Mission creep par excellence? Germany considers using road toll data for police purposes

Once personal data have been collected, new ideas will emerge about useful things that could be done with them — even if that flies in the face of data protection. This is often alleged by privacy advocates, and once more about to be proven true by authorities in Germany.

When the country installed its admirable (and long delayed) high tech system for automatizing road toll data handling about a year ago, using 300 cameras, GPS positioning and mobile control teams on 12000 kilometers of autobahn for charging or controlling trucks' payments, it was clear that the data thus gained would not be allowed to be used for other purposes. Indeed, a paragraph in the law establishing the system states explicitly:

“These data can only be processed and used for the purpose of monitoring the compliance with the rules laid down in this law. A transfer, use or confiscation of these data is inadmissible.”
(§ 7, 2 of Autobahnmautgesetz [version of 2.12.2004]).

Now, barely a year after the system has come into existence, a death case involving a truck driver on an autobahn truck stop is being used as an excuse to move the goal posts and give policy access to the data collected by the system. As SPIEGEL online and tagesschau report, authorities may be allowed to use the data to fight terrorists (!) and capital criminals. They are following a demand from the Association of German Detectives who claim that cases like the aforementioned one could more easily be solved if existing restrictione on toll data use were being lifted.

Politicians from the opposition Green and Leftist parties have already protested against the plans; but Germany's Federal Data Protection Officer in an interview with national television seemed not to mind very much. Experts, however, have questioned the usability of the system for monitoring traffic in real time as its data processing capability was too restricted for this (see the report in today's Sueddeutsche Zeitung, pp. 1 and 4).

If the rules will be changed to allow police to make use of them, it would indeed be an excellent case of “mission creep” — compare the case of US airline passenger data in this blog.

Passenger flight data: European Court might annul EU / US agreement

In the case about the transatlantic transfer of flight passenger name records (PNRs), the European Court may annul the agreement between the European Union and the United States.

The case had been brought before the Court by the European Parliament in June 2004. It argued that the agreement between the European Commission and the United States signed in May 2004 about transferring no less than 34 variables from passenger name records to US authorities, ranging from names and addresses to meal preferences and health information, was violating the European Union's own data protection legislation.

Now the Advocate General has published his opinion on the case, and he recommends that the Court annul the agreement (see his vote in English language). While the opinion of the Advocate General is not binding on the Court, the Court often follows his or her opinion.

UK plans "24x7 vehicle movement database"

A strategy document written by Britain's Association of Chief Police Officers (ACPO) and obtained by the Sunday Times (see article online) indicates that the UK will soon have a system in place that makes it possible to monitor the movement of every car on the road around the clock. (See also the article in The Register).

Cameras are to be installed "every 400 yards on motorways, as well as at supermarkets, petrol stations and in town centres". The system will work by combining CCTV cameras with automatic number plate recognition (ANPR) software and linking it to existing databases not only on the police national computer, but also to the DVLA (Driver and Vehicle Licensing Agency) database that carries information about tax and insurance status. It is planned to extend that to a database that lists vehicles without a valid MOT certificate.

Given that details of any vehicle passing a camera will be stored in a database for at least two years — even if the owner has not committed an offence — this will indeed create a mobility profile for every driver in the United Kingdom. It seems noteworthy that the system will largely come about through the linking of existing systems such as speed cameras, ANPR software, and online-accessible databases. However, this demonstrates how through the linking of existing systems a new quality of data can be obtained.

It is further planned that officers investigating crimes will be able to access the information from the new system from computers anywhere in the UK, although they will require clearance from senior managers. How effectively such a system can be used was demonstrated last Friday in the case of the shooting of a woman policy officer in Bradford: within minutes of the incident, a combination of a network of CCTV cameras and ANPR software was used to track the suspected getaway car (see BBC report and the discussion on slashdot).

As a West Yorkshire Police spokeswoman describes it: "When a car is entered on the system it will 'ping' whenever it passes one of our cameras, which makes it a lot easier to track than waiting for a patrol car to spot it." The local police chief described the system upon introduction last May as the "best investigative tool we have had since the introduction of DNA analysis."