Hawktalk

Commission acts on a deficient UK Data Protection Act - at last

The European Commission will no doubt expect plaudits for its request to the UK Government to change the Data Protection Act so that it meets the standard established by the Directive 95/46/EC. In practice, the Commission should answer questions as to why it has taken over seven years to reach a conclusion which has been obvious to data protection experts from the time of the Durant decision back in December 2003.

Since that time, the Commission has stood on the sidelines with respect of deficiencies in the UK’s Data Protection Act. It has waited until there has been a change of UK Government and for a situation to develop where over the 50% of the Articles in the Directive have been defectively implemented.

Don’t believe me? See the references at end where you will find that problems have been identified, mainly by the Commission, with respect of the UK Act’s implementation of Articles 2, 3, 6, 7, 8, 10, 11, 12, 13, 14, 18, 19, 22, 23, 25 and 28.

Some readers will also know that I have been pursuing various FOI requests with the Commission and since 2005, I have been trying to liberate why the Commission thinks there are problems with the UK Data Protection Act. This culminated in January, this year, when the Commission pointedly refused to follow the advice of the European Ombudsman to publish limited details of its assessment of these inadequacies.  In effect, the Commission has augmented seven years of inaction with seven years of secrecy.

I hope that you can now understand why I am not cheering from the rafters when the Commission expresses sudden concern about “the implementation of the EU’s 1995 Data Protection Directive (95/46/EC) both in UK law (the Data Protection Act of 1998) and its application by UK courts”.

Instead, I have some pointed questions to ask. For example, when the Commission’s uninformative press release says that it “has worked with UK authorities to resolve a number of issues”, I respond by saying “what were these problems? what was the resolution of them?” and “why is there a need for continued secrecy about problems that are no longer problems (as they have been resolved)?”.

So when the Commission’s press release states that “the Information Commissioner's Office's ...cannot monitor whether third countries' data protection is adequate” and that “these assessments should come before international transfers of personal information”, I ask the Commission to explain “why has it taken seven years to come to that conclusion?”.

When the Commission claims that the Information Commissioner “can neither perform random checks on people using or processing personal data, nor enforce penalties following the checks”, I ask the Commission to explain why it has maintained such silence and secrecy as these deficiencies have been present since 1998 when the Directive was first implemented by the previous UK Government.

When the Commission states that “Furthermore, courts in the UK can refuse the right to have personal data rectified or erased” I ask the Commission to explain “how it has it resolved the Court of Appeal’s interpretation of S.7(9) of the UK Act in the Durant decision”.

This latter point is not an issue for geeks - it is serious as this interpretation allows a Court to possess a general and untrammelled discretion not to enforce the right of access. In effect, Durant allows for an exemption from the right of access to personal data on the grounds that if a Court thinks there should be an exemption then there is an exemption.

As the Directive requires Member States to guarantee the right of access to personal data; the silence of the press release implies the Commission is tolerating the UK Courts having a wide discretion not to guarantee the right of access.

In summary, I don’t think the European Commission has acted because of concern for UK data subjects or the powers of the Commissioner as the Commission has known since 2004 that the UK did not implement Directive 95/46/EC properly?  I suspect that the real reason relates to the politically expediency, in as the Commission now wants to make changes to the Data Protection Directive 95/46/EC.  It knows that the UK has a new and more euro-sceptic UK Prime Minister who is unlikely to co-operate with its plans. 

I therefore think the Commission's belated legal action is driven by the answer to one question: "How can the UK be forced to implement any new Directive properly if its inadequate implementation of the 1995 Directive is left unchallenged". 

References:OUT-LAW News: UK's Data Protection Act might not meet European Union standards; http://www.out-law.com/page-4549 (May 2004); Europe claims UK botched one third of Data Protection Directive; http://www.out-law.com/default.aspx?page=8472,

Data Protection Act fails to implement 50% of the Directive? http://amberhawk.typepad.com/amberhawk/2009/11/data-protection-act-fails-to-implement-50-of-the-directive.html (Blog of November 19/11/2009)

FSA v Durant; [2003] EWCA Civ 1746; and  the Commission’s  Download Deficiency press release here.

Marketing: We have dates for our Data Protection Update sessions in Autumn (£95+VAT; book early as they are very popular. Also, we have a set of Data Protection courses (Edinburgh commencing in late August and in London on July 13th). Our next FOI course is in London (commencing 20th September) and in Leeds (commencing 19th October). Details on www.amberhawk.com.

Information Commissioner has to justify why statistical data are personal data

Sadly, there is more data protection case-law arising from the conflict over requests for personal data made under freedom of information (FOI) legislation, than there is when there is a data protection conflict. This state of affairs is the result of the fact the Commissioner has to publish a Decision Notice in relation to a disputed FOI request, whereas there is no similar Notice provision associated with an assessment as to whether or not a data controller is complying with, for example, a Data Protection obligation.

So when a FOI Decision Notice that relates to personal data is challenged in the Courts or Tribunals, we can all see the outcome, see how the Commissioner is thinking, and learn how the law is being interpreted and applies in practice.

A recent case involving the Freedom of Information Scotland Act 2002 (see reference at the end) illustrates this. Two Housing Associations in the Glasgow area wanted access to statistical information about the number of registered sex offenders broken down by the first four characters postcode area (e.g. G40 6xx).

The Scottish Information Commissioner refused to order the release of these details, because he viewed them to be personal data, and because of the nature of the data (registered sex offenders), the details had to be sensitive personal data. The Housing Associations challenged view this arguing that the statistical details did not identify anyone so should be released. So, the question before the Court was “are postcodes personal data”?

Clearly, the first four characters of a post code is not personal data in itself. So the question that had to be addressed by the Court was what “other information” could transform such a postcode into personal data? In this way, the parts of the definition of personal data that relate to identification of individuals could be tested.

Looking at the analysis in the judgment, one can see that the Court struggled with the answer to this question. So it came up with an ingenious solution to avoid giving an answer; it transformed the question into something that was not being asked!

The Court observed that the case had been brought by the Housing Associations because they wanted to pursue a campaign based on the premise that the distribution of sex offenders was unequal (i.e. some postcodes have more than others). So even though the Housing Associations made a commitment not to publish the details it received, this could not be guaranteed, so the basis of their action fell away. It then followed that the Court did not have to consider whether or not a post-code was personal data.

“What a cop-out!”.

But now to the twist in this particular tale. The Court concluded that “It is not clear from the decision letter why the disclosure of a statistic that in a particular district the number of resident RSOs (registered sex offenders), was four or fourteen or forty would lead to the identification of the individuals in question or what other information when taken with these statistics would reasonably allow for such identification” Consequently,  “we are not persuaded that ... the respondent (i.e. the Commissioner” intelligibly explains his decision”.

In other words, a Decision Notice that refers to the personal data exemption in FOI, in the first instance should spell out why the statistical information is personal data. So, in the absence of a Decision Notice mechanism for data protection, this in turn means that FOI Decision Notices will become more relevant to data protection specialists! In future, a Commissioner has to specify why some information is personal data

Reference: The judgment is well worth reading for those interested in data protection definitional matters: it  can be down loaded at http://www.scotcourts.gov.uk/opinions/2010CSIH43.html.

Marketing: We have dates for our Data Protection Update sessions in Autumn (£95+VAT; book early as they are very popular; these include a session devoted to what FOI Decisions tell us about personal data. Also, we have a set of Data Protection courses (Edinburgh commencing in late August and in London on July 13th). Our next FOI course is in London (commencing 20th September) and in Leeds (commencing 19th October). Details on www.amberhawk.com

Financial data sharing agreement with USA remains unbalanced and defective

The European Union has redrafted its agreement with the USA Treasury in order to require Europe’s financial institutions to transfer details of global financial transactions to the USA. The revised Draft Agreement is to be put to the European Parliament in July for approval, despite a text containing significant privacy defects and obvious areas of drafting in need of urgent attention.

The Draft Agreement often refers to “terrorism or terrorist financing” without defining what “terrorism” is, or what makes a “terrorist”. There is a kind of unwritten assumption that everybody will recognise a “terrorist” when they see one, despite the adage that one person’s terrorist is another person’s freedom fighter.

However, the Agreement (in Article 2) does define a range of activities that most people would recognise as “terrorist”, but because these activities do not use the word “terrorism”, they can be interpreted with, how shall we put it, “a degree of flexibility”.

For example, Article 2 includes in its “activities” that allow transfer to the USA “acts of a person that ... are ... dangerous to human life or create a risk of damage to property ....and are reasonably believed to be committed with the aim of ..... coercing a government to act or abstain from acting”.

Can you recall the protracted UK fire-fighters strike in 2002 which involved thousands of fire-fighters? Did this strike “create a risk of damage to property”? Was the strike “dangerous to human life”?  Was the strike called “with the aim of coercing a government to act” (in order to allow a large pay rise)? Well I think the answer to all three “terrorist” tests posited by the Agreement is “yes”.

Thus, the Agreement has the potential to transform law-abiding fire-fighters pursuing an industrial dispute into “terrorists” – as would be the case of the miners in the UK miners’ strike of 1984. Perhaps those organising comprehensive public sector strikes in Greece, France, Spain and Germany against those public sector cuts should be wary – this Agreement could easily assesses them as “terrorists”!

I am sure that the intent of this Draft Agreement is currently not to do this, but the fact is that it clearly has the potential to do so. I raise this prospect merely to show that “flexible drafting” increases the risk of unintended consequences at sometime in the future.

The Draft Agreement appears to be wholly unbalanced. Article 4 allows the US Treasury to obtain “Data” on request. All the Treasury need do is specify the categories of data it wants as being necessary in connection with terrorism, get the formal approval of fellow security officers in Europol, and then the personal data can be transferred.

Note there is no judicial warrant needed in relation to requests which could involve considerable amounts of personal data. However, when the EU want data from the USA, Article 10 requires them to identify “a person or entity that there is reason to believe has a nexus to terrorism or its financing”.

The difference between the two approaches is profound. The Draft Agreement allows the USA to say to the EU, for example, “give us a range of data about transactions in a certain region” as we are investigating “terrorism” (whatever that is). By contrast, a Member State of the European Union has to say to the USA something like “give us the data on this known entity or specific individual” in relation to “terrorism”.

Put in these terms, it is easy to see that the USA can make general requests for “data” whereas the EU has to make specific targeted requests about individuals or entities

That is why the Agreement is unbalanced and will result in a one-way data traffic flow – from EU financial institutions to the USA. No explanation has been given as to why the USA cannot follow the EU States and make targeted requests for personal data.

Article 12 of the Agreement establishes monitoring safeguards and controls. It states that there is to be an “independent person” appointed by the European Commission to police the data protection safeguards. Note that the Draft Agreement could easily have said that a European Data Protection Commissioner, or an ex-Commissioner, or the European Data Protection Supervisor (the natural choice I would argue) would be appointed to monitor these safeguards -  but it doesn’t.

So it follows that the “independent person” is not necessarily a Data Protection Commissioner or someone who has a track record in regulating the difficult area of privacy protection versus law enforcement. Of course the various DP Commissioners will be able to huff and puff on the sidelines – but make no mistake: Europe’s privacy regulators are deliberately being positioned on the periphery of this Agreement. My blog of 14/04/2010 (Should the European Data Protection Supervisor resign?) explains one possible reason why the EU Commission has decided on this course of action.

This raises a serious issue. If the purpose of this Article is to ensure that privacy safeguards are properly established and supervised, then the suspicion raised by its text is that the Commission want to appoint an ex Chief of Police or some other kind of “security apparatchik”. If such an outcome were to occur, it is not going to reassure anyone. In short, this Article could easily produce a supervisory outcome that lacks credibility.

The Agreement provides for no effective mechanism to challenge a particular data transfer before it happens. For instance, if a Bank or individual or organisation formed the view that a particular exchange would not be in accordance with the Agreement, it could go to Court to challenge the matter. In practice, such a complainant would fail because the complainant, at best, would most likely possess “suspicions of a problem”. By contrast if the Courts are to rule on an issue they need actual evidence of a problem – mere suspicion is not enough.

What should happen is that the Agreement should provide for a complainant procedure via the Independent Supervisor who should then, assuming the complaint is not vexatious or trivial, be required to investigate fully. By contrast, under the current arrangements in the Agreement, a complainant could invite the Supervisor to investigate, and hope that the Supervisor might investigate.

However, this makes the system of supervision and privacy protection, especially prior to transfer, depend on “hope” and "might" – and “hope and might” are insecure foundations upon which to build any rigid system of protection. As everybody knows, I “hope” Barnsley FC "might" win the European Cup in the near future.

Article 13 establishes a yearly review of the Agreement to investigate how well it is working, and measure its effectiveness and the safeguards. Is this review undertaken by an independent body or the independent supervisor? Well the answer is “no” - this review is to be undertaken by appointees nominated by the Parties to the Agreement.

This Article thus contains another credibility gap (or chasm, in my view). It suggests a protective mechanism  akin to that achieved by allowing Count Dracula to appoint one of his Brides to investigate whether an agreement to supply blood works properly.

So to my conclusion?  The EU and the USA want wide ranging powers to “follow the terrorist money trail”; most people support that objective. However, the absence of a definition of “terrorism”, the provision of a weak regulatory regime to act as a counter-balance to wide ranging data sharing powers, the deliberate exclusion of the Europe’s Data Protection Commissioners, means that this Agreement should not progress in its current form.

If the Agreement goes through, the UK has to choose whether to become a member. Most international agreements become law by the Royal Prerogative so there is a significant risk that there will be little Parliamentary scrutiny prior to implementation if the decision is taken to join the Agreement.

References: to download the Draft Agreement, follow the link: Download Eu-usa-draft-swift-agreement-com-final-2_June2010. The document was made public by Statewatch (http://www.statewatch.org/)

Marketing:  We have dates for our Data Protection Update sessions in Autumn (£95+VAT; book early as they are very popular). We have a set of Data Protection courses (Edinburgh commencing in late August and in London on July 13th). Our next FOI course is in London (commencing 20th September) and in Leeds (commencing 19th October). Details on www.amberhawk.com

Cartoon

 
 ©Chris Slane

Bill defines “personal information” to avoid strengthening DPA penalties

Ah! The reality of power! For all the Opposition talk about strengthening the protection of privacy, in the first weeks of Government, the pro-privacy proposition has become more difficult to implement. The inevitable result is that gears are being put into neutral or reverse (as quietly as possible, mind you!).

So it is with the repeal of the ID Card Act and the abolition of the National Identity Register by the “Identity Documents Bill 2010-11” whose Second Reading is today. We all know that from their respective manifestos, both Lib-Con coalition partners wanted to scrap ID Cards and strengthen the penalties in the Data Protection Act. We know that the previous Government had draft legislation on the stocks which provided for custodial penalties for misuse of personal data under the Data Protection Act.

With apparent political unity about the weak data protection offences associated with the deliberate misuse of personal data, one would have thought that an stronger penalty could have been introduced quite quickly. Alas, this is not the case. The Identity Documents Bill has used a contorted definition of “personal information” in order to avoid strengthening the offences in the Data Protection Act.

The Bill defines “personal information” to be a small subset of the fifty or so personal details that were to be contained in the ID Card's National Identity Register (the NIR is being abolished). As these items of information are used in relation to the issuing of passports, the Bill stipulates that if this “personal information” is misused or procured in order to produce fake official ID documents, then this misuse can be punished by a maximum 10 year prison sentence.

Of course, as the NIR is a computerised database so the “personal information” of the Identity Documents Bill are also “personal data” of the Data Protection Act. So if the Government wanted to introduce a data protection offence that carried a two year custodial sentence, and maintain the same effect as in the Identity Documents Bill, all it needed to do in this Bill was to: (a) introduce the data protection offence as agreed before the Election; (b) remove the restriction of the data protection offence applying to category(e) personal data; and (c), widen the custodial aspect of the offence to 10 years in the context of an identity document.

This is as simple as ABC; it would be job done and another manifesto promise ticked off. It is not a difficult to draft clauses to achieve this effect, and sadly, because it is so simple, one has to summise that its omission is the result of a deliberate policy decision.

The Bill is not only about the abolition of the ID Card: – it is also about enhancing data sharing powers. The Government has taken the opportunity to enable the Identity and Passport Service to obtain personal data when verifying information provided with passport applications from: any Government Department, any Northern Ireland Department, any Registrar General (for Births Deaths and Marriages), Welsh Ministers,  any credit reference agency and from any “person specified for the purposes of this section by an order made by the Secretary of State”.

So flexible and extensive “data sharing”, including data sharing by order, appears in the very first Bill (Bill No 1). It might be very uncharitable, but the new Government, it appears, has learnt the data sharing habits of New Labour on day one!

The Bill has also highlighted another emerging privacy problem. We now have a private sector data controller such as a Credit Reference Agency (CRA) making profits by virtue of the granting of powers to demand personal data (e.g. from public sector Electoral Registration Officers), and provide these details, in possible combination with those personal data obtained by “consent” of data subjects, when consumers “consent” to provide to financial services providers when they take out a mortgage or loan.

Personal data from these CRA databases are also increasingly being “shared” with more and more public authorities, as with this Bill.  If this trend continues, private sector credit reference agencies with their extensive databases will assume a public accountable deficit with respect of their processing of personal data that will have to be tackled. For example, the Information Commissioner can inspect and audit all large databases of Government Departments; it is difficult to see why the CRA databases (which span most of the UK population and which also obtain personnal data by law) should be excluded from this regime.

I should add as an aside that I can’t see why ID Cards (known as biometric resident permits) remain for “Johnny Foreigner” as it does not appear to make much sense and appears unnecessarily divisive. Mind you, if lucky foreigners are the only people to continue to receive all the full benefits of having an ID Card, one wonders whether possession of these delightful objects should not be extended to those “Non-Doms” we heard about during the Election campaign? Don’t worry Lord Ashcroft – that was an attempt at a joke.

Finally, I conclude with some comments with two minor aspects of the Bill that need exploring by means or probing amendment:

(a) Clause 3 of the Bill requires the destruction of information “recorded in the NIR”; it does not appear to require destruction of information collected prior to input into the NIR nor extracted from the NIR, prior to its destruction. The Clause appears to be too limited in scope.

(b) Schedule 1, paragraph 11 of the Bill removes the National Identity Card Commissioner from the list or organisations subject to the FOI regime. Of course this has to happen. However, the paragraph should have been drafted in a form which identifies the public authority that will maintain the Commissioner's records so that the public does not lose access to information already compiled by the National Identity Card Commissioner.

Overall what do I think of the ID card’s demise? Disappointment really, and it’s not because I will have less to moan about. There is a desperate need for an identity management scheme under the control of the individual.  Labour’s attempt to force a state controlled (neo-Soviet) monolith on an increasingly reluctant public is a missed opportunity and a complete a waste of money.

Let us hope the new guys on the block do not repeat the same mistakes. But those data sharing powers are not a good sign.

Marketing: The website contains details of our DATA PROTECTION UPDATE sessions in Autumn (£95+VAT; book early as they are very popular); our Data Protection courses (Edinburgh commencing in late August and in London on July 13th). Our next FOI course is in London (commencing 20th September) and in Leeds (commencing 19th October). Details on www.amberhawk.com