Hawktalk

Is the Irish Commissioner correct to claim that he can’t investigate Apple and Microsoft over PRISM?

Yesterday (Friday; 26th July), Reuters reported that the Irish Office of the Data Protection Commissioner (ODPC) had refused to look at the transfers of personal data undertaken by Apple and Facebook to the USA. An Austrian student activist group had asked the ODPC to investigate allegations that the U.S. National Security Agency (NSA) harvested emails and other private data via PRISM. This blog explains why I think the ODPC analysis is wrong.

PRISM is the controversial programme that allegedly gives the NSA back-door and hitherto secret access to the servers of several  important internet firms including Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, and Apple. Edward Snowden, the heroic whistle-blower (or villainous traitor depending on your standpoint), has claimed that Microsoft for instance, willingly provides access to all Outlook emails; a claim that has been refuted by Microsoft.

As an aside, I should add that all of the USA corporations identified as contributing to PRISM have denied they permit such access, sometimes strenuously so. I can’t be the only person on the planet who finds it amazingly difficult to reconcile these vociferous denials, with what is on these slides (see references), and with the vigorous attempts to extract Mr. Snowden from his bolt-hole at Moscow Airport.

Reuters reports (see references) that an ODPC spokesperson said: "We not consider that there are grounds for an investigation under the Irish Data Protection Acts given that 'Safe Harbour' requirements have been met". That spokesperson added: "If something is agreed by the European Commission for the purpose of providing safeguards, that ticks a box under our jurisdiction."

USA entity as data processor

The ODPC in his letter to Europe v Facebook (see references) explains the reason for his impotence is that there has been a transfer to a data processor in the USA's Safe Harbor who has then disclosed to the NSA:

“We consider that an Irish based data controller has met their data protection obligations in relation to a transfer to the US if the US based entity is in Safe Harbor. We further consider that the agreed ‘Safe Harbor’ Programme envisages and addresses the access to personal data for law enforcement purposes held by a US based data processor”.

In other words, because Safe Harbor offers an adequate level of protection, the OPDC has concluded that he cannot investigate onward disclosures in the USA, from his position in Eire.

I think the “data processor” comment in the passage above (and the data processor focus of the ODPC letter as a whole) surely makes the ODPC’s analysis wrong.

If a USA data processor discloses personal data, then this disclosure has to be under the control of the Irish based data controller. The ODPC for instance can explore any aspect of the contractual relationship between Irish data controller and data processor to assess the nature of any data processor disclosure made on behalf of the Irish data controller.

It follows that Irish Commissioner can investigate any disclosure or transfer authorised by the Irish based data controller as the location of the data processor is irrelevant and because the data controller is in charge of the processing.

USA entity as data controller

So let is assume the USA based entity is not a data processor but a data controller (which, unlike the ODPC’s letter, I think is the case), then the ODPC can still investigate.

In the SWIFT case, for instance, a Working Party 29 Report stated that a USA based data processor acted as a data controller when it provided law enforcement agencies back door access to financial transactions without the authority of the European data controllers (which were using the USA based “data processor” services; see references).

In any event the Irish data protection law states that the adequacy provisions only relate to the adequate level of protection in the territory once the personal data have been transferred. It does not relate to that processing prior to transfer.

This is a consequence of Section 11(2)(a) of the Irish Data Protection Act (which is very close to the wording of Schedule 1, Part II, Paragraph 15 in the UK Act) which states:

“Where in any proceedings under this Act a question arises—

(i) whether the adequate level of protection specified in subsection (1) of this section is ensured by a country or territory outside the European Economic Area to which personal data are to be transferred, and

(ii) a Community finding has been made in relation to transfers of the kind in question,

the question shall be determined in accordance with that finding”. (Note subsection (1) is a reference to what in the UK Act is the Eighth Data Protection Principle).

Note that this provision takes care not to use the word “processing”; it uses the word “transfer”. In other words, the ONLY processing operation of relevance to the S.11(2)(a) provision is “transfer” (and the same goes for Para 15 of the UK Act).

However, I do agree with the ODPC in that once the personal data have been transferred outside the control of the Irish data controller to another controller in the USA, then there is little to be done. However, prior to that transfer there are several processing operations, all of which take place in Ireland, all of which could be examined by the ODPC.

For instance, suppose there is a data controller in the USA and a data controller in Ireland. Can the ODPC re-assess the “fairness” of the disclosure to the USA data controller, given the new PRISM facts? Can the ODPC re-assess whether the disclosure is now lawful, given PRISM? Can the ODPC re-assess whether only relevant personal data are transferred? Can the ODPC look at any data sharing agreement between these two data controllers? Can the ODPC look, with fresh eyes, at the disclosure to the USA data controller in the context of “necessity”? Of course he can.

In this regard, consider the ICO’s enforcement action against the “Ring of Steel” around Royston (a sleepy market town near Cambridge) where all the main roads into Royston are covered by Automated Numberplate Recognition Systems becomes relevant.

The ICO’s press release about the enforcement states the capture of all vehicle registration marks, irrespective of any grounds for suspicion, is an example of unlawful processing in terms of Article 8 of the Human Rights Act, and also excessive (because such processing is unnecessary).

So could the ODPC consider that the ultimate capture of all email traffic by the NSA, irrespective of the grounds of suspicion is an example of unlawful disclosure in terms of Article 8, and also excessive? Of course he can.

In other words, whether the USA entity is a data controller or a data processor, the ODPC reasoning for not investigating is wrong. Of course, the ODPC might not want to investigate for other reasons, but that is not what is being argued in the ODPC's letter.

A final comment: if the Regulation goes ahead, it will be the Irish Commissioner who will be batting for all of Europe’s data subjects. I can’t be the only data subject who thinks that this prospect is getting more unattractive by the hour.

References

Download the OPDC letter to facebook v Europe: Download Blog august 2013 ODPS letter

Download the set of PRISM slides published by the Washington Post: Download Blog august 2013 washington post prism slide show

Reuters story: http://www.reuters.com/article/2013/07/25/us-usa-security-ireland-idUSBRE96O0T420130725

Blog on PRISM and SWIFT: "Of mice, NSA, GCHQ and data protection": http://amberhawk.typepad.com/amberhawk/2013/07/of-mice-nsa-gchq-and-data-protection.html

 

State secret: "why the Data Protection Act 1998 is defective".

Oh dear. Lost again.  The Tribunal has decided not to allow UK citizens to know why the Data Protection Act 1998 is defective, even though we are all discussing its replacement. The Tribunal decided at the time of the request, that the exemptions claimed by the MoJ applied.

However, the judgment ends with the following statements; do you think that this is an invitation to do the whole request again? If so, can you post a comment (without expletives) on this blog (see comments link at bottom).

This Tribunal however has to consider the facts and circumstances of this particular case. Infraction proceedings started in 2004. They have been largely resolved. It appears the outstanding issues have been parked and that the Regulations will replace the DPA in the foreseeable future. Draft Regulations are now out for consultation. The public interest in transparency and openness in knowing the outstanding issues could contribute considerably to understanding whether and how the draft Regulations deal with them and help provide meaningful public responses to the consultation on such an important area of human rights. 

However that is the position now and was not necessarily the position at the time of the request which was some two years earlier. At that time the negotiations of the Regulations had at best just started and there was no public consultation. However there was a need for confidentiality as explained above.  Therefore we find the need for transparency at the time of the request cannot be given significant weight. 

We find having weighed the public interest factors to and for disclosure that at the time of the request the balance narrowly favours maintaining the exemption. If the request was made today we may have come to another conclusion but we are bound by the law to consider the public interest test as at the time of the request.

I will ponder the judgment more carefully and come to a decision after a well earned holiday.

But I thought you should know the bad news; it is a major disappointment, I have to say.

References

The Tribunal Decision ( EA/2012/0110 Ministry of Justice v the Information Commissioner & Dr C Pounder) is on http://www.informationtribunal.gov.uk/Public/search.aspx

Relevant Blogs

European-Commission-explains-why-UK’s-Data-Protection-Act-is-deficient.html (Feb 2011)
http://amberhawk.typepad.com/amberhawk/2011/02/european-commission-explains-why-UKS-data-protection-act-is-deficient.html

Data-Protection-Act-fails-to-implement-50%-of-the-Directive.html (Nov 2009)
http://amberhawk.typepad.com/amberhawk/2009/11/data-protection-act-fails-to-implement-50-of-the-directive.html

Question-answered-why-does-the-European-Commission-think-the-UK’s-Data-Protection-Act-is-a-deficient-implementation-of.html (Feb 2013)
http://amberhawk.typepad.com/amberhawk/2013/02/question-answered-why-does-the-european-commission-think-the-uks-data-protection-act-is-a-deficient-implementation-of.html

 

Is the Data Protection Regulation dead? If not, should it be?

Are you thinking what I am thinking? I think you are.

Week last Monday, I attended a meeting of the Government’s Data Protection Advisory Panel, the Group that discusses the Data Protection Regulation with officials negotiating for the UK. I came away from that meeting thinking that, because of the range of disagreements over its content, the Data Protection Regulation is not going to be agreed before the June 2014 deadline.

Because of this, I think progress with both the Regulation and the Data Protection Directive in the field of law enforcement and should be stopped now, in favour of a more considered approach after the next European Elections in June 2014. This is the only way of making sure that groups representing the interests of data subjects and data controllers will be able express a view on any final text (if one is agreed).

At the moment, we may be on track of getting a revised Regulation text that is sprung on data controllers and data subjects at the last-minute and where there will be very little opportunity to engage with its provisions.

For instance, the European Parliament is still looking at amending the Commission’s original text published in January 2012, which following the comprehensive Irish revisions and DAPIX leaks is largely irrelevant. In practice, I can’t see the purpose of discussing 3,000 plus amendments to a text when everyone knows that text is completely different to the one that the Ministers and Commission are now amending.

Even with the revised Irish/DAPIX text, Member States cannot agree on the form of the Regulation; there are over 300 “Reservations” marked on the DAPIX text (see references). This usually means that the reserving Member States (or Commission) fundamentally disagree with the Irish/DAPIX text. It is also usually an indication that one or more Member State is likely to vote against the particular provision.

I also think there is a growing realisation that if Member States want “flexibility” in the Regulation’s text, that a further Data Protection Directive could unify all aspects of data protection (i.e. include law enforcement provisions as well).

However, if there is to be a new Data Protection Directive after the European Elections, then the current proposal for a Regulation has to die a death. And if the Regulation is to die, then somebody has to kill it. So who does the deed? And when? And how?

The real risk is that if no one (i.e. Parliament, Ministers or indeed Commission) has the courage to pull the plug, a runaway data protection regulation train will start its journey.

For instance, Member States will continue to negotiate through the Lithuanian and Greek Presidencies. No doubt further comprehensive changes will be made to a text, changes which of course, no-one from the data controller or data subject community have had any chance to make representations about its content.

Member States argued at their Council of Ministers that “nothing is agreed until the final text is agreed”; they have not considered that when there are comprehensive revisions (which there has been), this  "nothing is agreed etc..." position excludes their own countries’ data subjects and data controllers from involvement in legislation of which they are the prime focus.

Parliament will also continue in its hapless task and indeed, they might even arrive at 3,000 compromise agreements  – just to say “we succeeded”. Again the result will be new text, where there again, no-one from the data controller or data subject community will have had any real chance to consider.

Of course, the Commission might present another text to get through the current impasse; but there again members of the data controller or data subject communities are excluded.

The nightmare scenario is that the Parliament, Commission and Ministers try to resolve their diverse texts, so that a compromise version of the Data Protection Regulation emerges. There again no-one from the data controller or data subject community will have had any chance to comment on any compromise text.

This kind of deal could result in comprehensive horse-trading and risks the emergence of a text based on half-baked compromises and proverbial deals "made in smoke-filled, back-rooms”. For instance, agreements on the lines that have little to do with the best data protection outcomes;  “If you support our definition of “consent”, we will support your opt-out for the processing of personal data for your public sector”.

I think you have got the message: there is significant risk of the emergence of a data protection text where those directly affected will have had little say. Whatever our legislators choose as any final text (if there is one), representatives of data controllers and data subjects will have largely been excluded from the revision process  (unless, of course, the data controller is a member of the group that is spending millions of euros on lobbying).

So that is why I would vote for:

(a) “Pull the plug” now on the Regulation and law enforcement Data Protection Directive;
(b) use the time up to June 2014 and prepare a further draft version for comprehensive data protection rules for consultation, covering all public sector and private sector processing of personal data, and
(c) aim for a further round of legislation in later 2014 (after the European Elections).

In summary, getting a late bus to the correct destination is far better than catching the wrong bus at the right time.  The problem, in my view, is that the risks of getting it wrong are increasing all the time.

Blog References

Disagreements re DAPIX text (link at the end of): http://amberhawk.typepad.com/amberhawk/2013/06/latest-dapix-leak-of-the-data-protection-regulation-eases-transfers-and-makes-fining-difficult.html

Irish text link (link at end of): http://amberhawk.typepad.com/amberhawk/2013/06/irish-do-hatchet-job-on-the-data-protection-regulation.html

Council of Ministers meeting disagreements (link at end of): http://amberhawk.typepad.com/amberhawk/2013/06/member-states-divide-over-the-protection-offered-by-the-irish-version-of-the-data-protection-regulat.html

 

Of mice, NSA, GCHQ and data protection

Suppose you see a mouse in your house; is this the only mouse in your house?

The relevance of the question will come apparent when we dig deeper into those infamous “black boxes” allegedly used by the USA’s National Security Agency, the latest GCHQ mass interception fandango, and the responsibilities of the Information Commissioner.

With respect to the “black boxes”, I am surprised that no-one has linked the latest machinations with the SWIFT (Society for Worldwide Interbank Financial Telecommunication) debacle back in 2006. In summary, a clearing house “data processor” in the USA was required to provide “black box” access to USA national security authorities.

The banks in the UK, for instance, as data controllers were kept totally in the dark about the scale of this backdoor access. When the scandal broke, the Working Party of Data Protection Commissioners issued a strongly worded criticism (see references) which said that the “data processor” had assumed the mantle of “data controller”. UK banks were deemed to be disclosing personal data to another data controller and breaching the data protection rules, left right and centre.

It is not surprising therefore that the processing was eventually shifted to a data processor in Switzerland (which is deemed to have an adequate level of protection), unlike the USA.

Given the current furore over “national security” and the bugging/tapping into the European Commission’s institutions, it is interesting to note the possible role of any national security agency. Are you really assuming that that the USA bugged but the Russians or Chinese did not try? And are the Europeans so innocent that they did not know this might happen?

So could the British bug these European institutions under current UK law? I don’t know, obviously, but you make your own mind up. The Intelligence Services Act 1994 defines the functions of the Intelligence Service to be exercisable only:

“(a) in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty’s Government in the United Kingdom; or
(b) in the interests of the economic well-being of the United Kingdom; or
(c) in support of the prevention or detection of serious crime”.

Note the last two conditions and ask yourself a few questions. Is it in the “interests of the economic well-being of the United Kingdom” or in support of “the prevention or detection of serious crime” to:

• know what is happening to monetary policy in the Euro zone?
• know UKIP’s policy towards how it would withdraw from the European Union?
• identify serial child abusers who use child porn and chat-sites?
• identify political extremists who threaten violence in their email traffic?
• know what Google’s policy towards its future global internet services?

And that is why I think that Edward Snowden is only confirming actions which, if one thinks about it, are to be expected. The only issue is not whether such surveillance occurs, but rather the authorisation and supervision of such surveillance as being a “necessary interference” in the context of Article 8 of the Human Rights Act (a subject that I have discussed before; see references to longer articles if interested).

In this regard, the real problems  are:

1. The Courts already defer to the Home/Foreign Secretary on national security issues.
2. The Courts are unlikely to challenge Article 8 interference and second guess national security issues because Article 8 is a qualified right.
3. Both main Parties are considering fettering judicial discretion in national security cases.
4. Scrutiny by Parliament of national security issues is currently limited.
5. There are too many Commissioners in the national security protection business.
6. The current complaints system concerning national security does not appear to be credible.
7. There is uncertainty in the borders between policing and national security.

Notice also that all the data protection authorities huffed and puffed over SWIFT; there is an deafening silence when personal data are captured by similar black boxes, assuming they are attached to the servers of Facebook, Google and Microsoft etc. (which these companies deny).

If GCHQ has intercepted vast amount of personal data, there should be a certificate under Section 28 of the DPA (as well as authorisation under RIPA). If one does not exist, then the ICO can exercise his powers until that Certificate is produced. For instance in the case “SSHD –v  The Information Tribunal” one Department told the ICO that:

"As you are aware, section 28 of the Data Protection Act limits the extent to which we are able to assist you in this case. We will obtain a Ministerial Certificate signed by the Home Secretary should we be required to do so, but would first like to provide you with as much information as we possibly can give the limits imposed on us by the Act".

So in other words, the ICO and in fact all of Europe’s Data Protection Commissioners should not remain so silent (all there appears to be is a one page letter from the Working Party; see references). They can ask certain questions - and should do so to the limit of their powers. After all the allegations relate to disproportionate interception of personal data and processing that is not necessary for the statutory functions of certain bodies.

Note also that if SWIFT gets a black box, if Google, Microsoft, AOL, Skype etc are linked to other alleged “black boxes”, and the GCHQ intercepts by some “black box” all internet traffic leaving to UK, what will happen with all those cloud based services which involve USA companies and internet communications which leave the UK?

Should all such cloud using data controllers having seen reference to "black boxes" elsewhere assume that there are no black boxes are attached to their cloud communications? Or is it when you see a mouse in the house do you assume that there is only one mouse?

References

SSHD –v  The Information Tribunal  Neutral Citation Number: [2006] EWHC 2958 (Admin).

Swift WP29  report: http://ec.europa.eu/justice/policies/privacy/news/docs/PR_Swift_Affair_23_11_06_en.pdf 

Slide show re the NSA interceptions: http://www.washingtonpost.com/wp-srv/special/politics/prism-collection-documents/

One page letter from WP29: http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2013/20130607_letter_art29wp_chairman_vp_reding_prism_en.pdf

 

Relevant blogs on surveillance

http://amberhawk.typepad.com/amberhawk/2010/10/labours-privacy-legacy-1-in-50-subject-to-communications-surveillance.html

http://amberhawk.typepad.com/amberhawk/2009/10/can-national-security-agencies-disclose-communications-data-or-anpr-images-to-anybody.html

Relevant references downloads from  http://www.amberhawk.com/policydoc.asp

Evidence: Human Rights Legislation and Government Policy towards national security – 2006. Explores data protection in the context of Parliamentary scrutiny, data protection, human rights terrorism and national security Ebidence to the Joint Committee of Human Rights

Nine principles for assessing whether privacy is protected in a surveillance society (Part 2) – 2008. The article sets out nine principles that rectify the problems identified by the UK’s inadequate regime and promotes specific Principles to improve the data protection/human rights regime. Part 1, goes into why data protection and human rights regime in the UK is deficient.