Thursday, August 31, 2017

We need more oversight on police spying

Over the weekend, we learned that the police had illegally spied on blogger Martyn Bradbury, demanding his bank records as part of their "rawshark" investigation while relying on the Privacy Act's law enforcement exception. As in the previous case of Nicky Hager, the Privacy Commissioner ruled the spying unlawful because the police had provided no justification for the search; furthermore, given the sensitivity of the information, they should have sought a (judicially-approved) production order instead.

Bradbury is now off to the Human Rights Review Tribunal in search of damages, and rightly so. The police invaded his privacy. In his case, it had significant consequences, with the bank refusing him credit essentially on the basis of police defamation. This in turn led to significant personal consequences for him. Both the police and the bank are on the hook here, and they need to be forced to pay, both to right the wrong and pour encourager les autres.

But beyond Bradbury's case, this seems to be a growing problem. Police do thousands of these sorts of information requests a year, including hundreds to banks. And there's no oversight of any of them. The practice of privacy invasion and poking through our most sensitive private details is so routine the police don't even bother keeping proper records of it:

A Police National Headquarters spokeswoman said it had yet to "consider the full impact of the Privacy Commissioner's ruling".

She said there was "no centralised system that records the number of times police may have obtained such records".

The system didn't exist because "there is currently no business requirement to do so" - the same answer then-assistant commissioner Malcolm Burgess gave in early 2015 amid an outcry over police using the exploit to get bank, electricity, travel and other records without a legal order.

No centralised records means they can't even count the number of requests, let alone review them to ensure that the police use their powers proportionately. Its highly convenient that an intrusive and proven to be abused practice is not tracked in this way. But its also completely unacceptable. The police have had multiple rulings that this practice is in some circumstances abusive and unlawful. The onus is on them to ensure that they obey the law, and it would require only a small administrative change to do so. Instead, it looks like they're deliberately colluding to cover up unlawful conduct by investigating officers.

Transparency and review are solutions here. The police are required to publish annual statistics on search and interception warrants and how effective they are so that we can see whether they are abusing their powers. They should be required to do the same for production orders and "maintenance of the law" requests. It would be a simple law change; is there an MP who wishes to stand up for the public against police abuse?