory compliance.
All such surveillance platforms have potential for privacy invasion - of the highest order
Consider the numbers;
-
209 clinical commissioning groups
-
135 acute non-specialist trusts (including 84 foundation trusts)
-
17 acute specialist trusts (including 16 foundation trusts)
-
54 mental health trusts (including 42 foundation trusts)
-
35 community providers (11 NHS trusts, 6 foundation trusts, 17 social enterprises and 1 limited company)
-
The NHS deals with over 1 million patients every 36 hours
-
The total annual attendances at Accident & Emergency departments was 23.372m in 2016/17, 23.5 per cent higher than a decade earlier (18.922m)
-
The total number of outpatient attendances in 2015/16 was 89.436m, an increase of 4.4 per cent on the previous year (85.632m)
Examples of getting surveillance wrong and potential impact
‘Operation Champion’ - an operation established by West Midlands Counter Terrorism Unit a number of years ago to develop a ring of steel (of ANPR cameras) within a local community. This was considered to have been undertaken without the necessary transparency to the public and despite costing £3m, damaged the trust and confidence of local communities and was never operated.
Edward Snowden and the Investigatory Powers Act. Both comment on surveillance that is the different side, the covert side, to the same coin of public space video surveillance.
Surveillance by State agents should be operated with the highest level of discretion and integrity.
How many people are there here, whose organisations use Body Worn Cameras or ANPR would comfortably testify that these systems are run to the highest levels?
Ok -its rhetorical -but I guess you probably don’t have that level of reassur-ance. And you’re right not too! So how do we achieve the correct balance?
So - what have I tried to do?
I had spoken with the Chair of the NHS Protect Security Group (now dises-tablished) to seek to weave in voluntary adoption of the code - as we have successfully done in an ever growing number of organizations elsewhere.
The annual security standards review group, for a second year voted down the proposal to require all Trusts to complete the Self Assessment Tool.
There was considerable argument and debate around the subject and it was ultimately rejected on the grounds that we could not enforce compliance with none mandatory guidance.
The group stated that, if the guidance was to be mandatory for the NHS then there would be no issue in NHS Protect policing the requirements.
Section 33(5)(k) Protection of Freedoms Act 2012 provides the power for the Secretary of State to create a Statutory Instrument to include additional organisations as being a ‘relevant authority’ who must have regard for the code.
To me this seems the only logical way forward. The chair of this group has tried to get NHS Bodies to voluntarily adopt the Secretary of State’s code and failed as it seems that the NHS will only act on mandates, and so he has tried to make it a security management required standard and failed on the same grounds.
So, in 2016, I wrote to government Ministers recommending that they should consider broadening the list of relevant authorities to include the NHS for England and Wales.
Ministers, at this stage were of the view that we were making good progress at that particular time, not only with voluntary adopters of the code, but with the advent of our National Surveillance Camera Strategy. They did however write to Minister of Health to urge greater degree of co-operation by the NHS on a voluntary basis!
Why do I persist? - I shall re-iterate
Hospitals and other healthcare providers have many millions of people pass through their doors – both people who are sometimes at vulnerable points in their lives and the families and friends who visit. Staff are also subject to assaults – over 64,000 in 2014/15. Surveillance cameras play an important role in maintaining public and staff safety, preventing and resolving crimes yet beyond the management of personal data they are not subject to scrutiny and standards and therefore can we be reassured that they are fit for purpose and doing what they are meant to be doing.
Why shouldn’t the NHS be included in a mandate to raise the standards of surveillance camera use?
I believe it’s a real risk for the NHS family to ignore the code and doing so would risk reputational damage through appearing unwilling to engage with the public or follow good practice. I have no powers of sanction or enforcement.
However –It’s not all sweetness and light-I do use my Annual Report to Parliament to highlight compliant organisations and those with much to do. I see that as an option with NHS to further persuade government if necessary.
Maintaining public confidence is an incentive for complying with the code.
Last month I wrote again to my new Minister -Nick Hurd -Minister of State for Policing and the Fire Service. I reminded him that the government’s approach to this legislation is incremental - Paragraph 1.2 of the Surveillance Camera Code re-iterates that.
I reminded him that I committed to conduct a review of the operation and impact of the code in 2016 -which I duly completed. Within that I called for an expansion of organisations within the relevant authority status.
I found then and I find now the argument for the NHS inclusion in the list of statutory relevant authorities to be compelling. I remain committed to the view that;
- any organisation in receipt of public monies /publicly funded ought to be designated a relevant authority
- any organisations having obligations under the Human Rights Act should be designated a relevant authority
- any organisation having capabilities under the Regulation of Investigatory Powers Act 2000 should be designated a relevant authority
I’m not sure my argument was any stronger this time than it was last year - I just delivered it a bit louder as the case remains compelling!
I’m pleased to say that this situation is now being reviewed by the Home Office - together with the Surveillance Code in light of GDPR.
Many of you will be aware that the government is engaged in a consultation exercise regarding the placing of CCTV in abattoires. I have responded to that consultation requesting that, if introduced, it be in line with the Surveillance Camera Code of Practice.
If the arguments proffered by the government about CCTV applies to protect the welfare of pigs and cows it ought to apply to patients in NHS Hospitals.
You will soon hear from Mike Lees -NHS Barnsley - I hope he feels I have set the scene for him and not stolen his thunder. I take the view that repeating a message can be powerful and informative. Mike demonstrates the bright new uplands of well run security operations! I spoke to the Chair of his NHS Barnsley and he was very clear - If Mike gets this right it makes him feel warm about his whole security operation. It keeps people safe, with confidence.