Hawktalk

Expect 1,000 objections by Member States to the EU’s Data Protection Regulation.

About three months ago, I blogged about the considerable Member State “disharmony” about the content of the Data Protection Regulation published in January. Well the disagreements have multiplied, and the Council has “released” a revised position on the first 10 Articles of the new Data Protection Regulation that will replace the 1995 Directive. The changes favour data controllers.

The text contains details of 147 Member State reservations on Articles 1-10 and 80(a) and 83 (about one ninth of the 90 or so Articles in the Regulation). So, if this rate of disagreement continues, one can expect over a 1,000 reservations about this Regulation. In some places, the Commission is in a minority re its proposals for change.

This number of objections suggests that the Regulation is in difficulty, a view reinforced when one reads on Page 1: "Almost all delegations are of the opinion that the proposed regulation contains too many cases of delegated acts. Several delegations have a reservation on the chosen legal form of the proposed instrument and would prefer a Directive".

Anyway, this is my view of the changes so far. I have focused on issues which resonate in the UK. Full references as usual.

Issue 1: FOI carve-out inserted; problem with FOIA averted

There was a potential problem with the DP/FOI interface and the S.40(2) exemption under FOIA. This arises because the Regulation suggests that public authorities cannot legitimise the FOI disclosure of personal data by using the “balance of interest justification” (paragraph 6 of Schedule 2). The problem was that this paragraph is at the centre of most UK Tribunal Decisions re disclosure of personal data to the public at large under FOIA (e.g. MPs expenses”) .

This problem has been “fixed” by an insertion into Recital 18. Recital (18) now states that:

 “This Regulation allows the principle of public access to official documents to be taken into account when applying the provisions set out in this Regulation. Personal data in documents held by a public authority or a public body may be publicly disclosed by this authority or body if the disclosure is provided for by Union law or Member State law to which the public authority or public body is subject, and the data subject's legitimate interests or fundamental rights and freedoms in the particular case are not prejudiced”.

Issue 2: The UK’s attempt to dilute the impact of Lindqvist decision has failed:

The UK suggested adding words to Recital 15 so that “The number of individuals to whom the data are disclosed shall not of itself determine whether the processing of personal data is conducted by a natural person in the course of an personal or household activity”. This change, if accepted, would largely negate Lindqvist (where the European Court of Justice concluded that the personal affairs exemption could not apply to personal data posted on a web-site).

The UK's attempt was rejected and the Recital 15 still maintains  Lindqvist; it states that:

 “(15) This Regulation should not apply to processing of personal data by a natural person, which are exclusively personal or domestic and without any gainful interest and thus without any connection with a professional or commercial activity. The Regulation should not apply to controllers or processors which provide the means for processing personal data for such personal or domestic activities”.

Issue 3: UK tried to get Internet tracking provision removed

The UK unsuccessfully tried to get Recital 21 removed and I cant see why. The offending Recital remains and states:

 "In order to determine whether a processing activity can be considered to ‘monitor the behaviour’ of data subjects, it should be ascertained whether individuals are tracked on theinternet with data processing techniques which consist of applying a ‘profile’ to an individual, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes".

Issue 4: No protection for the dead; UK wants to narrow scope of personal data

Recital (23) now states that:

 “The principles of protection should apply to any information concerning an identified or identifiable natural person. To determine whether a person is identifiable, account should be taken of all the means reasonably likely to be used either by the controller or by any other person to identify the individual, unless this would involve a disproportionate effort in terms of time or technical or financial resources. The principles of data protection should not apply to data rendered anonymous in such a way that the data subject is no longer identifiable. The principles of data protection should not apply to deceased persons” (my emphasis).

Instead of the above which refers to “reasonably likely”  the document notes that “the UK suggests to clarify that the principle of data protection applies only where the person is easily identifiable”. So if the individual is not easily identifiable, then there should be no data protection. This is a pretty shocking approach if you ask me; it undermines "personal data" so much, that one wonders what the MoJ were playing at when they made this suggestion.

Issue 5: Wider carve out for law enforcement and national security; could exclude CCTV in certain circumstances

In the old Article 2, there was an exemption defined by “This Regulation does not apply to the processing of personal data ... in the course of an activity which falls outside the scope of Union law, in particular concerning national security”. This is now widened  to  include “and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters)".

The reason why this change could exclude CCTV is that many CCTV systems are installed for “public security” reasons where “public security” is undefined. The lack of definitions of “state security”, “economic well-being of the State” and “public security” is unsettling; history reminds us  that Robespierre had a “Committee of Public Safety” which had little to do with “public safety”.

Issue 6: Definitional changes

Thank heavens we are back to a definition of “personal data”. The long clumsy definition of “data subject” has been replaced by a definition of “personal data” as follows:

'personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, by means reasonably likely to be used by the controller or by any other natural or legal person, in particular by reference to a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. If identification requires a disproportionate amount of time, effort or material resources the natural living person shall not be considered identifiable;

Genetic data and biometric data definitions have been narrowed. Now the former is defined only in terms of the “result from an analysis of a biological sample”; similarly “biometric data” have to be the result “from a specific technical processing”.

Issue 7: The protection afforded to health information reduced; important in the UK context

The definition of “‘data concerning health” no longer “means any information which relates to the physical or mental health of an individual, or to the provision of health services to the individual”; it is now  “information related to the physical or mental health of an individual, which reveal significant information about health problems, treatments and sensitive conditions of an individual”. This change has to considered in the light of other changes – see below.

Issue 8: The definition of Third Party returns (for data sharing)

In the UK law, a “third party” disclosure of personal data is often to a law enforcement agency. The return of this definition therefore signals the maintenance of the exemptions from the fairness provisions of the First Principle (e.g. from giving a fair processing notice) that arise when there are disclosures to law enforcement, government bodies and for national security purposes.

Issue 9: UK gets changes to facilitate use of personal data (e.g. medical records) in research

At the request of the UK Government, the Commission has added a research exemption to the purpose limitation principle;  so any personal data has the potential to be available for research purposes. The Principle now reads

Personal data shall be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible subject to the conditions and safeguards referred to in Article 83.

Issue 10: Lawfulness of processing has enlarged.

There are three changed (equivalent of Schedule 2 conditions); these are:

(f) “processing is necessary for the purposes of the legitimate interests pursued by a controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”. Note, this change maintains the status quo under the current Act and provides a general justification for disclosure of personal data to third parties (see “The definition of Third Party returns” above). It also helps the FOI position (see Issue 1: FOI carve-out inserted; problem with FOIA averted)

(g) the processing is for “purposes and under the conditions provided for in Article 9(2) (b) - (j)”. Looking at Article 9, the provision pairs the processing of sensitive personal data (e.g. Article 9 is the equivalent of Schedule 3 of the DPA) with an identical Article 7 (Schedule 2) condition; the most notably addition is for the (medical) research purposes. This change is likely to facilitate disclosures of sensitive personal data (e.g. medical records)  for research purposes, so long as the data controller informs the data subject about the research purpose; there is no right to object to this (as yet). Researchers hated the current consent requirements in the DPA that restricted the use medical personal data for research purposes; their pleadings have been heard.

(h) the “processing is necessary for the purposes and under the conditions referred to in Articles 80 to 85”. Again this widens the processing without data subject consent in areas of “the processing of personal data concerning health”, “the processing in the employment context”, “the processing for historical, statistical and scientific research purposes”, where there is an “obligations of secrecy” and for “existing data protection rules of churches and religious associations”.

What’s my view on the above?

Well most of the changes favour data controllers at the expense of data subjects. This reflects the changing mood in Europe where the main focus is on economic stimulus and growth to avoid a catastrophic Euro collapse. In such an tight economic environment, data controllers want to exploit their personal data assets and not be limited by what is still a very prescriptive Regulation. Put simply, at the current time, I think Member States have concluded that protecting data subjects just gets in the way of the economic priorities.

That is why there are 1,000 objections in the offing, many of which have been overridden by the Commission. I think it won’t be long before some Member States might say: “Do you think we should remit this Regulation to a Committee where it can get a private funeral?”.

I have said it before, with this level of Member State squabbling, I don’t see this Regulation surviving; if it does survive it will be a completely different animal. And I expect the lead in time will not be 2 years but far longer.

References:

Download detail of the 150 disagreements here! (happy reading) Download Blog_June2012_eu-council-revised-dp-position

A blog on the Commission’s inflexible approach: “I have been taken to the Promised Land and seen our data protection future”: http://amberhawk.typepad.com/amberhawk/2012/03/i-have-been-taken-to-the-promised-land-and-seen-our-data-protection-future-explained.html

EU’s Data Protection Regulation: divisions exposed as Member States show disharmony: http://amberhawk.typepad.com/amberhawk/2012/03/eus-data-protection-regulation-divisions-exposed-as-member-states-show-disharmony.html

The Regulation: what are the big changes to the Data Protection Act regime?: http://amberhawk.typepad.com/amberhawk/2012/01/the-regulation-what-are-the-big-changes-to-the-data-protection-act-regime.html

The Lindqvist case is a decision of the European Court of Justice in Case C-101/01, made in 2003; see for example, “Baby battle woman can’t claim data protection exemption for YouTube video, warns expert” on http://www.out-law.com/page-8401 ). The “expert” is me!

Do Google’s StreetView images constitute unfair and excessive processing? Does a Swiss Court’s conclusions translate into UK law?

In one of my blogs on Google StreetView (see references), I said that the Information Commissioner (ICO) could not serve a Monetary Penalty Notice (MPN) on Google when its software captured some personal data from household Wifi systems. This assessment was based on the fact that Google published statements to the effect that only an insignificant cache of random personal data was captured and that any capture of personal data was wholly unintentional.

I argued that the problem when serving an MPN under the Data Protection Act, is that any breach has to be both substantial and deliberate; insignificant and unintentional are miles away from that threshold. Thus taking Google’s statements on face value, I thought that the ICO would not be able to serve a MPN.

Indeed, I thought an Undertaking was about as far as the ICO could go under the Data Protection Act; that Undertaking required Google to delete any personal data collected and submit to a later audit.

Two recent events could change that position:

• A report (April 2012) from the USA’s Federal Communications Commission (FCC) has shown that the Google’s data collection by WiFi was intentional (e.g. the data were collected for use in other Google projects) and the project was unsupervised and this lack of supervision led to an engineer writing software to facilitate interception of WiFi communications (para 51 of report; see references); Google’s statements to the ICO have been shown to be, at best, “economical with the truth”.

• A Federal Swiss Court (June 2012) has ruled that in some circumstances, the collection of StreetView images could be unfair, excessive and may need consent (see references).

For the ICO, the FCC findings are an embarrassment; it looks as if he should not have taken Google’s reassurances on face value and perhaps ordered Google to retain what personal data it captured (some Data Protection Commissioners have done this). If, for example, the ICO had served a formal Information Notice on Google, then because of the FCC report findings, Google would be at risk of committing an offence, because the ICO was furnished with explanations of suspect quality (or “porkies”, if one wants to be more direct).

Assuming that Google has deleted the personal data (under ICO instructions) it is rather difficult for the ICO to now turn the clock back or indeed prove anything. However, I think the Federal Swiss Court decision gives the ICO an “out” (if he needs one); all he does is get Google to implement something similar the Court’s conclusions in the UK.

In its judgment (see references for Press Release) the Swiss Federal Supreme Court clarified a number of data protection issues in relation to Swiss data protection law. As this law is equivalent to Directive 95/45/EC (Swiss Data Protection law has been determined to offer an “adequate level of protection” as required by the Eighth Data Protection Principle of the UK Act), it is reasonable to assume that some or all of the Court’s conclusions are mirrored in the UK Act (although obviously the detail has to be determined).

The Federal Supreme Court found that Google does indeed process personal data with regard to images in its online Street View service and that the publication of inadequately blurred images can violate a person’s right to his or her own image and privacy. The Court also emphasised that individuals should not feel as if they are under constant surveillance. Both these issues could easily be mapped onto “unfair processing” requirements in UK First Principle terms.

The Federal Supreme Court also required that StreetView images of sensitive facilities, particularly women’s refuges, nursing homes, prisons, schools, courts and hospitals in Street View must be rendered entirely anonymous prior to publication on the internet and stipulated that in addition to faces, other identifying characteristics such as skin colour, clothing, aids of physically disabled persons etc. should no longer be identifiable.

According to the Swiss Data Protection Commissioner, this means that in such cases it will no longer be sufficient to blur faces and that such images may have to be altered, perhaps manually.

The Court also criticised the fact that the elevated cameras on StreetView cars afforded views into private areas such as enclosed yards and gardens this view and stated that “images of private areas not open to view to an ordinary passer-by are not to be published without the consent of the persons concerned”. This links to excessive and also to unfair processing in UK Data Protection Principle terms.

The Court granted a transition period of three years to correct the relevant StreetView images that have been collected, while newly published images will have to comply with these requirements immediately.

In addition, Google must improve its online notices regarding the right to correction and also accept complaints sent by post. Furthermore, Google must also provide at least a week’s advance notice of where it plans to record images, and announce a week before publication the localities that are going to be published online. This information must not only be published on the internet, but also appear in the local media.

With regard to the demand that all faces on Street View to be blurred by automated means, the Court stated that the maximum permissible error rate “must be no higher than one per cent”. Google will be required to document these improvements for the Swiss Data Protection Commissioner on an ongoing basis.

Because of the FCC Report and other behavioural advertising issues, Google have never been "flavour of the month". That is why I think this Swiss judgement will be closely scrutinised by most of Europe’s Data Protection Commissioners to see what parts can be implemented elsewhere in Europe.

References:

Commissioner plays poker with Google http://amberhawk.typepad.com/amberhawk/2010/11/commissioner-plays-poker-with-google.html

Google, Microsoft and Yahoo! should give ground on privacy concerns. http://amberhawk.typepad.com/amberhawk/2010/05/google-microsoft-and-yahoo-should-give-ground-on-privacy-concerns.html

Individuals can reclaim their privacy on the Internet at any time. http://amberhawk.typepad.com/amberhawk/2009/07/individuals-can-reclaim-their-privacy-on-the-internet-at-any-time.html (Link to detailed explanation as to why I think StreetView images can ALWAYS be transformed into personal data).

The FCC report into Google StreetView: Download Blog_FCC-Report-on-Google-Street-View-personal-data-mining

The Swiss Data Protection Commissioner’s Press release on the Swiss Federal Court Decision:  Download Blog_swiss DP press release

Do all Conservative Ministers use personal emails and texts to avoid FOIA?

I am beginning to think that there has been a systematic attempt by all Conservative Ministers to evade the obligations of the Freedom of Information Act (FOIA) by using personal emails and texts to discuss policy matters. At yesterday’s Leveson Inquiry, a second Cabinet Minister (Jeremy Hunt), admitted that he ONLY uses personal emails to discuss policy matters with his special advisors.

It is well known that the Education Secretary, Michael Gove, is challenging a ruling by the Information Commissioner (ICO) that information in a private email account relating to departmental business is subject to FOIA. Last year, the Financial Times reported that Mr. Gove had used an undisclosed private email account belonging to a "Mrs Blurt" to discuss government business with his special adviser (“Mr Blurt” one assumes).

The brevity of the relevant Decision Notice in the Gove case (see references) is such that the ICO considers it axiomatic that any information relating to public policy, if recorded in the private emails of a public authority employee, is still information subject to FOIA.

To arrive at his position, other Decision Notices relating to private email accounts show that the ICO asks questions such as:

• Does the email entirely relate to a private matter?
• Does the email relate to work issues connected to the public authority who has received the FOI request?
• Does the email reflect positively on, or enhance the status of, that public authority?
• Does that public authority use the email content in connection with its own functions?

If the ICO is satisfied that an email relates a private matter (i.e. it is outside the scope of the public role of the employee who "holds" the email), then he will form the view that the public authority has no interest in, or control over, the requested information. It follows that the private email is not held by a public authority and is outside the scope of FOIA.

The counter argument to this, proposed by Mr Gove, relates to whether or not a private email is “held” by a public authority; if it is a private email then it is "private" - full stop - nothing else to consider. That is why the DfE has not responded to the FOI request or justified its refusal to disclose the information.

To do this would be to acknowledge the fact that information in private email account of Ministers (e.g. about policy matters) would be indeed “held” by a public authority- and, this of course, is what legal issue before the Tribunal is all about.

That is why a DfE spokesman told the Guardian Newspaper that: "...The department does not accept the grounds on which the Commissioner has come to his conclusion. We believe that these are important issues which it is appropriate for the tribunal to consider".

Now to the accusation that a second Cabinet Minister (Mr Hunt) uses personal email accounts to discuss policy (which therefore theoretically “evades” the reach of FOIA). This is self evident from the transcript of the Leveson Inquiry reproduced below.

The context is a cross examination into email contacts between the Minister, his special advisor and News International in connection with the BSkyB bid (a matter of public interest dealing with public policy – in the same way as Mr Gove’s emails discussed education policy). The relevant part of the Transcript of Mr Hunt’s evidence goes as follows (my emphasis below):

Q. We know from other material that it went to your personal email account. Is anything to be inferred from that?

A. No, that is the only email account I use.

Q. So you don't have an email account within the department; is that correct?

A. No, my departmental email gets looked after by my private office, and if there's anything they need to show me from that, they show me, but the only email account that I use is my personal one.

Q. So most of the contact we have, perhaps all of it, from Mr Smith by email is obviously to your personal email account; is that the correct position?

A. That's correct.

Now, remember those texts between Messrs Hunt and Osborne on their mobiles? Such personal texting between personal mobiles could easily be another mechanism so that communications between Ministers evade FOIA consequences. Put simply; whereas an official email would be caught by FOIA, a private text to a private mobile is not (so the Gove theory goes).

The conclusions I have reached on this issue are as follow:

• the fact that a second Cabinet Minister has followed the “Gove personal email approach” implies that the Government’s review of FOIA will result in an attempt to widen the FOI exemption with respect to requests involving policy matters (The reason is that the personal emailing is a ruse intended to avoid FOIA as currently constituted; it could now fail at the Tribunal – a likely prospect in my view);

• many Ministers have been given formal advice, perhaps before the last General Election, that relates to the use of personal email accounts and FOIA (I do not believe that Mr Gove discovered this personal email argument by himself);

• all Conservative Ministers - not necessarily Cabinet Ministers - are/have been communicating to special advisors on public policy matters by private email accounts (see the “only”s as used by Mr Hunt in the above transcript); and

• there is a huge legal battle in the offing over this issue if the Government do not widen the FOIA exemptions re policy matters (see blog re Jack Straw’s evidence).

Happy Jubilee weekend.

References

Where the Government want extend FOIA exemptions:  (see “Desire for a FOI charging regime equates to reduced accountability of public bodies” on http://amberhawk.typepad.com/amberhawk/2012/05/desire-for-a-foi-charging-regime-equates-to-reduced-accountability-of-public-bodies.html

Leveson Inquiry and Mr Hunt’s evidence (see 31st May, morning session; pages 14/15) http://www.levesoninquiry.org.uk/hearing/2012-05-31am/

The “Gove” Decision Notice (Google “FS50436308”) and an example of a Decision Notice relating to Private emails (Google “FS50409217”)

Background Guardian Article to the Gove email and appeal: http://www.guardian.co.uk/politics/2012/mar/29/michael-gove-appeal-against-email-ruling