Hawktalk

European Commission raises infraction threat to UK on failing to implement Directive 95/46/EC properly via the Data Protection Act

All through the New Labour Surveillance decade (and through to the current Snowdon revelations), Parliament and public have been deliberately kept in the dark as to why the UK’s Data Protection Act (DPA) is not a proper implementation of Directive 95/45/EC. What is wrong with this implementation? It’s an official secret.

However, the MoJ have just told me (see references) that the deficiencies are apparently so great that the European Commission is still thinking of infraction proceedings.

The above, of course, relates to my “Groundhog Day” FOI request to get published details about the deficiencies in the UK’s DPA: my request is grinding slowly on its fourth iteration.

Quite simply, I think the public should know why, since 2004 (the date of the Durant judgment – see references), every Ministerial pronouncement in Parliament about the DPA, and every subsequent Governmental White Paper paragraph that has referred to the DPA, has not contained an important qualification:

“….but the European Commission is of the view that the UK’s DPA is deficient implementation of Directive 95/46/EC”.

My latest FOI request has again been refused because “disclosure would or would be likely to prejudice relations between the UK and an international organisation” (see references). Forget about the prejudice to UK–EU relations that arise from the Conservative led Coalition Government’s derogatory statements about the European Union (e.g. Mr Cameron's reaction to today’s £1.7 billion payment request from the Commission). You must understand that my FOI request about data protection is far more prejudicial!

My latest FOI refusal states that the MoJ contacted the Commission in February and March 2013, again in January 2014 and then, more recently, at the end of September/beginning of October 2014. I was then told:

“On each occasion, the Commission confirmed that the proceedings remain live, that the particular information remains under consideration and therefore should not be released at this time. In their most recent communication, the Commission reiterated the position that the requested documents concern an ongoing infraction procedure against the United Kingdom, and that the correspondence requested (by my FOI request) are part of the investigation and inspection procedure performed by the Commission, and essential documents upon which the Commission will base its final decision on how to proceed…”.

“The Commission has been clear in each of its separate responses (in February 2013, January 2014 and October 2014) to the Ministry of Justice that infraction proceedings in relation to the UK remains a live issue, and subject to ongoing review and consideration…”.

“The Commission has indicated that a decision is going to be taken in relation to the infraction proceedings which will in part be based on the information that you have requested. The proceedings therefore are actively under consideration by the Commission…”.

So there you have it. Believe it or not, infraction proceedings based on information which is nearly a decade old appears to be on the cards.

The MoJ then considered that the public interest arguments are such that 60 million UK data subjects, 400,000 data controllers and the Welsh, Scottish, Northern Irish and Westminster Parliaments should not be informed about the data protection problems that might give rise to infraction proceedings.

Why the public interest is served by publishing these details

If the European Commission has determined that the UK’s Data Protection Act is not a proper implementation of Directive 95/46/EC (see above) then if the UK were to vote to leave the EU following a referendum then it follows that the UK would become a country outside the EEA offering an inadequate level of protection. Transfers of personal data to the UK could be thus prohibited.

It is my view that the public interest is served if any debate about an in-out referendum (e.g. as part of the forthcoming General Election), should take place in full knowledge of the potentially severe economic consequences if such a transfer prohibition were to arise. [In fact all internationally based businesses, especially in the City of London, should assess this risk].

At the Heads of EU States summit meeting in October 2013, Mr. Cameron had a list of European Commission “red-tape” legislation to stop; top of his list was the Data Protection Regulation. It is likely Mr Cameron, if he is re-elected, will have a list the proposals and it is reasonable to assume this list is also likely to contain the Data Protection Regulation. This means that the deficient UK’s DPA could remain as part of any re-negotiated settlement.

It is therefore in the public interest for the public to know that any re-negotiation objectives, which will form part of the next General Election debate, also involves knowledge about the deficiencies in the UK’s DPA.

The Conservative part of the Government also wants to replace the Human Rights Act; this step is likely to peturb the UK’s implementation of the Article 8 right. However, the Article 8 right relates to Council of Europe Convention No 108, thence to the Data Protection Directive 95/46/EC and through into that the UK’s DPA (e.g. the use of the word “necessary” in Schedule 2 for instance or in the 5th DP Principle).

Any forthcoming General Election, any debate about abolishing Article 8 of the HRA should involve the fact the UK Article 8 right might have already been diminished in the UK by the improper implementation of Directive 95/46/EC.

In addition, the public interest would be served as publishing as the information would:

• inform public debate in relation to Ministerial claims that personal data are protected by the DPA when in fact these claims might be misleading as to matters of fact;

• aid the public in understanding the European Commission’s constructive role in protecting the privacy of UK citizens as part of the referendum political debate; and

• encourage informed debate in relation to the proposed Data Protection Regulation and produce greater transparency around infraction proceedings.

Concluding comment

In fact, I think I have already identified the problems in the Data Protection Act (see references) and they are minor, especially since Durant has been reversed. The fact the Information Commissioner has not raised any problem about the UK’s implementation of the Directive 95/46/EC serves to reinforce my view. So, if the diversions are minor, then there is no prejudice to infraction proceedings and the exemption above should fall away.

That is why I think my refusal has little to do with the quality of the Data Protection Act which might have problems at the margin; something else is going on.

If my letter is to be believed the latest infraction threats have been heightened because the European Commission is:

• building a negotiating/legal position with respect to data protection should the UK leave the EU. It could be that the Commission will try to get the UK to adopt the final Regulation in order for it to be deemed to possess an adequate level of protection for countries outside the EEA.

• supporting or colluding with the UK Government because the Commission does not want details of any other infraction proceedings to be published. My FOI request, if successful, might be seen as the first breach of a policy hitherto does not allow the detailed of infraction proceedings to be published or debated in any Parliament in Europe unless the Member State or Commission want them to be debated or published.

Either way, these two reasons increase public interest in knowing the full details of these infraction proceedings.

References:

Durant and Edem: “Roll out the bunting: Durant judgment is good as dead and buried”: http://amberhawk.typepad.com/amberhawk/2014/02/roll-out-the-bunting-durant-judgment-is-good-as-dead-and-buried.html  (link to cases at end of blog)

List of UK deficiencies in:  “Why does the European Commission think the UK’s Data Protection Act is a deficient implementation of Directive 95/46/EC?” http://amberhawk.typepad.com/amberhawk/2013/02/question-answered-why-does-the-european-commission-think-the-uks-data-protection-act-is-a-deficient-implementation-of.html  (note the big one re Durant has gone)

Download the details of the infraction proceedings here: Download Blog MoJ FOI refusal Oct 2014

National security agencies should be subject to Data Protection law.

Yesterday, the Intelligence and Security Committee held a round-table on privacy and national security; in particular in relation to the Snowdon revelations and possible changes to the law.

So this is a good excuse to publish my written evidence to the Committee. It is on the lines that the Data Protection Act should apply to the processing of personal data by the national security agencies.

Historically the national security function was made exempt from the Data Protection Act 1984 probably because this legislation predated the Interception of Communications Act 1985 (which was imposed on the UK following a defeat at the European Court of Human Rights) or any consideration of any independent regulation of the national security function. This comprehensive exemption was carried over into the 1998 Act.

The national security agencies are concerned about oversight, because that oversight with access to documents and projects might, in itself, be a risk to national security. However, there is no need to designate the Information Commissioner as a national security regulator with respect to the processing of personal data.

For instance, disputes with respect to the application of the Principles can be tested by the National Security Tribunal which could hear complaints of substance; the Investigation of Regulatory Powers Tribunal could then assume the role of the Upper Tribunal and adjudicate on points of law. Any audit of compliance (like procedures with respect to warrants) could fall within the remit of the Surveillance Commissioner or the Interception of Communications Commissioner (as required).

I have also taken the opportunity to ask the Committee to investigate that the current set of Certificates which exempt the application of the Data Protection Act as they are sending the wrong message to the public (see blog on these Certificates and for a copy of those Certificates; see references).

For instance, in relation to the exemption from First Principle in these Certificates, it can be seen that only part of the exemption can be justified. For instance, the exemption from the need to provide a fair processing notice (giving a notice would be an act of “tipping off”) and from “lawful” processing (e.g. obtaining personal data in breach of an obligation of confidence) can be justified.

However, the exemption from Schedule 2 and 3 requirements are difficult to see as being justified. For instance, any public body can process personal data which are “necessary” for its statutory functions which, in this case, is “necessary for the national security functions”. It follows that an exemption from this obligation sends the message that the national security agencies might want the flexibility to process personal data that are “not necessary” for these functions.

There is a similar “message to the public” with the exemption from the Second Principle. This Principle requires data controllers to obtain the personal data “lawfully” and not further process (i.e. use or disclose) these data for a purpose incompatible with the national security function. It follows that an exemption from this Principle implants the notion in the public that the national security agencies might want to process personal data for purposes that are incompatible with their national security function.

Likewise with the message derived from the exemption to the Eighth Principle. This Principle requires a data controller to perform a risk assessment on the adequacy of protection, prior to the transfer of personal data outside the European Economic Area (EEA), or apply an exemption from the need to assess adequacy (see Schedule 4).

If these national security agencies were to make any transfer of personal data outside the EEA for a national security purpose, then such a transfer would normally be for a national security purpose and in the “substantial public interest” (and therefore qualify from an exemption to assess adequacy). It follows that message sent to the public is that the national security agencies require an ability to transfer personal data outside the EEA for purposes that possess little in the way of “substantial public interest”.

In my view, it would reassure the public if these agencies had, by law, to commit to the following obligations:

• Process personal data lawfully and ensure that any processing is necessary for their statutory functions.

• Ensure that personal data are processed in a way that is not incompatible with the national security purpose.

• Ensure that all personal data are adequate, relevant and not excessive in relation to the national security purpose.

• Ensure that personal data are kept no longer than necessary for the national security purpose.

• Ensure that personal data are kept secure

• Ensure that personal data are not to be transferred outside the EEA to a country that offers an inadequate level of protection unless there is a substantial public interest in any transfer.

One should add that these data protection principles have passed the test of time for 30 years or so. For instance, if the police and all their sensitive criminal intelligence collections can co-exist with these data protection principles for nearly three decades (since the 1984 Act).

I cannot see why metadata and personal data held by the national security agencies are any different.

References

Download my evidence here: Download Blog_Evidence to ISC

You can read several National Security Exemption Certificates (Section 29 of the Data Protection Act) at the end of the blog: http://amberhawk.typepad.com/amberhawk/2014/02/should-national-security-certificates-exclude-the-data-protection-principles.html

Push for new data sharing powers as Law Commission’s data sharing report is shelved

I suspect the Government is going to ditch the Law Commission recommendations on data sharing; this is because it wants a quick implementation of its own extensive data sharing proposals. In short, general data sharing powers are now on the political agenda again.

This is the third time in a decade that Government has tried to obtain data sharing powers that apply in circumstances unconnected with the usual suspects (e.g. data sharing in relation to crime, national security and law enforcement).

The Government tried in 2006 with the Identity Card Act to permit general public sector access to the Identity Card database in order to help deliver efficient and effective public services. This was followed with wide data sharing powers in the Coroners and Justice Bill in 2008; after considerable opposition in the House of Lords, these were replaced by the data sharing code of practice provisions (which we all love). Third time round has happened with these proposals.

The Government has learned that it needs to engage with its opponents. So for the last year, the Cabinet Office has been holding a number of public meetings with the objective of “exploring whether some of the barriers to sharing and linking different datasets in government can be removed in order to develop a better understanding of the economy and society, deliver more targeted and joined-up public services, and save public money lost through fraud, error and debt”.

In many cases, the Government insists that any data sharing occurs with the consent of the data subject.  However, the documentation (28th July 2014; see references) also indicate that consent is not the only way for data sharing to occur.

This document states that the Government intend to take a general data sharing power which “…is intended to be used in situations where….”:

• “The objective could not be met without data sharing”
• “It is not realistic and practicable to use consent to achieve the intended outcome or use of consent would not meet the criteria of free and informed decision”, or
• "Analysis of anonymised data would not achieve the intended outcome”.

Although this is a discussion document, I think the chosen wording gives rise to several concerns. For instance, the data sharing power has not been described in terms such as being "necessary" in association with a pressing social need that has been identified. And what does “not realistic” mean in practice? Could these powers be used when so many data subjects refuse consent to the data sharing, that it would then become “realistic” to override these refusals?

In addition, who decides when it “is not realistic” to rely on data subject consent or what are the circumstances when anonymous analysis “would not achieve the intended outcome” (Does this extend to data sharing of health and social work records for instance?). As with the two previous data sharing initiatives the devil is in the detail.

It is no good, as the document does, in providing examples of “beneficial” data sharing. The problem is that when powers are enacted, they can be used into the future. As with the adage “puppies are not only for Xmas”, once these powers are available, they can be used indefinitely until repealed.

To be fair to the document, it does identify the problems when “very broad powers” are used but proffers no solution to this (unlike this blog – see below).

Are these safeguards?

The 28th July documentation claims says that the privacy safeguards against excessive data sharing include: "The Data Protection Act 1998; Law of Confidentiality;  Article 8 of the European Convention on Human Rights and EU legislation on data sharing". I will now show when these legal safeguards are unlikely to apply.

For instance, with respect to the common law of confidence, it is well known that one can always set aside a confidentiality obligation if there is a statutory requirement to disclose such confidential personal data.  So as soon as Ministers exercise their data sharing powers to demand disclosure: “good bye” common law of confidence.

It is also well known that the Human Rights Act is under threat of abolition by the Conservative Ministers who are currently driving the data sharing agenda. So if a Conservative Government is returned after the next Election, we don’t know the nature of the A.8 replacement. As for Europe – we might leave following an in-out referendum! In both cases, the safeguards on offer are uncertain.

With respect to Data Protection Act (DPA), I have often argued that once statutory powers are applied to a disclosure, then the disclosure is almost invariably “lawful” and the disclosure itself can be subject to the exemption from the non-disclosure provisions (S.35(1)). This exemption can exclude several data protection principles (Fairness, Second to Fifth Principles) and the rights that could block disclosure.

The Third Principle can be neutered if broad purposes are defined in data sharing legislation. For example, if a controller says "personal data item X is relevant to a housing benefit purpose", the claim can objectively be tested: “is the data item relevant or not relevant to the housing benefit purpose?”.

However, this test is substantially diminished if the purpose is broadly defined as in "the purpose of the efficient delivery of public services"; it can be seen that many items of personal data could satisfy this requirement.

In summary, when a purpose is narrowly defined, the more precise the relevance test of the Third Principle becomes, and the more protection there is from the DPA. The converse is also true; the broader the purpose description, the less precise is the relevance test and the poorer the protection afforded by the DPA. The same argument applies to the retention criteria of the Fifth Principle as it, like the Third, the level of protection is linked to "the purpose" of the processing.

In summary, there will be not much data protection on offer when statutory data sharing powers are exercised.

Missing safeguards

Some of these are listed below; they are very easy to identify if, unlike the document, one asks the simple question “what could go wrong?”.

Whenever data subject consent is impracticable, then there has to be a right for any data subject to object to any further data sharing, at any time, without providing a reason. In fact, transparency arrangements should offer an “opt-out”. Exceptions to this right to object can be catered for as they can easily be identified (e.g. to permit data sharing in relation to fraud).

At the moment, there is no right to object that would apply to non-consensual data sharing and it is important to understand that the current right to object to the processing  under the DPA (S.10) won’t apply.

As soon as statutory powers for data sharing are exercised any data sharing required by law would be legitimate in terms of paragraph 3 of Schedule 2, whereas the current "right to object" in the DPA only applies when paragraph 5 and 6 applies to the data sharing.  In addition, the data subject has to show that data sharing would cause or likely to cause “unwarranted” and “substantial” damage or distress; this is a high barrier to the exercise of this right.

The second safeguard, I suspect, is needed when personal data are used for data matching and/or profiling; the Information Commissioner should be tasked to produce a statutory code of practice if data sharing involves these two.

Thirdly, there needs to be a counter-balance to the exercise of Ministerial powers by Statutory Instrument (SI)  as Parliament hardly ever rejects the use of powers granted to Ministers (even when the SI is subject to debate in a Select Committee). The Information Commissioner should be given the explicit right to apply to a Court on the grounds that the processing of personal data is disproportionate in terms of Article 8 of the Human Rights Act. This raises the prospect of the power being declared unlawful and the SI being struck out.

In other words, there needs to be an easy-to-use, free of charge, mechanism whereby data subjects could gain access to the Courts in order to test the lawful basis of the data sharing; allowing the Commissioner to enforce unlawful processing in terms of Article 8 is one example of such a mechanism.

The documentation is silent on the issue of redress for a data subject who has been damaged by non-consensual disclosures; one suspects that the aggrieved data subject is supposed to take a compensation claim through the Courts. This redress thus only applies in the most damaging of circumstances.

You could easily have the Information Commissioner (or some Ombudsman) recommending compensation if there is detriment to the data subject caused by the data sharing. This could, for example, arise if a data subject is denied a benefit on the grounds of sharing inaccurate personal data.

Sadly, there is currently no indication that data sharing, once commenced, will cease. For instance, in my view, if data sharing powers are used in non-law enforcement circumstances, there must be a document which explains the benefits achieved by data sharing in quantifiable terms. By implication, if the stated objectives are not realised, then data sharing should cease.

Instead the document suggests periodic reviews so that improvements can be identified (i.e. so that data sharing continue), or the existence of oversight by Parliamentary Committees that can make recommendations. Both these are window-dressing as once powers are enacted, data sharing continues and recommendations are just that (something that can be ignored).

Another way of achieving this cessation of processing objective is to have a “sunset” clause on each data sharing initiative. This would require data sharing powers to be renewed under an independent process,  and enables an effective cost-benefit analysis on the basis of past performance, before data sharing powers are renewed.

As I said, these simple protections are missing and I have yet to identify any effective privacy protection to prevent excessive data sharing or redress if data sharing goes pear shaped.

Concluding comments

The Government’s timetable is tight. A White Paper is expected by Christmas and a period of public consultation ending in March. This means that there will be a Civil Service briefing pre-prepared for an incoming government after the next General Election. Such a timetable excludes the considered approach suggested by the Law Commission.

With all political parties promising considerable deficit reduction targets (albeit different ones),  then one suspects that all the Civil Servants need do is to hint at unquantifiable but huge savings that arise from wide data sharing (just as they did on 2006 and 2008). It is therefore more likely that these proposals will be implemented; for the Government, I suspect, it is a case of third time lucky.

Just to be clear. I am not against data sharing; I am against data sharing that leaves the data subject exposed with no easy means of redress.

References

Data sharing paper from Cabinet Office (dated 28th July 2014) on https://docs.google.com/document/d/1g6kpiRUpgECnR2IXCuP0O1_VmuMMBgbD-oCmQI4wHVE/edit?usp=sharing

Law Commission on Data sharing: http://lawcommission.justice.gov.uk/areas/data-sharing.htm

Meeting with Francis Maud: http://datasharing.org.uk/2014/10/06/plenary-workshop-with-francis-maude-22-oct-2014-meeting-invitation/