Hawktalk

European Commission explains why UK’s Data Protection Act is deficient



The European Commission has released details as to why it sees the UK Data Protection Act as an improper implementation of Directive 95/46/EC, so much so, that it is considering infraction proceedings. Correspondence between the Commission and the UK Government has been exchanged, and despite the possibility of litigation, very little has been published or explained to MPs or MEPs.

Hence the “liberation” of information from the Commission about these infraction proceedings is very timely. It is also the result of an FOI request that commenced in April 2007 and which culminated in the involvement of the European Ombudsman from 2009. These details were released to me last week (February 2011) and are published for the first time below (see references).

Prior to April 2007, and in response to another FOI request to the Commission that commenced in 2006, the Commission had released details that Articles 2, 3, 8, 10, 11, 12, 13, 22, 23, 25 and 28 – just under a third of the 34 articles in the Directive 95/46/EC had not been implemented properly (see Out-law reference). However, no reason was given for the underlying problem the Commission had with each Article; hence the reason why I submitted a second FOI request in April 2007.

I my blog of 19/11/2009, I stated that Data Protection Act also failed to implement a further five Articles (Articles 6, 7, 14, 18 and 19 making 16 “deficient” Articles out of 34). This was because a Court of Appeal judgement linked the word “purpose” (as used in notification/registration to the Information Commissioner) to the word “purpose” as used in the Data Protection Principles. As the notification purposes are very broadly defined, the Court’s linkage between Principle and notification means that the purpose in the context of a Principle is now also broadly defined.

This in turn means that a data controller will find it easier to claim that, for example, the processing of personal data is relevant to a purpose, if relevance is assessed against the wide purpose is that notified to the Commissioner. In general, the broader the definition of “purpose”, the more diminished is the protection afforded by a Principle to data subjects. It also means that the Second Data Protection Principle (which limits further uses of personal data for incompatible purposes), and which encouraged the Appeal Court to make the linkage, is likely to be deficient in terms of UK implementation of the intent of the Directive

These additional Articles (i.e. Articles 6, 7, 14, 18 and 19) are not reflected in the information the Commission has reluctantly released. This is because the released information is limited to my request made in 2007. However, if there are actual infraction proceedings taken against the UK, the consequences of the Court of Appeal judgment should form as part of these proceedings.

What can we deduce about the infraction proceedings in 2011?

The starting assumption is that the actual infraction proceedings (if they commence) will be a subset of the issues identified by the Commission in the released information. Hence I make comments in relation to each of Articles 2, 3, 8, 10, 11, 12, 13, 22, 23, 25 and 28, and specify what I think their status is. If you think I am wrong, please add a comment to this blog.

In relation to Article 2, the Commission has a problem with the UK definition of “Relevant Filing Systems” and how the UK Act applies to manual files. I think this is a non-starter in relation to infraction proceedings because Member States can go their own way in relation to manual files. This is made clear in Recital 27 which states that Member States can establish “different criteria for determining the constituents of a structured set of personal data, and the different criteria governing access to such a set”. That is what the UK did with its DPA; minimal involvement of manual personal data files in the data protection regime.

There is a major problem with manual files but it has nothing to do with infraction. I think, for example, that manual employee records should be classified as a new category of “Accessible Record” and fully included in the Act. This is an easy amendment for the UK Government to make now; it does not need to wait for a change in the Directive (see blog of 03/11/2010).

Article 3 relates to the scope of the Directive and the Commission’s complaint that the UK’s domestic purpose exemption includes the processing of personal data for a “recreational purposes”. The Commission are arguing that such “recreational purposes” should not have an exemption from all Principles and all data subject rights.

Since the Lindqvist case (see blog of 25/1/2011), the UK’s “domestic purpose” exemption has been deficient because it includes an exemption from the Eighth Principle in all possible circumstances (in contradiction to Lindqvist). That is why the domestic purpose exemption, in my view, could also form part of the UK infraction proceedings.

The Commission considers that the UK law does not set the proper standards in relation to the processing of sensitive personal data concerning to criminal offences. I can agree with this assessment, and my blog of 14/02/2011 shows that the UK are not following the Article 8 provisions in relation to other forms of sensitive personal data in other areas (e.g. medical records; see references).

The Commission state that the fair processing provisions in Articles 10 and 11 are deficiently implemented if a data controller is legally obliged to make personal data available to the public. This is a swipe at the exemption in Section 34 of the UK Act relating to personal data made available to the public by or under enactment.

The S.34 exemption includes exemption from the subject information provisions and exemption from the non-disclosure exemptions; these exemptions arise because if the personal data are in the public domain, anybody can have access to them and if anybody can have access to them, then they could be used for any purpose.

That is why, in my view, the Commission is wrong here. It is impractical, for example, to expect an Electoral Registrar to issue a precise fair processing notice (unless it says “these personal data can be used by anybody for any purpose” which is hardly informative as to the precise purposes of disclosure or use).

Having said that, I think there are valid data protection issues with respect to publically available registers, especially where electronic forms of public registers containing personal data can be released to any requestor. There are strong arguments that such registers should not be released without the prior obtaining of a data protection guarantee from the person who wants a complete copy of the register; this would include those circumstances when disclosure is a legal requirement (e.g. disclosure of Electoral Rolls to Credit Reference Agencies).

The Commission do not like the provisions in the Act that allow for judicial discretion where a judge may (or may not) decide to do something. For example, Section 14(4) of the Act states that “the court may order the rectification, blocking, erasure or destruction of any of those data”; this of course means that a court may not make such an order. By contrast, Article 12 requires the Member State to “guarantee” data subject rights of rectification, blocking and destruction and the existence of “judicial discretion” is not a guarantee.

The best way to see this is in Durant. Here the UK Court of Appeal stated that section 7(9) (which relates to the question of whether or not the Courts should order a data controller to satisfy a subject access request)  that the judicial “discretion conferred by that provision is general and untrammelled”.  In other words, the UK DPA llows judges to make up subject access exemptions as they go along (in contrast Article 12 which requires “a guarantee” of data subject access, subject to an exemption specified in Article 13).

I think that the “judicial discretion” issue in relation to rights would be a major factor in any infraction proceedings.

The Commission do not like the exemption from Subject Access for confidential references given by the data controller (in Schedule 7, paragraph 1). It is not covered by the criteria in Article 13. It is in my view a “slam dunk” breach of the Directive requirements, and its days are clearly numbered.

The origins of this exemption lie in the fact that the Data Protection Act was a Home Office Bill. Back in 1997, it was common practice for the Home Office to do the bare minimum to ensure compliance with Human Rights judgments. So when it came to the implementation of the Gaskin judgement (European Court of Human Rights; 1989), which concerned access to confidential information received from a third party, the Home Office noted that the European Court made no direction in relation to an access request sent by that third party.

The Home Secretary of the day decided on the minimal implementation of Gaskin. Hence we have the recipient of the reference dealing with Sections 7(4)-7(6) of the Act, and the sender of the reference dealing with the exemption in Schedule 7 paragraph 1.  After 15 years, the Home Office’s formulation of minimal protection for individuals is unravelling.

The Commission claim that the data subject should be able to claim compensation for distress alone. By contrast the UK only compensates for distress when damage also arises except where the Special Purpose (e.g. journalism) is involved. That is behind the Commission’s complaints about Articles 22 and 23.

I should add that where the UK Courts do compensate for distress alone, they usually award small amounts of money:– so there is no prospect of a “data subject gravy train” on the horizon. I suspect that the Commission are keen on this aspect, although in practice the sums involved will be small.

The Commission don’t like the fact that UK data controllers can assess adequacy of the protection in a Third Country without some kind of supervision (Article 25). This could be linked to the fact that the Information Commission (in 2007) was a weak regulator as the Commission has also raised questions of his “investigative powers”.

In practice, I cannot see the Commission pressing these points in any infraction proceedings. Firstly because the whole issue of international transfers in subject to a comprehensive review – so if there is a problem, that problem would form part of that review. Secondly, the Commissioner’s powers have increased (e.g. audit of Government Departments, Monetary Penalty Notices), and that such powers are likely to be extended. Also, the custodial sentence for criminal offences on the same scale as the Computer Misuse Act is on the statute book, even thought it has not yet been commenced.

So what are we left with?

My list of data protection failings that still worry the Commission are: judicial discretion re rights; Article 8 implementation of Sensitive Personal Data; the exemptions (confidential references, domestic purposes and information made public by law); and compensation for distress alone. All the rest are marginal at best.

Concluding comment

However, when reading this list, remember these were the deficiencies that were identified by the Commission in 2004 following Durant. Quite frankly, it is unacceptable for the detail of this list of problems to have been kept secret for seven years. In respect of individual privacy, the Commission and the then New Labour Government have given 60,000,000 UK data subjects a collective V-sign.

The attachment to this blog does not comprise state secrets. In "liberating" these details, the Commission has required me to exhibit an obsessive behaviour on the autistic spectrum; they have delayed wherever possible, required me to endlessly chase them up, and provided bogus arguments in order to stop the release of these details.

Why is this? Why the great secrecy? Well I will let you know with my next blog on Thursday.

References

Click here to view the details released by the Commission Download DP_Infraction_reasons.

Employee manual records blog: http://amberhawk.typepad.com/amberhawk/2010/11/index.html

Sensitive Personal data issue blog: http://amberhawk.typepad.com/amberhawk/2011/02/ignored-notification-requirements-cast-doubt-about-sensitive-personal-data-.html

Other Articles infringed blog: http://amberhawk.typepad.com/amberhawk/2009/11/data-protection-act-fails-to-implement-50-of-the-directive.html

Out-law details of the scope of the infraction: “Europe claims UK botched one third of Data Protection Directive”  http://www.out-law.com/page-8472,

Adverts re Data Protection courses

Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip).

We are also running a Privacy Impact Assessment Course, a RIPA course and a Data Protection Audit on consecutive dates (In London, on 21st to 23rd March). We are starting a 5-day intensive data protection course in London (10th May), and a 7-day course starting in Manchester in (12th may). These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Details from the Amberhawk website (www.amberhawk.com)

Protection of Freedoms Bill promotes efficient CCTV surveillance not effective privacy

The hype surrounding the CCTV/ANPR provisions in the Protection of Freedoms Bill is misplaced. In fact, I would argue the Bill’s provision for a Statutory Code of Practice in the CCTV area represents little change on the privacy front, but a huge change in the potential for enhanced surveillance.

A statutory code of practice covering CCTV/ANPR is to be produced by the Home Secretary and regulated by a new “Surveillance Camera Commissioner”. The Code’s application is limited to policing bodies and local authorities; it does not cover the CCTV systems that are installed by Government Departments, the Security Service, other public bodies, or used in large shops or shopping malls. If the measure was intended to limit CCTV surveillance, then one would expect that some of these missing areas would be covered in its provisions.

Also not covered in the Code is the use of CCTV in the domestic circumstance; although I have to admit that this is a very difficult area to get right. However, having said what is not covered, I should point out that the Home Secretary is seeking powers that could extend the bodies that are subject to the Code.

There is no penalty if the Code is breached, although a breach of the Code may be raised in any legal proceedings. There are no new individuals rights created – for instance, for the Surveillance Camera Commissioner to investigate complaints about the operation of the Code.

So, if a Surveillance Camera Commissioner regulates the CCTV Statutory Code of Practice and the Information Commissioner presumably maintains his own voluntary CCTV Code of Practice, then Local Authorities and Police have the pleasure of dealing with two Codes. If these Codes diverge, there will be confusion as to what set of rules take precedent. The Bill does not set out a mechanism to resolve any conflict between these Codes.

There is also a possibility of at least two regulators with apparently overlapping responsibilities; this does not seem to be a useful proposal if privacy protection is an objective. The Surveillance Commissioner could be a third regulator if CCTV is used in combination with covert directional microphones.

The Bill’s current text ensures that conflict between the two Codes is a distinct possibility. For example: the installation or positioning of cameras overlaps with the use, collection and relevance of personal data (First and Third Principles); access to and disclosure of images overlaps with subject access, security, and incompatible disclosure purposes (First, Second, Sixth and Seventh Principles); the system use by staff and management overlaps with organisational measures (Seventh Principle); and the transparency arrangements overlap with the fair processing notice (First Principle).

There is no provision in the Code with respect of retention of CCTV images, but retention provisions can be included in the Code at anytime (overlaps with the Fifth Principle; see the use of the word “include” in S.29(3) of the Bill). Individuals could also complain to two Commissioners about the same CCTV image; one Commissioner has an obligation to do an assessment, the other doesn’t.

Although the consultation about the Code’s content is supposed to avoid these areas of conflict, it is the Secretary of State who has the last word. A Statutory Instrument brings the Code into effect; this means that Parliament’s involvement in the Code’s content is minimal.

Which Code is likely to be more balanced in relation to "privacy versus surveillance"? The Code produced by the Home Secretary (who has political responsibility for policing and a vested interest in the success of CCTV policy) or the one produced by the Information Commissioner? Let’s be honest; that was a loaded question:- but the answer explains why the statutory Code is unlikely to protect privacy.

This is because the person who is politically responsible for the interference is also identifying the protection from such interference. This is an impossible conflict of interest that cannot be resolved; it is a structural fault-line in the system of privacy protection in the UK.

I have said this before: it is like having a Code of Practice, regulated by Count Dracula, who sets standards as to how his Brides should use bottles of blood from a transfusion centre.

To break ANY potential for conflict in this area is simple. The legislation could have easily have said something like: “Where a Code makes a provision that relates to the processing of personal data, that provision must be approved by the Information Commissioner”. The Bill doesn’t include such a simple provision - so what conclusion is one supposed to draw?

Also missed from all the press coverage is the role of Automated Number Plate Recognition (ANPR) camera systems. ANPR is important because of the Police have a policy of “denying criminals the use of the roads” (see references). All vehicles passing an ANPR system (e.g. on a motorway) are regularly checked in real time with data from the Police National Computer vehicle information (see blog of 23/08/2010 for an explanation – also references). This provides valuable intelligence that the Home Office is keen to legitimise.

That is why a great deal of the Statutory Code will be devoted to making ensure that various CCTV/ANPR systems follow communication standards and can work efficiently and effectively (i.e. ensure the surveillance functionality is fit for purpose). This is also why much of the Code is reserved for commentary on: “technical standards”, “locations” and “types of system”. (Readers who are interested in the background to the Code should look at the Home Office’s “National CCTV Strategy” and the NPIA’s document about ANPR; see references).

As soon as one gets good facial recognition (as is likely someday), one can presume that this will be linked to the digital photographs of drivers or on passports. The Code will thus apply to the policy of “denying criminals the use of the pavements” perhaps. These changes may not be subject to detailed Parliamentary scrutiny – all a future Home Secretary could do is issue a new Code of Practice.

Finally, as well as fragmenting the regulatory regime, the Code only applies in England and Wales – so what happens in Scotland and Northern Ireland?

Now I am not saying that the police or Local Authorities should not have better CCTV or the police should not have more effective ANPR or better intelligence. What I am saying is that where there is enhanced surveillance there should also be enhance protection. You can’t have one without the other.

I also object to a Deputy Prime Minister, saying that this Bill curtails surveillance and excessive state interference, when this part of the Bill does no such thing. There was the kind of privacy “doublespeak” that used to be the preserve of Labour Home Secretaries. Not any longer.

At its most fundamental, the Protection of Freedoms Bill is a Home Office Bill like the Data Protection Act and the Freedom of Information Act beforehand (which probably explains the generous exemptions that cover Home Office responsibilities in these Acts).

So when you read this Bill, read it carefully. Remember where it comes from, and have that garlic and crucifix to hand.

References

National CCTV Strategy http://www.bhphousing.co.uk/streetcare2.nsf/Files/LBBA-24/$FILE/Home%20Office%20National%20CCTV%20Strategy.pdf

ANPR: http://www.npia.police.uk/en/docs/Policing_of_Roads_2007_PA.pdf

Also relevant is “CCTV – and data protection – 2007” which focuses on ACPO CCTV strategy and OIC Code of Practice: accessible from  http://www.amberhawk.com/policydoc.asp

Blog of 23/08/2010 about ANPR: http://amberhawk.typepad.com/amberhawk/2010/08/data-protection-and-surveillance-swopping-the-speed-camera-for-anpr.html

The Protection of Freedoms Bill: http://services.parliament.uk/bills/2010-11/protectionoffreedoms.html

Adverts re Data Protection courses

Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip). We will include commentary on the Freedom Bill.

We are also running a Privacy Impact Assessment Course, a RIPA course and a Data Protection Audit on consecutive dates (In London, on 21st to 23rd March). We are starting a 5-day intensive data protection course in Leeds (beginning 3rd March) and London (10th May), and a 7-day course starting in Manchester in (12th may) . These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Details from the Amberhawk website (www.amberhawk.com)

 

Ignored notification requirements cast doubt about Sensitive Personal Data

Directives often contain a notification provision which place each Member State under an obligation to report certain activities to the European Commission. Following a FOI request to the Commission, it has emerged that the UK Government has ignored its notification obligations in relation to the Data Protection Directive; this raises the general question of whether notification requirements in Directives are effective.

With respect to the processing of sensitive personal data without the consent of the individual concerned  (e.g. processing details of an individual’s health, criminal offences, ethnicity, religion or sexual life) there is considerable doubt as to whether the UK Government has transposed the Directive’s sensitive personal data provisions properly into the UK’s Data Protection Act.

Notification is not some trivial, bureaucratic, pen-pushing requirement. In the Passenger Name Records (PNR) Directive, for example (see last week’s blog), there is a requirement for Member States to provide the Commission with the identity of the “competent authorities” who receive PNR data. If these details are not provided by Member States, then Europe’s citizens cannot identify which national organisations are using PNR data or begin to assess whether that use is legitimate.

Additionally, important comparisons cannot be made: if the British were to have 20 competent authorities and the Germans 5, then questions might be asked as to whether the UK were disclosing PNR data too widely.

The failure by the UK to notify other sensitive personal data purposes

When a Member State interferes with an individual’s private and family life, transparency is a cornerstone of accountability and trust. With respect of the processing of sensitive personal data without the consent of the data subject, the UK Government has only notified 1 of the 19 processing purposes it should have notified. There are 5 further purposes relating to matters such as law enforcement but these do not need to be notified to the Commission (see Article 3(2)).

The FOI request reveals that only four countries have notified eleven additional sensitive personal data provisions: Denmark(1); Finland(2); Netherlands(7) and the UK(1) and two of the Dutch ones that are seven years old are marked as “temporary”. The actual UK total should be 19 notified purposes (plus 5 where there is no obligation to notify). See references for complete list of the notified eleven, and the missing UK eighteen.

With 18 additional conditions so far identified by the UK, one wonders how other EU countries have coped without them? Perhaps the British Government is over legislating in the field of the processing of sensitive personal data? Who knows – but transparency is the important step that allows these questions to be asked. Such transparency has been absent.

However, the overriding suspicion is that most EU countries (like the UK) are not reporting the additional uses of sensitive personal data that have been authorised. If this non-reporting occurs, what confidence can the public have when other Directives contain similar reporting arrangements (e.g. as with the PNR Directive)? If these provisions are neglected by Member States, what is the point of making such reporting a legal requirement? And what care has the European Commission taken to ensure that effective reporting does take place?

These are important questions that need an answer from the Commission and Member States.

Is the processing of sensitive personal data lawful?

The relevant provision of the Directive that requires additional uses of sensitive personal data (except health – see later) to be notified states that:

“Subject to the provision of suitable safeguards, Member States may, for reasons of substantial public interest, lay down exemptions in addition to those laid down in paragraph 2 either by national law or by decision of the supervisory authority” (Article 8(4); my emphasis)

Note that any additional processing purpose for sensitive personal data has to be associated with a “substantial public interest” and be subject to “suitable safeguards”. As can be seen by studying some of the UK additional uses, some conditions do not require a “substantial public interest” to exist or even provide for any additional “suitable safeguards”. The question arises therefore is whether these additional purposes are consistent with the text of the Directive, and whether they have been properly transcribed into UK law.

What is also surprising is that the Commission does not bother to insist that Member States provide the obvious facts that need notifying; namely, a description of the “substantial public interest” in the additional processing purpose and of the “suitable safeguards” that have been provided? This suggests that the Commission itself is possibly indifferent about the importance of these notification requirements.

Note also that Article 8(4) permitted the Government to allow the Information Commissioner to determine whether the additional processing of sensitive personal data was legitimate. This would have been the best option in terms of privacy outcomes, as the Commissioner would have to assess any additional processing of sensitive personal data in the context of a full data protection compliance check.

Because of this, it is easy to see why this would not appeal to a UK Government. If a Government Minister wanted his Department to use sensitive personal data to realise a political or policy objective, then that Minister would not want to risk that an unelected, independent official stopping them on data protection grounds. (See “Nine Principles...” reference if you are interested in this aspect).

Medical records

The wider uses of medical records are not notifiable to the Commission, but even here questions arise as to whether the Directive provisions have been properly transcribed into UK law. Here, the Directive states that it is only legitimate to process health data, (in the absence of patient consent, remember) “...where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services...”. Note that the list is limited to four purposes.

Compare that with the UK implementation which states that “...medical purposes include the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services”. Note that the list of medical purposes is unlimited (by the use of the word "include") and that any other medical related purposes (e.g. medical research) is not specified in the Directive’s limited list.

Thus the UK Act implementation included an attempt to facilitate a medical research purposes using health personal data without the consent of the data subject contrary to the text of the Directive; additionally that medical research purpose did not need to possess a “substantial public interest”. See references for recent research into the use of medical records for research purposes without consent of the patient.

Conclusion

Today the Prime Minister is promoting the “Big Society” and encouraging people to do those things that Government find difficult. So I can proudly announce that Hawktalk has joined the Big Society; it has reported to the Commission what the Government has failed to do.

References

The Commission’s list of notified additional purposes for the processing of sensitive personal data for all EU Member States (Download Commission_list_notifications_feb2011).  Because of the paucity of the content, I asked the Commission to expressly confirm that they had provided me complete and up-to-date information. This confirmation has been received.

List of processing purposes that the UK should have notified to the Commission (including those purposes where there is no need to notify) (Download Haktalk_list_not_notified_feb2011).

Academic analysis, “Using NHS Patient Data for Research Without Consent”:  accessible from http://papers.ssrn.com/abstract=1753029

“Nine principles for assessing whether privacy is protected in a surveillance society (Parts 1 and 2) – 2008”; accessible from  http://www.amberhawk.com/policydoc.asp

Adverts re Data Protection courses

Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip). We are also running a Privacy Impact Assessment Course, a RIPA course and a Data Protection Audit on consecutive dates (21st to 23rd March).

We are starting a 5-day intensive data protection course in Leeds (beginning 3rd March) and London (10th May), and a 7-day course starting in Manchester in (12th may) . These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Details from the Amberhawk website (www.amberhawk.com)

Why the PNR Directive is disproportionate and does not protect privacy

Last week the European Commission unveiled its proposal for a Directive that allows for the interchange of Passenger Name Records (PNR) relating to all air travellers flying internationally within the European Union. Surprisingly, the drafting of the Directive reveals that it is disproportionate!

When you first look at the Directive, with its emphasis on the use of PNR records in relation to “terrorist offences” or “serious transnational crime”, the first response is: “that’s OK with me”. Even when there is a reference to “serious crime” you instinctively say – “well that use is still OK”.

Well this natural response assumes you have not read the definition of “serious crime” in Article 2(h). This defines “serious crime” to mean a crime that has to be punishable by a custodial sentence for a maximum period of at least three years.

The definition then provides an option so that “Member States may exclude those minor offences for which, taking into account their respective criminal justice system, the processing of PNR data pursuant to this directive would not be in line with the principle of proportionality” (my emphasis).

Now consider that “may exclude” and then think of the world famous recipe for my “Grandma’s Apple Pie” (patents pending). Suppose it advises chefs who possess the culinary skills to attempt this unique dish that they “may exclude the curry powder or the baked beans as ingredients”.

Now I am going to ask you a simple question: “can a chef’s “Grandma’s Apple Pie” contain curry powder or baked beans?”. The answer is, of course, that it can! The use of “may exclude” infers “include” (i.e. the opposite) and that is an object lesson as to why some lawyers are very well paid.

However suppose a Member State chooses not to exclude these “minor offences”. Then the second part of the definition kicks in. Such a Member State has not taken “into account their respective criminal justice system” which avoids that “processing of PNR data pursuant to this directive would not be in line with the principle of proportionality”.

Ergo the use of the word “may” in the definition suggests to Member States that their implementation of the Directive can breach Article 8. To correct this, that “may” has to be changed to a “must”.

A “must” read section rather than a “may read”

However, even with a “must” rather than a “may” some “serious crimes” are really very minor. In the UK, the Daily Mail has reported cases of European Arrest Warrants being issued (Warrants are issued using the same definition of “serious crime”), where the “serious crimes” subject to extradition proceedings include: a “man who shoplifted about 20 Milka bars”; a case of “a carpenter who fitted wardrobe doors and then removed them when the client refused to pay him”, and “a person suspected of “theft of a dessert”.

The Daily Telegraph reports that “Many (subject to a Warrant) are accused of trivial crimes overseas such as possessing cannabis or leaving petrol stations without paying. No evidence need be presented in British courts of the alleged offence and judges have few powers to resist the person’s extradition.  Those affected can spend long periods in jail here and abroad for crimes which might not even be prosecuted in this country and they can also be seized for offences which are not even crimes in Britain” (see references).

Data sharing and “serious crime”

It is important to understand that “serious crime” should not be interpreted in the way the “man on the Clapham omnibus” would interpret these words and that any provision in the current Directive text that refers to “serious crime” is now seriously tainted.

For instance, Article 7, dealing with “Exchange of information between Member States”.  In the context of “serious crime” this permits the authorities to  “...compare PNR data against relevant databases, including international or national databases or national mirrors of Union databases, where they are established on the basis of Union law, on persons or objects sought or under alert...”.

Then there is Article 8, which deals with the transfer of PNR data or the results of the processing of PNR data to a third country law enforcement agency on a case-by-case basis in the context of “serious crime”. Additionally, these third countries can also transfer the data to another third country for “serious crime” purposes with the “express authorisation of the Member State”.

With all this data sharing going in the context of “serious crime”, the problems outlined above have the potential to be, how shall I put it, “very serious”.

What do the data protection authorities say?

The Preamble to the Directive provides details of the consultation process. This states that “The Article 29 Data Protection Working Party considered that the proposal was disproportionate and that it might violate the right to data protection”.  The European Data Protection Supervisor (EDPS) “questioned whether the necessity and proportionality of the proposal had been demonstrated since the proposal concerns the collection of data of innocent persons”.  The EDPS also “criticised the proposal as contributing towards a surveillance society”.

By contrast, the Directive now boasts that “its provisions are compatible with fundamental rights, and especially the right to protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights of the EU”. And I suspect this sentence provides the reason why the “serious crime” definition includes the words “may exclude”.

I think it has been added for a simple reason: to allow the Eurocrats to deflect any criticism from the European Parliament.

I am not a clairvoyant, but I am pretty sure that the EDPS and Working Party do not think that the proportionality problem has been resolved. This is because their concerns about proportionality are different.

From their perspective, the Commission has failed to answer a simple question: why it wants to keep records for 5 years on the millions of Mr & Mrs Ordinary Citizens and their 2.4 children going to the Algarve for a two week holiday?  Whereas a data protection analysis might produce a granulated retention criteria for PNR data, this Directive adopts the Henry Ford approach: “one retention period fits all” (and that is why it is likely to be disproportionate).

Note that if data protection authorities were explicitly empowered to assess legislation in the context of proportionality and Article 8, this would not be a problem (I keep banging on about this: see the section on lawful processing in my blog of 25/1/2011). Indeed, if the European Commission is so sure of its grounds in respect of Article 8 - as it says - then it has nothing to fear from legislating to provide data protection commissioners a power of this kind.

The fact that it hasn’t speaks volumes.

References

Examples of European Arrest Warrants: http://www.dailymail.co.uk/news/article-1352337/British-police-hit-20-times-number-EU-arrest-warrants-make.html#ixzz1DBvT4CAz; http://www.telegraph.co.uk/news/uknews/law-and-order/7969981/Britain-left-to-count-cost-of-European-Arrest-Warrant.html

The PNR Directive: from http://ec.europa.eu/home-affairs/news/intro/news_intro_en.htm#20110202

Adverts re Data Protection courses

Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip). We are also running a Privacy Impact Assessment Course, a RIPA course and a Data Protection Audit on consecutive dates (21st to 23rd March) in London.

We are starting a 5-day intensive data protection course in Edinburgh (beginning 24th February) and in Leeds (beginning 3rd March). These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Details from the Amberhawk website (www.amberhawk.com)

How the Information Commissioner would improve Data Protection law

Last Friday, data protection day, was commemorated with a meeting organised by the Ministry of Justice in Whitehall. At that meeting, David Smith, the Deputy Information Commissioner (“D. I. C.”), reviewed the Information Commissioner’s wish list of changes to data protection law. This blog reports on the content of that list.

Regulation or new Directive

Speaking to “very well informed sources” at a break in the meeting it became clear that the UK Government wants the changes to data protection law to be implemented by a Directive (unlike the EDPS who wants a Regulation, see last week’s blog). If this is the case, Directive negotiations will take an age, and one can assume that any prospect of a new Data Protection law in the UK will be booted into the long grass (5-8 years at least – well into the next Parliament).

So if the Commission decides on a Regulation, I think it will have to give Member States a considerable degree of subsiduarity (e.g. Member States have flexibility in the area of national security or law enforcement). Otherwise some Member States (e.g. the UK) will ensure that any internal discussion about a Regulation will become protracted because, in the UK, law enforcement and national security agencies are used to relying on generous exemptions from the data protection rules. I got the sense at the meeting that this position will NOT substantially change.

Also lurking in the background is the “Protocol on the Position of the United Kingdom and Ireland in Respect of the Area of Freedom, Security and Justice”. Article 6a of this Protocol to the Lisbon Treaty states that:

“The United Kingdom and Ireland shall not be bound by the rules laid down on the basis of Article 16 of the Treaty on the Functioning of the European Union which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title IV of Part Three of that Treaty where the United Kingdom and Ireland are not bound by the rules governing the forms of judicial cooperation in criminal matters or police cooperation which require compliance with the provisions laid down on the basis of Article 16”.

Let’s cut the legalise. The above means the UK can opt out in areas of judicial co-operation and serious crime especially where data protection rules impacts in these areas. This is another legacy of New Labour, over anxious that Europe would not be able to interfere with Surveillance Britain.

It is interesting to note that no-one has challenged the Coalition Government as to whether it agrees with this opt-out – I suspect it does agree.

In addition, those who support a Regulation want a Regulation to be harmonising measure so that all Europe’s data protection laws provide the equivalent standard of data protection. They also support a Regulation as Member States will be obliged to translate its provisions into national data protection laws.

However, if Member States can go their own way – as the UK can in these sensitive areas - then the rationale for supporting a Regulation is lost. To put it bluntly, I can see many Member States saying – “well if the UK can do it, so can we” (or “yes we can” for American readers).

Accountability and pragmatism

The ICO like all European Commissioners support the idea of a prominent Accountability Principle. For instance, the D. I. C. indicated that the ICO favours details about data protection compliance appearing in Annual Reports and in published Privacy Impact Assessments. However the D. I. C. did not support a statutory appointment of a data protection officer as that might not be appropriate for all Small to Medium Enterprises. What the ICO wants senior management of all endeavours to formally identify someone as being responsible for data protection compliance. So expect this to form part of the UK’s implementation of any new Accountability Principle.

Similarly, the Commissioner is lukewarm with respect to a statutory data breach notification requirement because he considers the requirement to notify data subjects of a breach depends on the circumstances of the breach. He is content with the current UK situation where personal data loss is first notified to the Commissioner.

All this leads to the concept of “pragmatism in data protection”. At the meeting the D. I. C. stressed that ICO’s policy is to adopt a pragmatic approach to resolving data protection problems because such a pragmatic approach offered more influence with the data controller community. In other words, data protection principles were not fundamental principles to be held inviolate on every processing occasion.

Although the D. I. C. accepted that this pragmatic view was seen by others (presumably other European Privacy Commissioners) as “a sign of weakness”, the approach found acceptance with the Government’s spokeswoman. Dogmatism in data protection was something for those Europeans to have in their law (but not ours!).

The lasting impression is that these statements comprise a public admission that the future development of data protection policy in Europe is split at the highest level. If this is true, any Regulation or Directive is impossible to draft as there appears to be a rift between privacy fundamentalism on the one hand and data protection pragmatism on the other. The only outcome can be an agreement to disagree – especially in the areas of law enforcement.

One can therefore predict that harmonisation of European data protection law may well be a pipe-dream.

A question of harm?

The D. I. C. outlined that the ICO is wanting a “harm” or “risk based approach” (the harm approach is key to understanding the APEC Framework agreement) towards the protection of privacy. This is a seductive idea because in many instances the data controller can identify potential harm (e.g. when processing personal data of a confidential nature). That is one reason why there is the promotion of Privacy Impact Assessments, designed to allow a data controller to quantify such harm, prior to any processing of personal data.

However, a word of warning: old-timers like myself are steeped in data protection history. They will remember that a "harm debate" took place in the UK some thirty five years ago, well before the UK had any data protection law, and that the notion underpinning a data protection regime based on "harm" was firmly rejected by the Lindop Committee in its Report on data protection in 1978 (Cmnd 7341 paras 18.24-18.27).

Lindop concluded that there was no objective standard whereby a data controller could be able assess harm prior to the processing of personal data because there was no way an organisation could judge whether its personal data or its processing would be sensitive or non-sensitive. This was because sensitivity was a subjective assessment that could only be accurately judged by each data subject concerned; and of courses, such assessments can change over time and in context.

For example, in the UK of the 1950s most gays were fearful other knowing of their sexuality, unlike today – but this is not the case in parts of  Africa. Those who have eagerly contributed to the font of universal knowledge (e.g. by YouTube or Facebook offering details about themselves) can easily regret that contribution when the context is changed to looking for employment. The sensitivity associated with a name and address of a Jewish friend changes dramatically if book is lost and falls into the hands of the Gestapo.

In other words, an assessment made now can change in an instant (I have friends who took a wonderful holiday in Egypt only a six weeks ago) and if that is the case, what is the value of such assessments and an approach based on harm?

That is why Lindop concluded that the only real issue was whether the data identified or related to a particular living individual and if so, then all the data protection principles should be applied. However, having established the principles did apply, Lindop concluded that the impact of the principles would be modified by a number of factors – for instance, whether there was foreseeable harm to the data subject, the sensitivity of the personal data, or whether the personal data were in the public domain.

Lindop, I believe, was in the fundamentalist camp – the Principles apply – and any pragmatism comes with enforcement and any analysis of what went wrong.

Modification to the Principles

The ICO will push data minimisation and Privacy by Design mechanisms as one of the key changes to any new law. Although this is not a new pronouncement by the ICO, I would argue that many of these requirements are already form part of the current Data Protection Principles. For instance, data minimisation can be achieved by application of the Third Data Protection Principle – for example, why do you need to register your details on a web-site to access its free content? Isn’t that an example of excessive collection of personal data?

Of course web-site owners can make such collection of personal data relevant. For instance, a data controller might want to keep records of who visits sites so that they can modify content to meet the aspirations of those who visit the site, or even deliver some marketing to those registered (heaven-forbid). However such purposes (and marketing choices) should be declared to those who register via a fair processing notice.

I also think that many aspects Privacy by Design link to the Seventh and Sixth Principles (e.g. obligations to have regard to the “state of the art” in relation to the security of the processing of personal data or in relation to respect the rights of data subject, so that they have choices over who can access their personal data and when. Free subject access can easily be designed into any new project that involves the processing of personal data).

The ICO would like to see collective redress available. Many of you know that the current PECR Regulations allows for aggrieved recipients of marketing messages to claim compensation for damage caused by the processing of such messages sent in breach of the Regulations. So how much is one individual damaged, for example, by a single spam message – somewhere between 0.01p and 0.1p would be a healthy overestimate?  The result is that nothing happens on the PECR "compensation for damages" front; however, if there is collective damage, then the costs and risks to the spammer is much increased.

However, I should add that the Commissioner already has powers to protect the collective. For instance, a Monetary Penalty Notice could be applied to spammers using personal data (e.g. an email address is personal data) where there has been blatant disregard for the email marketing rules.

With respect to notification (a hated activity), the D. I. C. pointed out that the ICO is funded by notification fees. Reduce notification and the Government would have to pick up the tab. My solution to this is to allow the ICO to be funded by Parliament; it is far too easy for an Executive to strangle data protection progress by withholding state grant-in-aid to the regulator.

Finally, the Commissioner is fond of soft law – so expect more Codes of Practice in the UK.

Conclusion

What do I think? There will be little progress and the UK’s Data Protection Act will be largely unchanged in the current decade. There might be tweaks at the edges – but no fundamental change.

Adverts re Data Protection courses

Our Spring UPDATE session is on 11th April in London: follow the link for details of speakers and content on our web-site (at £195+VAT for the day it is a real double dip recession busting snip). We are also running a Privacy Impact Assessment Course, a RIPA course and a Data Protection Audit on consecutive dates (21st to 23rd March).

We are starting a 5-day intensive data protection course in Edinburgh (beginning 24th February) and in Leeds (beginning 3rd March). These courses cover the DP ISEB syllabus and prepare delegates for the examination in April 2011, although you do not need to be seeking the qualification to attend.

Details from the Amberhawk website (www.amberhawk.com)