Some readers may know that in 2004, I made a FOI request to the European Commission to obtain details of possible infraction proceedings brought against the UK Government by the Commission. The Commission claimed that legal proceedings might be needed as the Data Protection Act did not properly implement the parent Data Protection Directive (95/46/EC).
The reason for my renewed interest in this subject is the Court of Appeal’s linkage between the “purpose of the processing" as used in three data protection principles and the “purpose” as notified to the Information Commissioner (see last Thursday and Friday’s blog). I have discovered that this linkage does not appear in the list of possible infractions identified by the Commission back in 2005.
Then, the Commission claimed that Articles 2, 3, 8, 10, 11, 12, 13, 22, 23, 25 and 28 of the Directive had not been implemented properly by the UK Government – just under a third of the Directive. These Articles relate to: the definitions used in the Directive; the scope of the Directive's application to manual files; the conditions when sensitive personal data can be processed; the fair processing notices give to individuals; the rights granted to data subjects; the application of exemptions from these rights; the ability of individuals to seek a remedy when there is a breach; the liability of organisations for breaches of data protection law; the transfer of personal data outside European Union; and the powers of the Information Commissioner.
Although the Commission eventually identified the Articles subject to possible proceedings, both Commission and the UK Government have consistently refused to provide any other specific information about the disputed implementation.
I now think the linkage introduced by the Court of Appeal also damages the UK implementation of Articles 6, 7, 14, 18 and 19. For example, the three Principles themselves (Article 6) and those parts of the Directive that relate to the purpose of the processing (Article 7(f)) or Article 14 (the data subject’s right to object to the purpose of the processing). In other words, half of the Directive’s Articles are now possibly defective.
It is important to stress that the notification requirements in Articles 18 and 19 of the Directive are also now improperly implemented: these Articles modify the “purpose of the processing” to permit simplified notification of the purpose to the Commissioner BUT NOT any other linkage.
In fact, thanks to the Court of Appeal, the UK Act linkage between “purpose of the processing” and the notified “purpose” has arguably allowed for the defective implementation of any Article or Principle that uses the word “purpose”.
Perhaps the last paragraph is too far. But if I am correct in my analysis, many Directive provisions that rely on the word “purpose” are compromised. It follows that certain “fractious” events might happen sooner than one thinks.
Reference: for original commentary on the infraction proceedings please look at http://www.out-law.com/default.aspx?page=8472. Durant v Financial Services Authority [2003] EWCA Civ 1746. If anyone wants a comprehensive analysis of Durant, just e-mail info@amberhawk.com with “Durant Heaven” in the subject title of the e-mail. I will then send you your Xmas reading!
Comments