Hawktalk

Data protection policy should return to the Ministry of Justice

The incoming Labour Government has expanded the role of the Department for Science, Industry and Technology (DSIT) by transferring many IT/data related functions from other parts of Government (mainly the Cabinet Office) into DSIT.  The objective is to make DSIT an important driver for economic growth.

In further detail, “experts in data, digital and AI from the Government Digital Service (GDS), the Central Digital and Data Office (CDDO) and the Incubator for AI (i.AI) [have transferred to DSIT] to unite efforts in the digital transformation of public services under one department” (see references).

The objective is to “transform public services and fuel economic growth through science and technology”.  This “will be the defining mission of a revamped [DSIT] department” and comprise the “first steps towards building a modern digital government”.

However, if such objectives comprise the strategic mission for DSIT, the questions that must be answered are:

• How do these economic objectives interact with DSIT’s approach to data protection policy?
• Will there be a repeat of an approach which viewed data protection as sand in the oil of economic progress and an inhibitor to wider data sharing across the public sector?
• Will data protection policy become subservient to economic priorities?

Historical approach to DP policy

For the two decades from 1984, governmental responsibility for UK data protection policy was very problematic.  For instance, the DPA1984 (and DPA1998) were both a minimal implementation of Council of Europe Convention No 108 (and Directive 95/46/EC) in order to have minimal impact on controllers, the economy and provide the minimal protection for data subjects as compared with European standards.

Any data protection specialist who worked with either the DPA1984 or DPA1998 will remember that both sets of legislation were characterised by a weak regulatory regime, diminished rights and both carried a minimal threat of enforcement.

In addition, both DPAs (and FOIA) were enacted under the auspices of the Home Office, courtesy of its strangely named “Liquor, Gambling and Data Protection Unit”.

This meant that the Home Office, which has the political responsibility for functions that were very invasive of privacy (e.g. law enforcement, national security), were also charged with the responsibility of developing policies for protecting data subjects from such invasion.

It can be seen that this represents a huge conflict of interest.  If you have ever questioned why the data protection or FOI exemptions in these early Acts were very expansive when applied to Home Office functions, the answer is, quite simply, staring you in the face!

However, in 2007, responsibility for Data Protection, FOI, Human Rights and related civil society matters were centralised at the Ministry of Justice (MoJ); a neutral Department of State that did not have a vested interest in the processing of vast amounts of personal data for specific public sector functions like tax, housing, health, policing etc.

In data protection terms, the transfer to the MoJ, lifted responsibility for DP policy from a Home Office which processed large amounts of personal data in support of an opposite policy direction.

Why was the MoJ dropped?

The short answer is Micheal Gove MP, when he became Secretary of State at the Department for Education (DfE) in 2011 and thence Lord Chancellor, at the MoJ, in 2015.

In 2011, a FOI request to the DfE included a request to access information contained in Mr Gove’s Hotmail emails to and from his political advisor (“Mr and Mrs Spad”).  Mr Gove’s Department refused the request on the grounds that the relevant emails were private emails and the requested information was therefore not held by the DfE (as they would have been if the official gov.uk email address had been used).

This was despite the fact that the Hotmail communications related to official DfE business.

The FOI request was refused by the DfE and this was followed by appeal to the ICO and the inevitable Decision Notice in favour of the requestor.  Mr Gove’s Department appealed the Notice but the appeal was withdrawn before the Tribunal hearing.  Much, one assumes, to Mr. Gove’s ire.

All became quiet on the Westen Front, until Mr Gove arrived at the MoJ as Lord Chancellor after General Election in May 2015.  On October 15, 2015 he scattered policy responsibility for IT/data related matters to the winds.

For instance, responsibility for:

• Data Protection was transferred to the Department for Culture Media and Sport (DCMS) and thence to DSIT when this Department was formed by Rishi Sunak.
• Data Protection for law enforcement and national security was, in practice, returned to the Home Office.
• Human Rights law (including Articles 8 & 10) was retained by the MoJ.
• FOI and EIR (including DP/FOI/EIR interface) was transferred to the Cabinet Office.
• IT security for personal data processed by the public sector and the HMG Security Framework was managed by the Cabinet Office.
• IT security for personal data processed by the private sector (i.e. now surrounding the ISO27000 series) was developed by DCMS then DSIT.
• ID for Government Services developed by the Cabinet Office via Government Digital Service.
• Digital Verification Services parts of the defunct DPDI Bill were developed by DCMS then DSIT.
• Artificial Intelligence (i.AI) was launched in July 2023 by the Cabinet Office.

So much for joined up government!

Why a return to the MoJ

The Government’s changes, as announced, represent a partial reconstruction of responsibility for the above bullet points around DSIT (the first and the last four bullets from the list above).

The problem is that DSIT, with its enhanced responsibilities for AI, R&D and other technologies is intended to become an engine room for economic growth.  In these circumstances, data protection can all too easily be seen as an inhibitor (as it was with the previous Government).

The risk is then that DPDI-like provisions will re-emerge to provide wide ranging exclusions to ease the secondary use or disclosure of personal data in support of a turbocharged dash for growth.

To minimise this risk and to ensure that data protection is considered with its proper weight, responsibility for data protection policy should be returned to the MoJ.  Leaving DP responsibility in DSIT risks making data protection policy wholly subservient to its economic priorities.

References

Press release about DSIT’s enhanced responsibilities: https://www.gov.uk/government/news/dsit-bolstered-to-better-serve-the-british-public-through-science-and-technology

Post summer Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• Data Protection PRACTITIONER Course is in London (and Zoom) on Monday, 16 Sept to Friday, 20 Sept (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London (and Zoom) on (October 8-10: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

New A.17 right to erasure in the UK_GDPR added during “wash-up”

Although the DPDI Bill is dead, you have probably missed the addition to the right to erasure (Article 17 of the UK_GDPR) which was made during “wash-up” period (last month) via another piece of legislation (the Victims and Prisoners Act ["VPA"] 2024).

In summary, the change in the law concerns what controllers do when there is a malicious complaint (e.g. to social services) and the procedure for removing that complaint, following the conviction of the complainant of a stalking or harassment offence and a finding that the complaint was malicious.  Phew, a number of conditions to explain!

The change to the A.17 can be found in Section 31 of the VPA Act; it deals with malicious reporting cases such as those as Stella Creasy (MP for Walthamstow, in London), which was publicised by the BBC. (See references for all relevant details).  The new right does not apply immediately; it has to be "commenced" by the incoming Government at sometime in the future.

The new right to erasure

The  VPA Act adds a new paragraph (g) to A.17(1). 

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay if…….

“…(g) the personal data have been processed as a result of an allegation about the data subject—

1. which was made by a person who is a malicious person in relation to the data subject (whether they became such a person before or after the allegation was made),
2. which has been investigated by the controller, and
3. in relation to which the controller has decided that no further action is to be taken.”

So who is a “malicious person”?  Quite simply a malicious person is a person who has made an allegation about a data subject AND that person has been convicted of a “relevant offence".  All the “relevant offences” are identified and relate to stalking or harassment;  they are tabulated in new Article 17(5) and there are ten such relevant offences.

Relevant offences include, for example, an offence under sections 2, 2A, 4 or 4A of the Protection from Harassment Act 1997 or section 8 of the Stalking Protection Act 2019.  Other legislation tabulated are the Scottish and Northern Ireland equivalent of these Acts, and specific legislation which deals with harassment and stalking offences committed by members of the UK’s armed forces.

Article 17(5) is accompanied with a new section 13A to the DPA2018 which provides an order making power to amend or add to the list of relevant offences via an affirmative resolution process.

When does the new right apply

Suppose male employee X stalks a female member of staff. The female member of staff reports it to HR and because of the seriousness of its preliminary investigation, the police get involved.  Supposes further there is an eventual prosecution of X for a stalking or harassment offence (i.e. a relevant offence) but the employee X’s defence, as explained to HR, involves scurrilous accusations against the victim.

Now clearly, the female victim might want HR to delete these allegations from her personal data. As there has been an investigation by the employer, a successful prosecution for a relevant offence and the employer has taken no further action against the female victim, then the new right applies to her.  However, this right does not apply to employee X, as the harasser/stalker is most likely sacked (where sacking is an “action”).

In summary, as there was an initial investigation before personal data were handed to the police, they can be deleted in relation to the female victim (no action against her) but retained in relation to the stalker (i.e. records can be kept of the reason for the sacking but not relating also to the victim).

Note that the new right does NOT apply to personal data processed by the police as their processing is likely to be subject to Part 3 of the DPA2018 (i.e. law enforcement processing) and not the UK_GDPR.

Enter Stella Creasy MP

Stella Creasy MP has faced such serious but false accusation concerning her children,  and this has influenced this amendment behind the scenes.  In the House of Lords’ debate the MP was thanked “for the amendments they have tabled on this issue, and their engagement with myself and officials in this area”.

In her case, according to the BBC, in 2023 a man told Leicestershire Police that her children should be taken into care due to her "extreme views".  This was followed by the MP reportedly facing a safeguarding review by the London Borough of Waltham Forest.

She was quickly cleared; the BBC reports that the man had objected to the MP breast feeding her newly born baby in the House of Commons chamber.

As there was a formal complaint to Police and it investigated a "number of emails" sent to the MP (presumably in the context of harassment). However, it was this police referral that triggered a statutory investigation by the Borough, and this explains why the Borough could not delete the personal data (even though it the Deputy Speaker of the House of Commons publicly criticised the "appalling abuse and harassment" Ms Creasy had received).

Because individuals can hold views that are wrong, the BBC reported that Leicestershire Police resolved the issue by “a community resolution rather than a formal sanction because the messages did not meet the threshold for a criminal offence”.

Concluding comment

You will note that the new right does not help Ms. Creasy get her personal data deleted, as the BBC report states that no relevant offence has been committed (see added note below).

This could have an unforeseen consequence; data subjects who are falsely accused by a stalker or harasser might put pressure on the authorities to prosecute in order to engage the new right.  This is preferable, from the victim’s perspective, than to allow the offender to be let off by treating the issue as some kind of misogynistic misdemeanour which results in the victim’s personal data remaining on file.

And that might not be a bad outcome.

Note added on 23/6/2024: there is a Times report dated 3rd December 2023 stating that Leicester Police changed their mind about harrassment and "a man from Wigston in Leicestershire, admitted harassment without violence and was given a 14-week prison sentence suspended for one year, in part because of overcrowding in prisons. He was also given a three-year restraining order and will be required to carry out 120 hours of unpaid work". (see updated references below).

References

The Parliamentary debate about the new right to erasure in A.17(1)(g) of the UK_GDPR: https://hansard.parliament.uk/Lords/2024-05-23/debates/CC504D8F-CC76-4EBB-9FF3-09FD1D2C2E74/VictimsAndPrisonersBill

Section 31 of the Victims and Prisoners Act 2024: https://www.legislation.gov.uk/ukpga/2024/21/section/31/enacted

BBC story “Stella Creasy: Call for action after online troll sparked MP probe” https://www.bbc.co.uk/news/uk-england-london-65463367

Times report (3/12/2023) on the re-opened case: "Troll’s harassment of Stella Creasy one of worst cases judge has seen" on https://www.thetimes.com/article/stella-creasy-labour-mp-online-troll-philip-stacey-guilty-0k9mzzmls

Forthcoming Data Protection Courses

The next Data Protection PRACTITIONER Course is in London on Monday, 16  September  to Friday, 20 September (5 days: 9.30am to 5.30pm).  Remember also our specialist DP qualification for those in Education. 

Details from www.amberhawk.com

Labour should not let the DPDI Bill go through in “wash-up”; it should kill it off.

When a Prime Minister calls a General Election, the Official Opposition in Parliament becomes very powerful.  The reason is that the two main political parties can agree to enact outstanding and uncontroversial pieces of legislation (e.g. in this case, before the end of next week – May 30th).  Parts of the DPDI Bill do fall into this uncontroversial category; but many bits don’t.

In summary, the Opposition can say to Government something like; “we will agree to pass the DPDI Bill if you remove Schedule 11 (DWP powers to access bank accounts), the definition of personal data and the new disclosure arrangements in Schedule 1, paragraph 1” etc.  Alternatively something like: “we will let through the DPDI Bill limited to the DVS elements, ICO changes to an Information Commission and  law enforcement transfers of personal data outside the UK”.

This horse trading is called “wash-up”; it is undertaken in smoke filled rooms, out of the public gaze where FOI is a distant dream.

The problem is that the Labour Party is not opposed to the DPDI Bill; so it could agree to enact something from the DPDI.  That explains why privacy NGO “BigBrotherwatch” has launched a campaign to get its supporters to contact Labour MPs to ensure the DPDI Bill has no resurrection.

If Labour seeks the views of the ICO, he will repeat his oft-expressed (and erroneous) view that he supports this Bill as it presents no risk to data subjects (aaargh).

So in my last missive on the lamentable (but unlamented) DPDI Bill, I thought I would list the items that are in my view controversial in the hope that it helps “Kill the Bill.

Weakening data subject protections

The list is not complete but contains the following; all impact on the rights and freedoms of all UK data subjects.

Personal data: this definition is changed to make it more prescriptive (i.e. less personal data are subject to the DPDI Bill).  This definition, which impacts on all the data protection rights and Principles, does not meet the standard set by the DPA1984, CoE No 108 and GDPR and is a risk to the UK’s Adequacy Agreement with the EU.

Lawful basis: the specification of “Recognised Legitimate Interest” legitimises any voluntary data sharing of personal data from any private sector controller to any public sector controller for its public tasks.  In addition, the further purpose of the disclosure is also likely to be deemed compatible with the purpose of obtaining. The data subject’s right to object to such disclosures is much diminished.

As modifications of lawful basis are not possible with the GDPR, this provision is also a risk to Adequacy.

Marketing: “opt-in” (consent) for third party marketing becomes the exception; “opt-out” (legitimate interests) becomes the new norm. This overturns the “opt-in” consent rule for Third Party Marketing established under DPA1984  (40 years ago).

In my view, this change represents a spammer’s charter for Third Party marketing.

Transfers outside the UK: these transfers are legitimised via powers granted to the Secretary of State (SoS) without direct reference to Parliament (as it follows negative resolution procedures). The provisions allow the SoS to identify specific controllers in a certain country as adequate, even though the country itself is not deemed to be adequate.

This also could threaten the Adequacy Agreement if transferred personal data from the UK contains personal data that has originally been transferred from the European Union.

Data subject rights: the presumption that automated decision-taking is prohibited, is removed. This means that automated decisions using Artificial Intelligence (AI) techniques are likely to become the norm in the UK.  There is very little protection for UK data subjects except for making complaints after an AI decision has had an effect on them.

In addition, DPDI specifies that a data subject complaint is first directed to the controller. This will add a further month and a half delay before the data subject can complain to ICO (who often takes 4-5 months to allocate a case-worker).

This means delays of half a year or more concerning an automated decision can be expected.  Such a time delay does not protect the data subject’s interests; it protects the controller’s interests.

Research (RAS) processing: it becomes easier to share personal data for RAS purposes, in the absence of transparency to data subjects, so long as certain safeguards apply (see next bullet). Consent as the lawful basis for RAS is likely to be replaced by “legitimate interests” or “public task”. Existing databases can be used and disclosed for RAS purposes and the “scientific research” definition is expanded to cover AI research and development.

There is a considerable risk that, to facilitate AI research and development,  there will be disclosures of personal databases in the legitimate interest of Third Parties and onward to further Third Parties in their legitimate interests, again in the absence of transparency.  This “Wild West” approach to data-sharing is likely, in my view, to result in major data breaches or significant AI harm to individuals.

Research (RAS) Safeguards: The safeguards for data subjects associated with RAS purposes (mentioned above) are not particularly “safe”. For example, one safeguard is that the RAS disclosure does not cause “substantial damage or substantial distress”; this means that moderate damage or distress is perfectly acceptable to Government.

The Regulator: the ICO becomes an Information Commission where voting members of the Commission are all selected by SoS. Such self-selection puts at risk the regulatory independence of the UK and has knock on implications for the Adequacy Agreement.

Codes of Practice: Codes are still not produced in an independent manner in the UK. Although the SoS does not to approve the final text of a Code (as originally intended), it is possible for the SoS to recommend that Parliament vote down the Code.  As the SoS’s political party form the majority of MPs, the SoS veto over the text of Codes of Practice is maintained.  (btw the ICO thinks the veto has gone).

National security: the SoS can designate personal data processed by the police as being of interest to GCHQ. MI5 or MI6. The result is that the personal data, once designated, move from Part 3 of the DPA2018 to Part 4.  This then means that any processing of designated personal data fall outside the DP enforcement regime.

This reason for this designation mechanism has never been explained. However, it provides an alternative, for example, that could permit a bulk ANPR database that the police use to monitor traffic on UK roads being subject to national security rules for data protection purposes.

Forget bulk data transfers and the statutory restrictions and protections found in Investigatory Powers legislation; instead think designated databases under DPDI Bill and total freedom from ICO regulation.

Codes of Conduct: Law Enforcement Codes of conduct can be produced by expert Law enforcement bodies covering their own processing. If approved by a (SoS compliant) Information Commission, these Codes can specify that the processing described in a Code complies with Part 3 data protection obligations.

The prospect of controllers establishing that their own processing is compliant with DP law, by reference to a Code of Conduct they produced for themselves, is pure Alice in Wonderland.  It obviously risks reducing the protection afforded by data subjects

DWP Powers: the Department for Work and Pensions (DWP) want to obtain financial details from financial bodies to use AI techniques to identify whether any payment to any claimant is correct (e.g. benefit, pension, allowance).  As powers to demand these details when there is suspicion of fraud already exist, these new powers do not need any suspicion of fraud.

An “account information notice” from the DWP can demand details from accounts of those connected to a benefit recipient (e.g. of a family members).  So potentially these powers involve half the UK population (e.g. child benefits; OAPs, benefit recipients).

Even the ICO has identified a likely A.8 ECHR problems (ICO says “I do not think the current drafting is sufficient to ensure this [proportionality]”.  Note the ICO does state the obvious:  that there is lack of an A.6 lawful basis that could be subject to his enforcement powers.

International Agreement: there is a new lawful basis of “necessary for the purposes of responding to a request made in accordance with the Agreement … [between UK and USA Governments] … on Access to Electronic Data for the Purpose of Countering Serious Crime signed 3 October 2019”. This sets a precedent for other similar International Agreements having a similar lawful basis.

Again the ICO is on record as saying this change is unnecessary.

Conclusion

For the above reasons(and more), the data protection elements of the DPDI Bill should NOT be subject to the Parliamentary “wash-up” mechanism.  The Bill should be killed off.

This is especially the case as Government Ministers still claim that this DPDI Bill maintains a high level data subject protection and at the same time eases the load of controller compliance, when this is demonstrably wrong.  Quite simply, this Government cannot be trusted with data protection.

However, before you rest easy, the Tony Blair Foundation has plans for the wider use of NHS data to make large financial gains for UK Plc whilst maintaining the highest degree of patient confidentiality.

“Hang on a second; haven’t I heard this before?”  I therefore suspect that a further DP legislation is on the horizon after the Election.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture.

• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Data Protection PRACTITIONER Course is in London on Monday, 8 July to Friday, 12 July (5 days: 9.30am to 5.30pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected].

DPDI Codes of Conduct allow competent authorities to write their own DP rules

If, on April 1^st,  I reported that a cabal of controllers could club together and draft a Code of Practice that establishes their legal compliance with the UK’s data protection regime, you would probably say that this was too far-fetched to be true. Yet this is the procedure that has been put in place by our the Government for all law enforcement processing of personal data.

The grim detail can be found in Clause 68A of the Data Protection and Digital Information (DPDI) Bill.  The production of law enforcement Codes of Conduct (as they are called) does not have to involve any data protection expertise, nor the ICO, nor does the text require Parliamentary approval nor does a Code have to consider its impact on data subjects.

Yet, law enforcement processing often comprises the most sensitive of processing.

In addition, the DPDI Bill’s procedure for Codes of Conduct compares starkly with Codes of Practice (which does involve, by law, data protection expertise, impact on data subjects and the approval of the ICO and Parliament).

How Codes of Practice are produced

The DPDI Bill specifies that the ICO has to reissue the Data Sharing Code of Practice, the Age Appropriate Code, and the Journalism Code to accommodate the changes in the DPDI Bill.  As is well known, the Direct Marketing Code has been held up until the range of non-consensual marketing rules of the DPDI Bill become law.

Additional Codes of Practice can be produced on the instructions of the Secretary of State (SoS).

All these Codes follow the same procedure.  This first involves consultation with the SoS and other specified parties that have an interest in the production of a Code. This could involve a preliminary scoping document covering the need for a Code.

For example, a revised data sharing Code will have cover the voluntary data sharing arrangements for disclosures of personal data from the private sector to public sector controllers arising from the introduction of the “Recognised Legitimate Interest” lawful basis.  The revised Code also has to accommodate the weakened data subject’s right to object to such disclosures using this lawful basis.

The text of Code is first drafted by the ICO.  This is then considered by a panel of experts, chosen by the ICO for their knowledge of the subject; this panel then produces a report on the draft Code.  The panel of experts includes representatives of “persons likely to be affected by the Code” as well as representatives from data subject facing organisations.

This expert panel report can suggest modifications to the draft Code; the ICO can reject or accept some or all of the suggestions. Details of any rejection from the panel of experts has to be made public.  The Code (if modified) is then subject to an impact assessment.

This procedure is also followed for significant amendments to existing Codes.  However, for reasons unexplained, the analysis of a panel of experts can be dispensed with, if the Code is an additional Code produced following instructions of the SoS.

The Code is then submitted to the SoS for comments which are made public (if the SoS has any).  The ICO has a choice: he can reject SoS’s comments;  withdraw the Code, or submit a “revised” Code to accommodate them. The Code is then laid before Parliament by the SoS.

Note that if the ICO rejects the SoS commentary, the SoS can ask Parliament not to approve the Code.  In this way, the SoS still retains the “whip hand” if there is disagreement over the Code’s content.

How Codes of Conduct are produced

Let’s assume there is a need for a Code of Conduct covering facial recognition cameras as used by law enforcement agencies.  How would such a Code of Conduct be developed?

First the ICO identifies “expert bodies” who are “encouraged” to produce a Code.  Note that the identification is of expert bodies and not expert individuals.  In other words, there is no obligation placed on expert body, to choose from its ranks, an individual who has requisite expertise in data protection.  Note also, the expert bodies can reject the ICO’s encouragement.

These expert bodies are then also “encouraged” to submit their Code of Conduct to the ICO in draft.  In other words, the drafting of the content of a Code of Conduct can emerge without any submission of its text to the ICO.

If a draft Code of Conduct is submitted to the ICO, the ICO can express an opinion on a Code, decide to approve the Code, and publish the Code if approved.  Of course, this provision does not apply if the Code is not submitted to the ICO.

There is no requirement for the ICO to publish his or her opinion on a particular Code of Conduct (e.g. to explain why approval was not granted).  Codes that have not been submitted to the ICO for approval can still be published without any commentary from the ICO.

There is no requirement for an Impact Assessment (e.g. impact on data subjects) nor is there a requirement to seek Parliamentary approval of a Code of Conduct’s content.

One can easily see a situation where the ICO does not like a Code of Conduct and expresses some contrary views on its proposals.  The response of the expert bodies could well be to press ahead with that Code of Conduct without any further involvement of the ICO.

This could especially be the case with, for example, if a populist Government wanted to skew law enforcement policy in a specific direction (e.g. wanted facial recognition cameras to target those who have pre-booked seats on flights to Rwanda).

Remember the ICO is to be replaced by a Commission where all the voting members of the Commission are appointed by the SoS.  Additionally, the SoS might express a view that a strong emphasis on law enforcement should be a strategic priority for the Commission.

All these possibilities could put pressure on the Commission to approve the Code of Conduct produced by the law enforcement agencies.

Once a Code is “approved” by the ICO, then the text may be used to demonstrate compliance with the law enforcement requirements (see Clauses 56(4) and 59(7A) of the DPDI).

In this way,  public bodies producing a Code of Conduct effectively are drafting text that determines how data protection law applies to their controversial area of law enforcement processing. This "lawfulness" is without any reference to the Courts, Parliament, Impact assessment on data subjects nor any detailed privacy analysis from the ICO.

The ICO has not objected to such a prospect.

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our specialist DP qualification for those in Education. Next course on June 11th, 12th & 18th 2024

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).

Government extends privacy protection to bequests made to the Conservative Party

Late on Good Friday (a very good time to bury “bad” news), the Government quietly tabled an amendment to the Data Protection and Digital Information Bill  (DPDI Bill) which extends the definition of personal data to include bequests and comments, made by a deceased, in his or her will.  The ICO has welcomed this amendment as a positive change to the law.

Although the amendment makes a somewhat quirky change to the Wills Act 1837,  an impeccable sauce has indicated that its main motive is to protect the privacy of bequests of large financial donations to the ruling Conservative Party.

Because the amendment is to a later Schedule of the Bill, it is expected to be debated towards the end of Committee stage in late April.

Amendment to Wills Act 1837

In further detail,  the unassuming amendment reads as follows:

At Schedule 12, page 270, line 8, insert new paragraph 29  (into the DPDI Bill)

29        WILLS ACT 1837

Insert into section 1 of the Wills Act, after the words “section 8 of the Human Transplantation (Wales) Act 2013…”, the following:

All personal information contained in a will shall be treated as if it were personal data (as defined in Section 3 of the Data Protection Act 2018) except when applied to the rights granted to data subjects as specified in Articles 12 to 22 of the UK_GDPR.

Following the amendment, there is a brief explanation of the impact of the change in the law.  This reads:

Minister’s explanatory statement

This amendment protects personal statements and bequests made by a deceased person in a will.  It ensures the deceased, when drafting a will, can be assured of the confidentiality of any bequest, after death.  The amendment also clarifies the law so that the recently deceased cannot exercise their data subject rights under the UK_GDPR.

Speaking on the new GBNews, Sunday breakfast, talk-show (“In The Pub with Lee Anderson MP”),  ex-GBnews presenter Esther McVey MP,  known by the tabloid press as the Minister for Common Sense, expanded on the amendment. She said:

“The amendment is a total realisation of the benefits of Brexit.  The UK is seizing back control of its laws by extending privacy protection to the wills of the newly departed.  The deceased will sleep more serenely in Heaven, secure in the knowledge that their privacy is maintained on Earth, from the moment they leave”.

Lee Anderson MP added a more practical observation:

“The text of wills can be very controversial, especially if the recently deceased leaves, in a will, a “parting shot” at his or her partner or another member of the family.  Such information is rightly protected from the do-gooders, neigh-sayers and anti-Brexit re-moaners who are jealous that their trivial political pursuits do not attract large financial donations from the dead”.

He added “where I come from, up North, we recognise the dead know a thing or two”.

ICO has also welcomed the clarity of the new amendment.  In a statement on his website, the ICO said:.

“I  heartily support the spirit of this amendment and I assure the British public that I shall enforce the new provision as robustly as I enforce the UK_GDPR and DPA2018 currently”.

“As a New Zealander, I am well attuned to a cultural tradition that embeds immense respect for ancestral history: “Hanga koa i taku gin me te tonic”, he added in Māori.

And finally…

Remember my Petition requesting the Government to implement the EU’s AI Act as part of the DPDI Bill is on that Parliamentary web-site: https://petition.parliament.uk/petitions/652982.  Please consider signing it and passing it to your colleagues to consider signing.

Details  reasons why you should sign the Petition are on my Hawktalk blog: https://amberhawk.typepad.com/amberhawk/2024/03/petition-calls-for-implementation-the-eu-data-act-to-protect-data-subjects-from-ai-abuse.html

Forthcoming Data Protection Courses

The following BCS Practitioner or Foundation courses can be attended in person, or via Zoom, or as a mixture (i.e. part Zoom, part attendance just in case “stuff happens on the day”).

• All-day Zoom workshop (10.00-4.30)  on the DATA PROTECTION AND DIGITAL INFORMATION BILL held on Thursday 9 May.
• Data Protection PRACTITIONER Course is in London on Monday, 13 May to Friday, 17 May (5 days: 9.30am to 5.30pm).
• Data Protection FOUNDATION Course is in London on (July 2-4: Tuesday to Thursday, 3 days: 9.45am to 5.00pm).
• Remember our new specialist DP qualification for those in Education.

More details on the Amberhawk website: www.amberhawk.com  or email [email protected] (e.g  for. DPDI workshop agenda).