Hawktalk

EU Study calls for better privacy protection in the Cloud and more transparency re USA’s surveillance laws

Happy Data Protection Day.

What better time for the European Parliament to publish a report that calls for more "legal certainty in jurisdiction-spanning transfers of data involving a multiplicity of data controllers and processors” and for the Safe Harbor Agreement to be extended to Cloud Service providers based in the USA.

In a passage that will get all the headlines, the Report also calls for more transparency in relation to how law enforcement agencies in third countries (but in particular the USA) will use their surveillance powers to access personal data, held in the Cloud, about data subjects who are not their citizens.

The Report states that “The challenges of privacy and data protection in a cloud context are clearly underestimated, if not ignored. In most European for a dealing with cybercrime, Data Protection laws appear to be very marginal in the agenda and inadequately addressed to meet the challenges raised by cloud computing”. That is why “Data Protection offences should be recognized as a type of "Cybercrime".

The Report claims that as the Data Protection Directive 95/46/EC and the Proposal for a General Data Protection Regulation "do not apply to law enforcement activities” (unlike the UK data protection law which does apply to policing and law enforcement) there is a need for “a harmonization of fundamental legal concepts such as 'jurisdiction', 'data processor' and 'data controller' at EU level”.

The Report claims  “Such harmonization would decrease conflicts of laws and would contribute towards more legal certainty for the data subject/consumer as regards the applicable law”.

The Report also claims that “the EU-US Safe Harbour Principles which allow transfers of data to US organizations does not apply to telecommunication common carriers which also provide cloud computing services”.

Consequently, the “study recommends that Safe Harbour Certification are checked and reinforced. The 'Safe Harbor' principle should also apply to telecommunication common carriers which also provide cloud computing services”.

With respect to Homeland Security, the Report states that “Particular attention should be given to US law that authorizes the surveillance of Cloud data of non-US residents”. Consequently the European Parliament “should consider amending the DP Regulation to require prominent warnings to individual data subjects (of vulnerability to political surveillance) before EU Cloud data is exported to US jurisdiction”.

In general “No data subject should be left unaware if sensitive data about them is exposed to a 3rd country's surveillance apparatus. The existing derogations must be dis-applied for Cloud because of the systemic risk of loss of data sovereignty. The EU should open new negotiations with the US for recognition of a human right to privacy which grants Europeans equal protections in US courts”.

Finally a different topic: if you are looking for a data protection day present for yourself  why not consider a copy Rosemary Jay’s Fourth Edition of her Data Protection Law and Practice which is officially launched today. At 1330 pages, it is the obvious book to have if ever you are asked that “Desert Island” question.

References:

EU’s Cloud Report http://www.europarl.europa.eu/committees/en/libe/studiesdownload.html?languageDocument=EN&file=79050

Details of Rosemary Jay’s book (the Fourth Edition of Data Protection law and Practice) can be downloaded here: Link at bottom of; http://amberhawk.typepad.com/amberhawk/2013/01/european-parliament-mauls-the-data-protection-regulation-enhanced-protection-for-data-subjects-and-fettering-of-commission.html

Cameron’s speech puts UK accession to any Data Protection Regulation and Directive in doubt.

In yesterday’s speech on the relationship between the UK and the Europe Union, the Prime Minister has raised doubts as to whether the UK will adopt both the proposed Data Protection Regulation and the Data Protection Directive in the field of law enforcement.

Reading the runes: if the Conservatives win the next General Election, I think that implementation of both Regulation and Directive is unlikely.

Why am I saying this? First, the Conservatives are going to consult business about the EU Regulations they want to keep; how many businesses do you think will respond with “Well that nice Data Protection Regulation is top of my list”?

Then look at the timings: Election in 2014/15; any referendum is in 2017,  negotiations with the EU in 2015-2017 and the (optimistic) commencement of the Regulation is 2016. This is smack in the middle of the negotiations which means the Regulation is an obvious target for negotiations.

Finally, the Conservatives are to look at what competences they want to return. So consider the notion of “return of competences” in the context of the following extracts from the PM’s speech, intertwined with the commentary on the Directive and Regulation released last week (see last week’s blog).

In his speech, the PM said: “There is a crisis of European competitiveness, as other nations across the world soar ahead”. In its criticism of the Data Protection Regulation, the Government state that it “is seriously concerned about the potential economic impact of the proposed Regulation. At a time when the Eurozone appears to be slipping back into recession, reducing the regulatory burden to secure growth must be the priority for all Member States”.

In his speech, the PM said: “And I want us to be pushing to exempt Europe's smallest entrepreneurial companies from more EU Directives”. In the criticism of the Data Protection Regulation, the Government state “At a time when the Eurozone appears to be slipping back into recession, reducing the regulatory burden to secure growth must be the priority for all Member States. It is therefore difficult to justify the extra red-tape and tick box compliance that the proposal represents”. In addition, “we estimate the costs for UK small businesses of simply demonstrating compliance with the proposals to be around £10 million” (in 2012–13 earnings terms) and in terms of the “whole economy of £100–£360 million per annum (in 2012–13 earnings terms)”.

In his speech, the PM said: “In Britain we have already launched our balance of competences review – to give us an informed and objective analysis of where the EU helps and where it hampers”. In the criticism of the Data Protection Regulation, the Government state that “the Government’s position that the proposed Regulation should be re-cast” to “allow for harmonisation in the areas where it is advantageous and flexibility for Member States where it is required” and that “the proposed Regulation places prescriptive obligations upon data controllers”.

In his speech, the PM said: “Let us not be misled by the fallacy that a deep and workable single market requires everything to be harmonised, to hanker after some unattainable and infinitely level playing field”. In the criticism of the Data Protection Regulation: “...This is a ‘one size fits all’ approach which does not allow data controllers (from small online retailers to multinational Internet companies) to adopt their own practices in order to ensure compliance with the legislation”.

In his speech, the PM said: “Some of this antipathy about Europe in general really relates of course to the European Court of Human Rights, rather than the EU. And Britain is leading European efforts to address this”. This is undisguised code for the UK withdrawing support from the European Convention of Human Rights in favour of a localised UK Bill of Rights which is very likely to weaken the obligation to respect “private and family life” by allowing more flexible interference by public authorities.

In his speech, the PM said: that the Government was “Launching a process to return some existing justice and home affairs powers”. In the criticism of the law enforcement Data Protection Directive, the Government said that it “does not consider that full harmonisation of police and judicial co-operation in criminal matters is necessary or desirable”. This is because “introducing prescriptive requirements for domestic processing may instead have a detrimental effect on law enforcement operations, placing onerous burdens on data controllers and huge costs on public authorities”.

In summary: I think it is clear that the Government sees the Data Protection Regulation primarily as a burden on business; if the other Member States don't change its text, then the Regulation is very likely to be a candidate for an opt-out. In the promised referendum, if UK voters decide the leave the EU, then Iit’s also good-bye to the Regulation. Either way, its bye-bye.

In any event, it is clear that the UK wants nothing to do with the Data Protection Directive in the field of law enforcement. That is definitely “toast” if there is a Conservative Government after the next Election.

References:

“Scale of UK Government’s opposition to the proposed Data Protection Regulation and Directive made absolutely clear”. http://amberhawk.typepad.com/amberhawk/2013/01/scale-of-uk-governments-opposition-to-the-proposed-data-protection-regulation-and-directive-made-abs.html

Listen to the Prime Minister's speech: http://www.bbc.co.uk/news/uk-politics-21156905

 

Scale of UK Government’s opposition to the proposed Data Protection Regulation and Directive made absolutely clear.

Last week, we had the European Parliament saying that the Commission’s proposed Data Protection Regulation and Directive should be strengthened; this week we have a publication that identifies the extent of the UK Government’s opposition to both.

The document which expresses the nature of the opposition is the Government’s Response (“the Response”) to the Justice Select Committee’s opinion on the European Union Data Protection Regulation (and Directive in the field of law enforcement and judicial cooperation); its text shows what the Government wants to change and why (link at end).

This blog essentially comprises two sets of quotes from the Response, one set relating to the Regulation and the other to the Directive. The quotes more or less speak for themselves and I make very little commentary. One gets the gist very quickly! Note, however, that the UK Government’s opposition to the Directive is almost absolute.

Quotes in relation to the Regulation

1. “The UK Government’s position with regard to the proposed Regulation is that it should be re-cast as a Directive”. Comment: this is to allow flexibility for Member States to implement the data protection rules in their own way. The Response states that “the Government’s position that the proposed Regulation should be re-cast as a Directive would allow for harmonisation in the areas where it is advantageous and flexibility for Member States where it is required”. Please note that the UK Government is not the only Member State that prefers an implementation by Directive (see references).
2. “If the proposed Regulation were to be changed to a Directive and the proposal for a Directive were to be taken forward, then there would be two Directives, one for the general data protection framework and one for processing in the area of police and judicial co-operation in criminal matters. An advantage of this approach would be that the two Directives could then be implemented in a single piece of domestic legislation to help avoid confusion and support consistency where necessary”. Comment: note that the phrase “support consistency where necessary” infers that the data protection principles, rights, enforcement etc that apply to the police in the proposed law enforcement Directive might not be the same as in the Regulation.
3. “The Government wants to see EU data protection legislation which protects the civil liberties of the individual whilst allowing for proper public protection and economic growth and innovation. These should be achieved in tandem, not at the expense of one or the other”. Translation: the Government believe that the higher protection for the individual is at the expense of public protection and economic growth.
4. The Government states that “the proposed Regulation places prescriptive obligations upon data controllers as to how they will comply with the proposed Regulation, such as completing data protection impact assessments and hiring data protection officers. This is a ‘one size fits all’ approach which does not allow data controllers (from small online retailers to multinational Internet companies) to adopt their own practices in order to ensure compliance with the legislation”.
5. Instead “the European Commission’s proposal should focus on regulating outcomes, not processes”. Under the risk-based model that the UK is advocating, “it would be for data controllers to put measures in place in order to comply with the outcomes prescribed in the legislation”.
6. “The Government is seriously concerned about the potential economic impact of the proposed Regulation. At a time when the Eurozone appears to be slipping back into recession, reducing the regulatory burden to secure growth must be the priority for all Member States. It is therefore difficult to justify the extra red-tape and tick box compliance that the proposal represents”.
7. “At a time when the Eurozone appears to be slipping back into recession, reducing the regulatory burden to secure growth must be the priority for all Member States. It is therefore difficult to justify the extra red-tape and tick box compliance that the proposal represents”. For example, “we estimate the costs for UK small businesses of simply demonstrating compliance with the proposals to be around £10 million” (in 2012–13 earnings terms) and in terms of the “whole economy of £100–£360 million per annum (in 2012–13 earnings terms)”. Comment: warning! There are some dodgy numbers about (see references).
8. “Whether or not a DPO is appointed could depend on the quantity and the sensitivity of the data that is being handled”. Comment: this is at odds with the Regulation which says that it is the size of the organisation that determines when a data controller needs a Data Protection Officer (DPO), and the European Parliament’s amendment which says the number of data subjects is the important consideration when having a DPO.
9. “The Government believes that the supervisory authorities should have more discretion in the imposition of fines and that the proposed removal of discretion, combined with the higher levels of fines, could create an overly risk-averse environment for data controllers”. It adds “ere there to be divergence in terms of the use or the levels of fines, and if those differences had a negative effect on compliance, the Government considers that the provision of guidelines by the European Data Protection Board could be useful”. Comment: note that the UK sees the role of the Board is to provide Guidelines (which, of course, could be ignored in the same way as many Working Party 29 Reports are ignored at the moment).
10. “The Government agrees with the Committee’s view that the proposed Regulation as drafted is over-prescriptive in terms of how data controllers comply with the draft Regulation. Under the risk-based model that the UK is advocating, it would be for data controllers to put in place and regulate the obligations in order to ensure compliance with the legislation”.
11. “We want to achieve protection for individuals whilst ensuring that data controllers can process data without having to comply with expensive and bureaucratic measures which do not enhance data protection and which prevent businesses from growing".

Quotes in relation to the Directive

Before starting there is a reference in the quotes below to “domestic processing”; to avoid confusion the term is a reference to how the law enforcement agencies work within the UK (e.g. how they process personal data already just within UK borders). It is not a reference to Section 36 of the current DPA!

1. “The Government shares the Committee’s view that there is not a pressing need to update the Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. The Framework Decision has yet to be fully implemented across all Member States, or evaluated. Implementation and evaluation of the current legislation should come first before new legislation is considered”.
2. The Government believes that the inclusion of domestic processing in the draft Directive is at odds with the principle of subsidiarity. Under this principle, the form of Community action should be as simple as possible, and leave as much scope as possible for national decision. Furthermore, there is no evidence to demonstrate that the lack of EU rules in this area has had a detrimental impact on law enforcement activity or the protection of individuals. Comment: this can be shortened to “hands off our internal approach to policing”. Given the political agitation on the Conservative back benchers, I can’t see the current UK Government implementing it at all.
3. “It is our view that introducing prescriptive requirements for domestic processing may instead have a detrimental effect on law enforcement operations, placing onerous burdens on data controllers and huge costs on public authorities – without delivering better data protection for individuals”.
4. “On the issue of common law, the Government shares the view of ACPO and the Committee that the Directive should not undermine the use of common law powers in the UK or other countries with similar systems”. Comment: this shows that the Government believes that the proposed Directive would, in its current form, undermine the common law powers of the police.
5. “The Government therefore does not consider that full harmonisation of police and judicial co-operation in criminal matters is necessary or desirable”. Comment: can’t be clearer than that.

References

The Response of the UK Government to the Justice Select Committee Report: Download Blog UK Government response to Justice re eu-data-protection-proposals

Blog covers some dodgy numbers: “Data Protection Regulation cost of compliance. Has the UK published suspect numbers?” http://amberhawk.typepad.com/amberhawk/2012/11/data-protection-regulation-cost-of-compliance-has-the-uk-published-suspect-numbers.html

Blog specifies which countries want the Regulation implemented as a Directive: http://amberhawk.typepad.com/amberhawk/2012/11/uk-government-opposed-to-the-commissions-data-protection-regulation.html

Blog discusses the Report to European Parliament on the Data Protection Regulation; enhanced protection for data subjects and fettering of Commission’s powers. http://amberhawk.typepad.com/amberhawk/2013/01/european-parliament-mauls-the-data-protection-regulation-enhanced-protection-for-data-subjects-and-fettering-of-commission.html

Details of our half day workshop on the Data Protection regulation can be downloaded here: http://www.amberhawk.com/uploads/Brochures/Amber_Regulation%20half%20day%20workshope.pdf

 

European Parliament mauls the Data Protection Regulation; enhanced protection for data subjects and fettering of Commission’s powers

Happy New Year. Nice to be back at work, I think not.

In a 215 page report, the European Parliament has suggested 350 Amendments to the text of the Data Protection Regulation published last year. This blog gives you an impression of those proposed changes that caught my eye on a “speed read” of the Report (produced by Jan Albrecht, the rapporteur for the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs).

I think the most important proposal is the fettering of the European Commission’s powers. In many instances, many powers found in the Regulation are amended to involve the European Data Protection Board of Data Protection Commissioners (the Regulation’s formal structure for what we now call the Working Party 29 Group of Commissioners).

Sometimes the powers are transferred entirely (e.g. when the Board is “entrusted with the task of further specifying the criteria and requirements for the methods to obtain verifiable consent” or when specifying the criteria, conditions and appropriate safeguards for the processing of what we know as sensitive personal data (in the UK Act, these are the preserve of the Secretary of State).

Sometimes the Commission need to involve the Board before exercising powers; for instance the Commission may lay down standard forms for specific methods to obtain verifiable consent” but only “after requesting an opinion from the European Data Protection Board.

The change is to be welcomed because it helps reduce the conflict of interest that is endemic in every data protection regime that has ever existed. For instance, the European Commission is responsible for processing personal data for its own objectives and also responsible for establishing the data protection rules in the Regulation. This means that there is always a risk that the Commission could subvert data protection law to suit its policy objectives.

Such subversion happens in spades. So, for instance, if it is politically convenient to ignore data protection considerations when transferring personal data abroad (e.g. PNR data to the USA) or enter into agreements that are data protection deficient (e.g. the European Data Protection Supervisor has publicised several examples of such agreements), then the Commission does so quite freely. All Data Protection Commissioners can do is shout in public, and then go to the pub and cry into their beer.

In this way, the European Commission (and any Government) can be seen as a special data controller that has powers to amend the data protection law so to ensure that its processing is lawful. This contrasts with what most data controllers do; they have to amend their processing of personal data to ensure that it conforms with data protection law.

Another small amendment that caught my eye was that the domestic purpose exemption is modified so that individuals can use Ebay. This was one of the UK Government’s objections to the text. Someone contact the Daily Mail immediately: tell them that a lefty Green MEP has caved in to Dave and Nick.

The Report has introduced the concept of a not quite personal data; a 'pseudonym'; I am not sure of the consequences. A 'pseudonym' is  a “unique identifier which is specific to one given context and which does not permit the direct identification of a natural person, but allows the singling out of a data subject”.

The Report then states that “For the use of pseudonymous data, there could be alleviations with regard to obligations for the data controller undertaking the processing (e.g where personal data are processed only in the form of pseudonyms, consent may be given by automated means)".

I am not convinced the concept works also and I think it needs a definition of “pseudonymous data” which also considers what other information the data controller has. For instance, suppose I know that mickey.mouse@hotmail.com is really Fred Bloggs. The mickey.mouse email address is pseudonymous data as it does not “not permit the direct identification of a natural person”; but I know who it is.

The Report has tried to separate that processing with the consent of the data subject from that processing that is necessary for a contract. For instance, we have all seen Fair Processing Notices of the form “by signing this contract, you consent to …… etc etc”.

In these cases, the Report recommends that “The execution of a contract or the provision of a service may not be made conditional on the consent to the processing or use of data that is not necessary for the execution of the contract or the provision of the service”.

The definition of data subject is stronger. “A data subject means a natural person or a natural person who can be identified or singled out, directly or indirectly, alone or in combination with associated data, by means reasonably likely to be used by the controller or by any other natural or legal person….“ (main changes in italics). What this means that if an individual is not identified but is “singled out”, then the data controller is processing personal data.

Clearly if you are on the Internet and someone is monitoring your IP address, you are being “singled out” and you become a data subject. One can also see that also that the IP address is “pseudonymous data” (see above), and what the Report is trying to do, but there is an overriding uneasy feeling that the drafting is not quite right.

The Report’s proposals would still scupper requests for personal data under the UK's FOI Act. This is because the proposal still excludes reference to the “Third Party’s legitimate interests” to the disclosure (i.e. para 6 of Schedule 2 of the DPA). I should add, that my colleague Sue Cullen has written a wonderful chapter on the trials and tribulations of the DP/FOI interface in Rosemary Jay’s next edition of her data protection bible (see references).

In general, for data controllers relying on para 2 of Schedule 6, the Report has defined circumstances when the legitimate interests of the data controller are always overridden by concerns regarding the fundamental rights of data subjects. For instance, the rights and freedoms of the data subject always prevail if Sensitive Personal Data or location data, or biometric data are processed or if the personal data are to be used for profiling.

In the context of profiling, the Report suggests amendments that ensure that any data controller will find any profiling activity far more difficult to do.

I have to admit that some of the amendments are poorly drafted. For instance, consider the data minimisation principle (i.e. our Third Principle relating to adequate, relevant, not excessive). The Report amends the requirement and states that personal data are “limited to the minimum necessary in relation to the purposes for which they are processed; they shall only be processed if, and as long as, the purposes could not be fulfilled by processing anonymous information that does not involve personal data) – (my emphasis).

Sadly the phrase “anonymous information that does not involve personal data” implies that some “anonymous information does involve personal data” – which of course is a contradiction in terms.

Some proposals are just “off the wall”. The Report has a proposal to modify the small business exception in several places by replacing the current criterion of 250 employees with a criterion based an enterprise processing personal data relating to fewer than 500 data subjects per year.  I think most small businesses would have 500 email addressess in Outlook!

Anyway, Happy New Year again. Another 220 pages to read and digest. I just told my psychiatrist that it was a real pity the Report did not come in time for Xmas as fills your stockings nicely.

However, remember that the real power is with the Council of Ministers. It what they say that goes; this report, when the chips are down will be more or less ignored (and the drafting errors will make this so easy to do).

References

Jan Albrecht Draft report on the COM proposal for the General Data Protection Regulation http://t.co/3NtwVsYS

Details of Rosemary Jay’s book (the Fourth Edition of Data Protection law and Practice) can be downloaded here Download RJ BOOK DPLP FINAL

Details of our half day workshop on the Data Protection regulation can be accessed here http://www.amberhawk.com/uploads/Brochures/Amber_Regulation%20half%20day%20workshope.pdf