Hawktalk

EU Parliament proposes 100 million euro fines for non-compliance with Data Protection Regulation (or more).

Well I have just had a speed read of the leaked amendments that are being debated by the European Parliament today (see references). The general impression is that the Snowden revelations about the NSA has strengthened the Parliament’s view on the provisions that relate to the protection of data subjects when there is data sharing with the authorities.

I have also concluded that all that lobbying by corporate USA and Internet business has come to very little. They have very little to show for their efforts; I suspect courtesy of the NSA issues. The latest revelations concerning NSA surveillance on the French has just reinforced the "mood music" in favour of a stronger Regulation that protects data subjects.

We now know that the European Parliament has accepted these compromise proposals. The next question is whether the Council of Ministers will also converge to a final text, and if so, there will be another round of compromises to produce a final text. The European Commission could also produce another text. All it needs is for these two or three texts to be reconciled, we will then have a finished text; the Regulation is "on" so to speak.

As is well known, the Council of Ministers are gutting the Commission's original text (see references) and is moving in a less prescriptive direction with more flexibility for Member States; by contrast, the Parliamentary amendments tweak the text in a less prescriptive direction but adds more prescription in places.

In other words, there is a large gulf between the two compromise texts and a lot that can go wrong before a final compromise is reached.

Anyway – here goes. What caught my eye in these Parliamentary amendments – with very little comment.

Leading the headlines will be the following mega-fine provision in the reorganised Article 79; just read on.

“To anyone who does not comply with the obligations laid down in this Regulation, the supervisory authority shall impose at least one of the following sanctions:

a) a warning in writing in cases of first and non-intentional non-compliance;
b) regular periodic data protection audits;
c) a fine up to 100 000 000 EUR or up to 5% of the annual worldwide turnover in case of an enterprise, whichever is greater.”

The mega-fine (which has certain tax avoiding, NSA data sharing, corporate USA companies in mind - no prizes for guessing) is mitigated if the controller or the processor is in possession of a valid "European Data Protection Seal”. There are a number of amendments to the Regulation that promote such Seals of approval (rather like a data protection kite-mark).

There is a definition of pseudonymous data: “Pseudonymous data' means personal data that cannot be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to ensure non-attribution”.

The important point of this definition is that 'pseudonymous data' is definitely personal data (i.e. subject to the rights especially the right to object to the processing). The intent is to mitigate some of the Regulation’s provisions and make the processing obligations less onerous.

Article 10(1), for instance, states that . “If the data processed by a controller … consist only of pseudonymous data, the controller shall not process or acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation”.

The next provision provides for an exemption that states that “Where the data controller is unable to comply with a provision of this Regulation” (because of A.10(1)), then the controller shall not be obliged to comply with that particular provision of this Regulation”.

Personally, I am not sure this works in the way the drafters intend; more of that perhaps in a later blog. I suspect it could be a very large exemption.

Sensitive personal data is extended to include what we have already in the UK Act and adds: philosophical beliefs, sexual orientation,  gender identity, trade-union activities, biometric data administrative sanctions, judgments and suspected offences.

However, data controllers will be pleased to know that sensitive personal data can be processed if “processing is necessary for the performance or execution of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”. In UK DPA terms there will be a general Schedule 3 condition covering "necessary for a contract".

There are new limits to data subject's consent:

• “Consent shall be purpose-limited and shall lose its validity when the purpose ceases to exist or as soon as the processing of personal data is no longer necessary for carrying out the purpose for which they were originally collected”.

• “The execution of a contract or the provision of a service shall not be made conditional on the consent to the processing of data that is not necessary for the execution of the contract or the provision of the service”.

• As well as the burden of proof that the data subject has consented; it shall also be “as easy to withdraw consent as to give it” and the “data subject shall be informed by the controller if withdrawal of consent may result in the termination of the services provided or of the relationship with the controller”.

There are several changes to the Principles as we know them in the UK. There is

• an obligation to ensure that personal data are “processed in a way that effectively allows the data subject to exercise his or her rights (effectiveness)”  (see this as a change to the UK 6th Principle);

• a reformulated Accountability Principle (a data controller “shall ensure and be able to demonstrate compliance with the provisions of this Regulation (accountability)” (The Council of Ministers dropped this).

The balance of interest grounds for the processing (e.g. in First Principle, Para 6, Schedule 2) from the data controller's perspective has an additional limitation: “the processing is necessary for the purposes of the legitimate interests pursued by a controller or … by the third party to whom the data is disclosed” where that interest has to “meet the reasonable expectations of the data subject based on his or her relationship with the controller….”.  Public authorities cannot justify processing in terms of this ground

The data subject’s fair processing essay (or notice) is extended to include additional items (take a deep breath): “information regarding the security of the processing of personal data, the existence or absence of an adequacy decision the existence; where applicable, information about the existence of profiling, of measures based on profiling, and the envisaged effects of profiling on the data subject; meaningful information about the logic involved in any automated processing; in particular the existence of certain processing activities and operations for which a personal data impact assessment has indicated that there may be a high risk; and where applicable, information whether personal data was provided to public authorities during the last consecutive 12-month period”.

There is also the introduction of a pre-fair processing notice. Data subjects should be able to access “standardised information policies” which describe “where personal data relating to a data subject are collected”. The controller has to provide the data subject with the following particulars:

“a) whether personal data are collected beyond the minimum necessary for each specific purpose of the processing;
b) whether personal data are retained beyond the minimum necessary for each specific purpose of the processing;
c) whether personal data are processed for purposes other than the purposes for which they were collected;
d) whether personal data are disseminated to commercial third parties;
e) whether personal data are sold or rented out;
f) whether personal data are retained in encrypted form”.

There is a Privacy by Design Principle.  “The controller shall ensure implement mechanisms for ensuring that, by default, only those personal data are processed which are necessary for each specific purpose of the processing and are especially not collected, or retained or disseminated beyond the minimum necessary for those purposes, both in terms of the amount of the data and the time of their storage. In particular, those mechanisms shall ensure that by default personal data are not made accessible to an indefinite number of individuals and that data subjects are able to control the distribution of their personal data”.

Security Principle includes mandated details about security policies. Such a “policy shall include:

(a) the ability to ensure that the integrity of the personal data is validated;
(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services processing personal data;
(c) the ability to restore the availability and access to data in a timely manner in the event of a physical or technical incident that impacts the availability, integrity and confidentiality of information systems and services;
(d) in the case of sensitive personal data processing … additional security measures to ensure situational awareness of risks and the ability to take preventive, corrective and mitigating action in near real time against vulnerabilities or incidents detected that could pose a risk to the data;
(e) a process for regularly testing, assessing and evaluating the effectiveness of security policies, procedures and plans put in place to ensure ongoing effectiveness.

Any personal data loss has to be reported to Regulator without “undue delay” but the “The supervisory authority shall keep a public register of the types of breaches notified”.

The Regulation includes the concept of “Lifecycle Data Protection Management”. For instance a Privacy Impact Assements extended and includes a risk assessment. The Regulation then states that: “The following processing operations are likely to present specific risks:

(a) processing of personal data relating to more than 5000 data subjects during any consecutive 12-month period;
(b) processing of special categories of personal data …(in the UK these data are sensitive personal data)… location data or data on children or employees in large scale filing systems;
(c) profiling on which measures are based that produce legal effects concerning the individual or similarly significantly affect the individual;
(d) processing of personal data for the provision of health care, epidemiological researches, or surveys of mental or infectious diseases, where the data are processed for taking measures or decisions regarding specific individuals on a large scale;
(e) automated monitoring of publicly accessible areas on a large scale;
(f) other processing operations for which the consultation of the data protection officer or supervisory authority is required pursuant to point (b) of Article 34(2);
(g) where a personal data breach would likely adversely affect the protection of the personal data, the privacy, the rights or the legitimate interests of the data subject;
(h) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects;
(i) where personal data are made accessible to a number of persons which cannot reasonably be expected to be limited.

Most data controller will have to have a designated Data Protection Officer (e.g. where "the processing is carried out by a legal person and relates to more than 5000 data subjects in any consecutive 12-month period") . This mandatory DPO provision was dropped by the Council of Ministers in their textual discussions.

Exemptions are much reduced (almost to those in Article 12 of Directive 95/46/EC) whereas the Council of Ministers have widened them. However, the domestic purpose exemption is amended so that it applies to the “publication of personal data where it can be reasonably expected that it will be only accessed by a limited number of persons” (e.g. to accommodate users of social media).

The "right to forget" is forgot; instead there is an extended right of erasure which considers freedom of speech issues.

With respect to consistency and the European Commission’s powers, it appears that the following has happened.

• The European Data Protection Board determines the data protection standards
• Member States can have flexibility to modify certain provisions in accordance with national culture, traditions, culture etc
• European Commission’s role looks as if it is limited to when a Member State misuses that flexibility

Hope you find this useful. If you think I have missed something important, can you post a comment.

References:

This is being discussed at UPDATE (next Monday) and our Data Protection Regulation half day (for details; follow the links bottom left of side panel). Places still available (and to the launch of Amberhawk Associates).

European Parliament amendments leak: http://www.edri.org/eudatap-leak

Recent blogs on the Regulation

http://amberhawk.typepad.com/amberhawk/2013/06/irish-data-protection-regulation-text-gives-google-and-facebook-the-upper-hand.html

http://amberhawk.typepad.com/amberhawk/2013/06/member-states-divide-over-the-protection-offered-by-the-irish-version-of-the-data-protection-regulat.html

http://amberhawk.typepad.com/amberhawk/2013/06/irish-do-hatchet-job-on-the-data-protection-regulation.html

http://amberhawk.typepad.com/amberhawk/2013/08/exemptions-in-the-irish-draft-of-the-data-protection-regulation-guarantees-disharmony-and-permits-me.html

 

Select Committee criticises ICO's approach to Millipede; prospects for successful enforcement are poor.

In my previous blog on Operation Millipede, I said that October 8th would be an interesting day; and so it turned out. The Home Affairs Select Committee is not convinced that the Information Commissioner (ICO) is going about his investigation in the right way and MPs on the Committee made their objections abundantly clear.

To some extent, I agree with the Committee’s assessment and I explain why in the blog. Contrary to the ICO’s assertions before the Committee, I think a Monetary Penalty Notice (MPN) is unlikely to be available and any prosecution of the S.55 offences in the Magistrates Court is not going to be easy  given the time delays of some years.

I have split the blog into two; a factual commentary on the evidence presented to the Committee and a commentary about the criticisms arising from the evidence session. I should add that the evidence session was often a mixture of testy confrontation and polite sarcasm. This was because the Commissioner often did not answer the question that had been asked; I suspect one reason for this is that the ICO’s numbers given to the Committee did not add up (see below).

Factual commentary from the evidence session

Operation Millipede is the name coined by the Serious Organised Crime Agency (SOCA) for one of its investigations that involved blagging by private investigators (PIs). SOCA, now subsumed into the National Crime Agency (NCA) launched earlier this month, sent details of 102 clients to the ICO in 31 large folders of evidence.

However for some unknown reason, SOCA delayed sending the folders to the ICO for 18 months and quite clearly, the Committee wants to know “Why?”. One MP on the Committee suspected the delay was because the PIs involved included ex-police officers who were being protected. The Commissioner, by contrast, thinks that this delay was because SOCA did not see the matter as a priority (i.e. the DPA offences were not a “serious crime” falling within the remit of SOCA).

The Committee were told by the Commissioner that there were actually 98 clients who used the PIs in SOCA’s files and 125 target data subject victims (many of which do not know they have been under surveillance). Of these 98 clients:

•  8 already arose in the Millipede prosecutions, so no further action is being taken;
• 12 were be classified as inactive in that there is evidence that these businesses are no longer trading;
• 11 clients presented insufficient information; these 11 could be regarded active if new information comes to light. Six of these are based in the UK, four are out of the UK and the location of the remaining client is unknown;
• 67 clients were active from evidence at Companies House, public registers or from active websites and private individuals who instructed PIs were traceable.

So far so good; the numbers add up to 98.

However, then the maths gets “murky” to say the least. Of the 67 (i.e. the ones the ICO could target), 24 are located outside the jurisdiction (but the ICO promised to pursue these with the help of overseas regulators; there appears to be 8 other jurisdictions – but this is not confirmed in the oral exchanges).

It appears that 19 clients of errant PIs are being closely targeted for possible prosecution or enforcement. Of these 19, four are law-firms, five are in general retail, three are in insurance and two are financial services. Of the rest, four are Private Investigators, one is in the security industry and one is in construction.

This leaves 24 other clients. Three times the Commissioner was asked about these other 24; all I can say that nobody was the wiser following his answers. At one stage, a confused Keith Vaz, chair of the Committee, said that from the ICO’s evidence that he now counted 71 cases but then his “maths was not the best”.

The ICO also stated that if a conspiracy can be proved, he will prosecute at the Crown Court so that an unlimited fine can be levied and press for recovery of proceeds of crime. He will also pass files to other regulators (e.g. the Solicitor’s Regulatory Authority or in financial services).

At the Committee hearing, the ICO impassionedly called for the commencement of the custodial S.55 offence and asked for the Commitee's MPs to take Parliamentary steps to “rescue the S.55 offence from Leveson”; these steps should require the Government to explain properly why it could not start the custodial element of the offence. Surely, he added, that the S.55 offence was not being commenced “for fear of the Daily Mail”.

I should add that Government excuses about S.55 are complete balderdash as it has already partially commenced an offence in data protection. As you probably know, the practice of enforced subject access should be a criminal offence by virtue of section 56 of the DPA. There was partial commencement of section 56 of the Data Protection Act 1998 in the sexily entitled “The Data Protection Act 1998 (Commencement No. 3) Order 2011”.

I thus see no logical reason why the custodial element of the S.55 offence cannot be partially commenced to exclude Leveson complications.

Criticisms from the evidence session

The Commissioner was wrong to assert to MPs that a Monetary Penalty Notice (MPN) would be in his armoury. His written evidence states that the material he obtained from SOCA “relates to the period 2001 to 2009”. As the MPN regime was commenced in 2010, then a MPN is not available (and this was determined by the Tribunal with the Scottish Borders case where the Tribunal considered it was fair only to consider the contraventions from the date of the commencement of the MPN provisions on 6 April 2010).

The Commissioner also referred to the S.55 prosecution being available; the problem being that most Magistrate Court prosecutions have to be taken within 6 months of the offence.  FOI aficionados, for instance, will recognise this problem as the ICO cannot prosecute the S.77 FOIA offence because of the time delay (see references).

Even if the ICO can pursue a prosecution in the Magistrates Court, I can see many arguments on the grounds that it is wrong to pursue trivial offences after years of delay when the offence is not reportable and does not even involve the taking of a DNA sample (such as S.55 as currently constituted).

It is also clear that the Home Affairs Committee does not like the ICO asking the National Crime Agency (NCA) for help.

The Commissioner’s position is that he needs upto £200k to do the investigation properly and needs seven or eight experienced investigators. It appears from the oral evidence session that the NCA could second these investigators to the ICO, thus reducing the ICO’s investigation costs to £50K. He told the Committee that he could not afford £200K and could not see a problem in using NCA staff.

By contrast, the Committee see lots of problems and used words such as “baffled” or “compromising your investigation”. The problem from its perspective is that the NCA officers seconded to the ICO could easily be the SOCA officers who delayed giving the ICO the files of evidence. The Committee wants the ICO to investigate independently of the NCA; Keith Vaz said that the ICO should not have to “borrow pencils and rubbers” from the NCA.

Finally, the Commissioner did not quite understand other Committee’s concerns about his investigation. All of the offences committed by PIs were for unlawful interception of communications (e.g. offence under RIPA) or misuse of computers; the clients of these PIs have not been questioned at all.

The Committee has recognised that the DPA offence can be committed by the clients of these PIs through the instructions given to them. So when one MP asked the ICO whether he would consider other police investigations similar to Millipede where clients instructed PIs to obtain personal data by deception, the ICO dismissed the suggestion and said he was not “touting for extra work”.

From the Committee’s perspective, similar S.55 crimes possibly committed by important organisations with household names, are not even being looked at from an evidential perspective. This won’t go down well, I suspect.

I also think the Select Committee are looking to publish the list of 98 names of clients minus the 19 the ICO is considering; Parliamentary privilege should avoid libel issues. Publication of these (possibly plus 19) could follow in three months time when the ICO gives a "progress report" on the prosecution.

I think such publicity could even help the ICO. You never know; ex members of staff and whistle-blowers might come forward with the further evidence he needs.

References:

The evidence session (30 mins) is well worth a watch: http://www.parliamentlive.tv/Main/Player.aspx?meetingId=13853

Original Blog on Operation Millepede: http://amberhawk.typepad.com/amberhawk/2013/09/october-8th-is-this-the-date-when-operation-millipede-reveals-the-extent-of-unlawful-processing-by-some-prestigious-or.html

The problem with the S.77 offence in FOIA (see http://www.cfoi.org.uk/fois77offence290110.html which the Government says it will correct

I will be discussing Millipede at our UPDATE session (http://www.amberhawk.com/bookevents.asp)

Cartoon: Keep up to date on Data Protection

This brief blog  is to alert you to our UPDATE day in London 

(Monday, October 28th) where I think I have compiled a very

interesting program – in fact the best so far. Speakers include

Tim Pitt-Payne QC on Monetary Penalty Notices, Rosemary

Jay on latest legal cases, Martin Hoskins on Privacy Impact

Assessments, Nick Pickles from BigBrotherWatch on “Big Data”,

and a speaker from the Law Commission on its data sharing 

consultation. The cost of the day session is £225+VAT 

(details on http://www.amberhawk.com/bookevents.asp).

At the end of the day, UPDATE delegates are invited to stay

for a short reception to launch Amberhawk Associates; our new

consultancy arm. Amberhawk Associates are a group of well

known, experienced information law practitioners who have

decided to pool their diverse skills.