A post script about RIPA

pic courtesy of Flood G. on flickr (creative commons - thanks)

A short while ago I wrote a post about social workers carrying out surveillance of families that they work with, which has attracted a certain amount of attention. You can read that post here : Social work spies? (Yes, you over there I'm talking to you...).

I've had an email from a data protection officer at a local authority expressing concern that the article isn't correct, so I thought I'd better address it. I'm confident that I haven't in fact got the law wrong, but I thought it would be useful to explain why - and where I think wires have got crossed.

The DP Officer says this :

RIPA only applies to criminal investigations. She could never get an authorisation as it has to amount to a criminal offence for 12 months or tobacco or licensing.

For non- criminal matters you could do a RIPA type proportionality and necessity test but it falls outside the ambit of the RIPA regime as the Inspectors have previously confirmed. 

Lets break that down.

RIPA only applies to criminal investigations?

RIPA isn’t just about criminal matters at all. It defines what surveillance is and how it can be rendered lawful. An authorisation acts as a shield against civil liability (see s27 RIPA). Such potential civil liability might be framed in a number of ways, but might for example arise from the interference with Article 8 rights that covert surveillance would undoubtedly represent.

An authorisation can only be granted if it is necessary on specific grounds. Those include but are not limited to criminal matters :

in the interests of national security;

for the purpose of preventing or detecting crime or of preventing disorder;

in the interests of the economic well-being of the United Kingdom;

in the interests of public safety;

for the purpose of protecting public health;

for the purpose of assessing or collecting any tax, duty, levy or other imposition, contribution or charge payable to a government department; or

for any purpose (not falling within [the above] which is specified for the purposes of this subsection by an order made by the Secretary of State.

A narrower list applies to intrusive as opposed to directed surveillance, but the point is RIPA is about the lawfulness of surveillance in general - not about surveillance only for the purpose of a criminal investigation. If further proof of that were needed, see the Home Office Code of Practice which I quoted extensively from in the original post : whilst much of it relates to police activity, there is substantial coverage of surveillance by local authorities.

Ok, next part :

Could a local authority get an authorisation?

It is quite right that a LA could probably not get an authorisation for the sort of social work snooping I’ve described. Although it is possible to see how the sort of covert surveillance we're talking about might fit under a number of the non-crime headings above, the effect of RIPA insofar as it related to local authorities was adjusted in 2012 :

  • firstly via the Protection of Freedoms Act 2012, which prevented LAs from granting their own authorisations (they now have to go via a JP),
  • and secondly via the Regulation of Investigatory Powers (Directed Surveillance and Covert Human Intelligence Sources) (Amendment) Order 2012, which limits the types of local authority investigation that can be authorised - as our correspondent suggests to serious crime and (somewhat randomly) tobacco and licensing. So as far as local authorities post 2012 goes, the list of potential authorisation grounds is considerably narrowed.

So, whilst it might have been possible to obtain a RIPA authorisation for this stuff up until 2012, it doesn't seem to be possible now.

In my original post I identified all of this, saying :

Since 2012 there are heavy restrictions on what authorisations local authorities are allowed to grant/ apply for (as far as I understand it they are only permitted to authorise directed surveillance where it is for the purpose of preventing or detecting crime or of preventing disorder, and even then only in relation to certain specified types of crime), which is not going to apply for much of what we are looking at. Any authorisation is likely to need judicial approval (from a JP), and it needs to be in place BEFORE you start snooping (see 4.42)...

I did not say in terms that no social worker could ever get an authorisation for this sort of surveillance, but I did say that it was pretty unlikely / challenging and nobody who read my post carefully should have been under any illusion that they could simply grab an authorisation off the shelf and carry on as they were. Having sketched some of the potential difficulties, I made clear I wasn't going to get in to the detail of the authorisation regime, and that was because the primary purpose of the original post was to encourage professionals to appreciate and confront the fact that what many are doing (and apparently normalising) is in fact covert surveillance, and it is an interference with Article 8 right to privacy of private individuals. Which may have no lawful basis in the absence of a RIPA authorisation.

For the avoidance of doubt I don't think one can simply say that because RIPA no longer offers a route to authorisation a local authority 'isn't covered by RIPA' and can do whatever it likes with impunity. Whilst Article 8 arguments are unlikely to render the product of covert surveillance inadmissible in children proceedings, because of the countervailing Article 8 and other rights of the child, that does not mean that a civil claim for an interference of Article 8 might not be brought against a local authority if the facts were right. RIPA may not provide the answer, but a discussion of its definitions seemed like a useful framework for raising awareness of the intrusive, contentious and potentially risky conduct that some social workers are engaging in.

So how can we do this stuff lawfully?

My correspondent mentions in her email that I am not a criminal lawyer. I'm not. Nor am I a data protection lawyer. This is not my specific field, but it is an area of crossover, and family lawyers (as well as social workers) need to develop their knowledge in these areas. I don't hold myself out as any particular expert in the area, but I have taken care writing this and the previous post and have cross checked my view with others on the issues above, who have greater expertise than I and who concur.

In my day job I am in the happy position of being able to frown sternly when social workers describe what sounds like covert surveillance, and then sending them off with a flea in their ear to discuss with the legal department before taking another step. I don't usually have to deal with what follows but i do know I don't much like the idea of receiving a brief for a case that is dependent upon covert surveillance of a family by a social worker. It makes things very murky and is a distraction. My view from the perspective of the one who has to run the trial and try and protect a client against Human Rights Act claims, is : spell out in words of one syllable at the start that you are going to be checking up on the family so there is an expectation and an understanding that there is a necessary level of intrusion for a specified purpose. My broader advice to social workers was to go the legal department or relevant designated officers within the local authority to seek guidance before carrying out surveillance. That advice stands.

I'd be interested to know from those who work in local authority legal departments what their experience is of claims and complaints being made arising from covert surveillance by social workers (I'm not aware of any but guess there must be at least some and if there aren't it must be only a matter of time), and whether anyone else can think of any mechanism by which the risk of such a claim can be removed or reduced (is there any other framework for rendering this type of Article 8 interference lawful that I am missing? for example the police can use PACE to do some things and those don't need a RIPA authorisation). Quite apart from civil claims under the Human Rights Act I wonder whether there is a risk of adverse Ombudsman decisions, or of regulatory issues for social workers with reference to the HCPC code. There are also potentially significant issues in terms of GDPR / data protection. Thoughts welcome.

A footnote for parents

Parents should also understand that the fact that evidence has been obtained through covert surveillance does not necessarily mean that the court will disregard it, or that a claim can be brought under the Human Rights Act. As with cases where parents make covert recordings of social workers, the court when presented with such material will have to balance the relevance, strength and importance of the material as against any fairness issues that are raised. Ultimately, if it is likely to be evidence that is going to help the court make sound decisions for a child it may well be considered.

 

Feature pic courtesy of Flood G. on flickr (creative commons - thanks)

Social work spies? (Yes, you over there I’m talking to you…)

pic courtesy of Flood G. on flickr (creative commons - thanks)

I've had this post on my 'to do list' for some time, but have finally been nudged into action by coverage this week of some research on the topic in the Times : Social workers ‘spying’ on families through Facebook (sorry, paywall).

That says that 'Social workers are risking breaking the law because they are using Facebook to spy on families and inform decisions on child custody, academics say.'

This is not news to those of us who act for parents or social workers in these cases (in fact they say custody cases but its clear they are really talking about cases where social workers are involved for child protection reasons, so this would more often arise in care proceedings than disputes between parents). I have been worried about the lawfulness of what social workers are doing for some time, and the low levels of awareness of the potential legal issues - hence my plan to write this post.

What the Times say is that the study they are referring to found '“surveillance” of Facebook accounts was common. Social workers used fake profiles to “friend” parents in cases where their posts were not publicly viewable. They watched parents’ relationships and behaviour, looking out for factors such as abusive partners or drug use.'

Oddly, I've been able to find no trace of this study and it has been suggested that what is being referred to is some sort of leaked draft. No matter, the point is that it chimes with my own experience. Social workers do this stuff because it is a very effective way of seeing whether parents are walking the walk as well as talking the talk. You'd be surprised how often parents will insist that their lifestyle is all Little House on the Prairie, but their Facebook feed suggests its rather more Kardashian (I don't really know who the Kardashian's are but I believe they have big bottoms and very exciting lifestyles). And of course parents/ex partners harvest and produce this stuff too when warring over children or divorce.

Many would say that if it's on a public Facebook page its fair game, and if it shows a child is at risk it should be admitted in evidence (and can you just stop complicating things please, Reed?). Those are reasonable perspectives. But just because something is a good idea or is a means to an end, doesn't mean its lawful. And where it is the state gathering and using this material there is a pretty good chance that it isn't lawful at all (parents need not panic this applies to situations where social workers are looking at and gathering data about private individuals).

So. The law. Do you have a caffeinated drink and a stress ball handy? Then I'll begin. What follows is merely a sketch, not a comprehensive guide.

  • Social workers are employed by local authorities. As such, when they are carrying out their job they are acting as agents for a public authority. The Regulation of Investigatory Powers Act 2000 regulates surveillance of private individuals (you and me) by public authorities (NB same probably also applies to CAFCASS guardians and reporting officers).
  • The 2000 Act regulates this activity not by saying what is unlawful, but by providing a route to give authorisation for specific types of covert surveillance - it's a piece of shield legislation. That is to say that if a public authority sticks to the requirements of the act it is protected against claims under the human rights act. If it doesn't it's fair game and may find itself liable under various bits of law (tort, criminal, human rights, privacy etc etc). Unless of course some other law specifically authorises the activity.
  • Surveillance 'includes monitoring, observing or listening to persons, their movements, conversations or other activities and communications.'
  • It's 'covert' if it is carried out in 'a manner calculated to ensure that any persons who are subject to the surveillance are unaware that it is or may be taking place'.
  • RIPA divides covert surveillance into 'directed' or 'intrusive' surveillance. In short intrusive is surveillance of people's homes and cars. Directed surveillance is surveillance that doesn't qualify as 'intrusive', but is conducted for the purposes of a specific investigation and likely to result in the obtaining of private information about any person.

With me so far? Take a slug of coffee. Continue...

We can see from the above that lots of things that social workers routinely do might amount to directed or intrusive surveillance. Here are some examples that I bet every care lawyer has seen at least once :

  • social worker sitting in their car around the corner from a family home waiting to see if the violent ex turns back up and is let in, or if his car is still there in the morning, or routinely arriving a few minutes early to see if they can catch them out.
  • social worker on unannounced visit when family are out peering in the window and recording the carnage they see inside - or peering over the gate to see if that mouldy mattress or bags of rubbish are still in the garden.
  • social worker arriving for a visit and listening from outside before ringing the bell
  • social worker who sees Mr X and Mrs Y with the children in a car together and decides to follow them to see where they are going
  • social worker checking the Facebook profile of the parents in a case to see what they are up to (relationship status, when they are out socialising, who they are friends with), making a note of these things or screenshotting etc.

This is where most people are going 'Holy sh*t'. That IS covert surveillance. And there is some LAW about it.

Alright, but a public Facebook profile isn't private so it's fine. Right? Nuh uh.

Here's what The Home Office : Covert Surveillance and Property Interference, Revised Code of Practice, August 2018 says :

3.4 Whilst a person may have a reduced expectation of privacy when in a public place,covert surveillance of that person’s activities in public may still result in the obtaining of private information. This is likely to be the case where that person has a reasonable expectation of privacy even though acting in public and where a record is being made by a public authority of that person’s activities for future consideration or analysis. Surveillance of publicly accessible areas of the internet should be treated in a similar way, recognising that there may be an expectation of privacy over information which is on the internet, particularly where accessing information on social media websites...

3.5 Private life considerations are particularly likely to arise if several records are to be analysed together in order to establish, for example, a pattern of behaviour, or if one or more pieces of information (whether or not available in the public domain) are covertly (or in some cases overtly) obtained for the purpose of making a permanent record about a person or for subsequent data processing to generate further information. In such circumstances, the totality of information gleaned may constitute private information even if individual records do not. Where such conduct includes covert surveillance, a directed surveillance authorisation may be considered appropriate.

...

3.10 The growth of the internet, and the extent of the information that is now available online, presents new opportunities for public authorities to view or gather information which may assist them in preventing or detecting crime or carrying out other statutory functions, as well as in understanding and engaging with the public they serve. It is important that public authorities are able to make full and lawful use of this information for their statutory purposes. Much of it can be accessed without the need for RIPA authorisation; use of the internet prior to an investigation should not normally engage privacy considerations. But if the study of an individual’s online presence becomes persistent, or where material obtained from any check is to be extracted and recorded and may engage privacy considerations, RIPA authorisations may need to be considered.

Right, so taking a quick look once on the off chance might be ok - but checking back multiple times and joining the dots. Not so much. Here's the example that they give in the guidance and you can easily translate it onto social workers hanging around a family home :

Example: Officers of a local authority wish to drive past a café for the purposes of obtaining a photograph of the exterior. Reconnaissance of this nature is not likely to require a directed surveillance authorisation as no private information about any person is likely to be obtained or recorded. However, if the authority wished to conduct a similar exercise, for example to establish a pattern of occupancy of the premises by any person, the accumulation of information is likely to result in the obtaining of private information about that person and a directed surveillance authorisation should be considered.

And if you were thinking that it's probably fine where someone hasn't bothered to put any privacy settings on their social media account, think again :

3.13 depending on the nature of the online platform, there may be a reduced expectation of privacy where information relating to a person or group of people is made openly available within the public domain, however in some circumstances privacy implications still apply. This is because the intention when making such information available was not for it to be used for a covert purpose such as investigative activity. This is regardless of whether a user of a website or social media platform has sought to protect such information by restricting its access by activating privacy settings....

See these examples at 3.15, which again have obvious parallels for social workers tasked with gathering evidence to support their assertions about disguised compliance or ongoing relationships etc for the purposes of care proceedings:

Example 1: A police officer undertakes a simple internet search on a name, address or telephone number to find out whether a subject of interest has an online presence. This is unlikely to need an authorisation. However, if having found an individual’s social media profile or identity, it is decided to monitor it or extract information from it for retention in a record because it is relevant to an investigation or operation, authorisation should then be considered.

Example 2: A customs officer makes an initial examination of an individual’sonline profile to establish whether they are of relevance to an investigation. This is unlikely to need an authorisation. However, if during that visit it is intended to extract and record information to establish a profile including information such as identity, pattern of life, habits, intentions or associations, it may be advisable to have in place an authorisation even for that single visit. (As set out in the following paragraph, the purpose of the visit may be relevant as to whether an authorisation should be sought.)

So, how many social workers who think its just part of the job to 'keep an eye' on families who are suspected of disguised compliance, who think its all part of their social work toolkit of 'respectful skepticism', have got a RIPA authorisation for this stuff? How many of their lawyers even knew this was a thing? Gulp... (I'm not being a clever arse here, I too was pretty clueless about this until I had to look it up one time.)

I think the position may be different if there is a clear written agreement in place which says that visits may be made that will be announced and unannounced, because in that scenario the expectations of privacy are somewhat different and the surveillance is not covert. 3.12 confirms that :

where a public authority has taken reasonable steps to inform the public or particular individuals that the surveillance is or may be taking place, the activity may be regarded as overt and a directed surveillance authorisation will not normally be available.

It is important therefore that thought is given to this, and that sufficient attention is paid to the drafting and logging of such agreements. Written agreements or even just writing to a parent to tell them this is how you work are likely to remove much of the risk in this area.

A further thing to think about is interaction via Facebook without being up front about who you are. In my direct experience social workers seem to know that pretending you are someone else in order to extract information is not ok, but I am a member of a number of parents groups on Facebook where this is a real worry and parents are very careful to vet who is allowed access to the groups (I'm open about who I am on these groups btw!). The Times example gives a quote apparently from the research study, from a social worker apparently bragging to a colleague about her fake Facebook profile set up for the sole purpose of 'stalking' parents. Yikes. The guidance says :

3.11 Where a person acting on behalf of a public authority is intending to engage with others online without disclosing his or her identity, a Covert Human Intelligence Sources authorisation may be needed.

Sneaking into a private Facebook group under a pseudonym is a definite no no.

And for members of the independent bar who think its ok for them to have a quick squint and report back to their local authority clients - thats also a no (which should come as no surprise frankly) :

3.17 Internet searches carried out by a third party on behalf of a public authority, or with the use of a search tool, may still require a directed surveillance authorisation...

4.32 a surveillance authorisation should also be considered where the public authority is aware that a third party (that is not a public authority) is independently conducting surveillance and the public authority intends to make use of any suitable material obtained by the third party for the purposes of a specific investigation being undertaken by that public authority.

OK chaps, we're gonna need some authorisations...

Firstly, it's gotta be necessary and proportionate. This involves balancing the seriousness of the intrusion into privacy against the need for the operation. Is it REALLY necessary and proportionate?? Can you get this information another way? (If you can get it by being up front through a notification or written agreement I'd say not). Also see 4.10 :

When completing an application for a warrant or authorisation, the public authority must ensure that the case for the warrant or authorisation is presented in the application in a fair and balanced way. In particular, all reasonable efforts should be made to take into account information which weakens the case for the warrant or authorisation.

Since 2012 there are heavy restrictions on what authorisations local authorities are allowed to grant/ apply for (as far as I understand it they are only permitted to authorise directed surveillance where it is for the purpose of preventing or detecting crime or of preventing disorder, and even then only in relation to certain specified types of crime), which is not going to apply for much of what we are looking at. Any authorisation is likely to need judicial approval (from a JP), and it needs to be in place BEFORE you start snooping (see 4.42). I confess that I have lost the will to live with trying to spell this bit out since Lexis is down for maintenance and I'd need to cross reference two acts and various iterations of the applicable regs to work it all out.

So I'd suggest this. Think hard. Think long and hard about this stuff before cracking on without an authorisation or before applying for one. It's tempting, but it's not always going to be justifiable - or frankly, worth the effort and risk. And find out who the person is in your organisation is that is responsible for this stuff. And get them to provide some training!

Whilst I've referred here to the Home Office Guidance rather than the Act directly, you can see that this is a veritable minefield which many are happily skipping through as if it were a summer meadow.

There are other examples in family law where everyone has been operating under the collective delusion that because we do this stuff it must be lawful. Take the case of Tchenguiz & Ors v Imerman (Rev 4) [2010] EWCA Civ 908 where the Court of Appeal said there was no special rule in the Family Court that sanctioned otherwise unlawful conduct (that case was about a wife taking private documents from a husband to demonstrate his dishonesty about his financial position on divorce, which had previously been thought to be permissible in certain circumstances). See also Prest v Petrodel Resources [2013] 2 AC 415 in which Lord Sumption issued a reminder that 'courts exercising family jurisdiction do not occupy a desert island in which general legal concepts are suspended or mean something different' (See speech of Lord Sumption here and my blog post about it at the time).

Those cases are a reminder that we can't just apply the magic hand wave of family court specialness or mutter something about 'child protection' or 'the best interests of the child' and pretend we haven't noticed. Social workers need advice and support on this and their lawyers should be ready to deliver it. Whilst unlawfulness is not itself a bar to evidence being admitted into family proceedings and relied upon (see here), this will not protect a local authority from privacy / human rights / data protection actions brought by parents.

This is a tricky area. Sometimes this evidence is dynamite and it can be the difference between a child being protected from collusion and concealed risk/harm and a case failing. It might sometimes be the only way of showing that a suspicion is founded in reality - but in reality I doubt that is often so, and in any event our courts quite rightly work on the basis of fairness, and evidence rather than suspicion. What's more it does the social work profession no favours to be seen as going about this with complete disregard for the law and the privacy of families. If you stop and think about it, it is actually oppressive and disrespectful and an abuse of power, and can only further damage the ability of social workers to gain an understanding of the strengths and weaknesses of families, and to assess their honesty through a mutually trusting professional relationship.

Conclusion : Must do better (All of us).

POSTSCRIPT - see here for my postscript of 3 April.

Feature pic courtesy of Flood G. on flickr (creative commons - thanks)

CPConf2018

The third Child Protection conference supported by The Transparency Project will take place on Saturday 15th September 2018 at the Conway Hall in London.

In 2015 the question asked was whether the Child Protection system was fit for purpose?

Having concluded that sadly the answer was ‘no’ CPConf2018 hopes to continue the success of discussions from some very different perspectives on the system, including social workers, lawyers and parents who don’t often – or at all – get the opportunity for open discussion on a level playing field. Anyone with an interest in child protection (which hopefully is most people) is welcome to attend.

The issue up for deliberation is ‘future risk of emotional harm’ – how is this a reason to justify removing children from their parents? What are the historical explanations for this, how is it working in practice and how is it defined and perceived by those working in the system, and those subject to it?

The conference will start at 11am and will hear short presentations from

  • Professor Lauren Devine of the University of the West of England,
  • journalist Louise Tickle,
  • parent ‘Annie’ who blogs at ‘Surviving Safeguarding’,
  • social worker Simon Haworth, and
  • lawyers Lucy Reed (me) and Sarah Phillimore of The Transparency Project.

After lunch the plan is to have wider discussions between the audience and panel, which will include Emeritus Professor Andy Bilson who will present the findings of some of his recent research. The group ‘Special Guardians and Adopters Together’ will also produce the findings of their recent survey about how ‘emotional abuse’ is understood by their members.

The aim of the conference is not only to promote discussion about the notion of ‘emotional  harm’ and how it is relied upon in care proceedings, but also to feed into a possible future Transparency Project Guidance Note about the production and content of risk assessments in care proceedings.

Tickets are £30 plus the Eventbrite fee. For more details and how to buy tickets please visit the EventBrite site.

If you can’t join on the day, please follow the discussions via social media hashtag : #CPConf2018