Hawktalk

Tripartite version of the Data Protection Regulation leaked

Statewatch, bless them, have liberated 630 pages of the four column Data Protection General Regulation text that lists the Commission’s original text, the European Parliament’s changes, the Council of Ministers' version and a fourth column for the compromise that will be imposed on us all.

Assuming agreement by the Council of Ministers in June, it is this 4 column version that goes into forthcoming the secret tripartite negotiations; a practice which is coming under scrutiny by the European Ombudsman. Perhaps the Ombudsman can use this set of negotiations see how secret these important tripartite negotiations really should be.

Obviously I can’t do an analysis of 630 pages here, but I will be doing one for our UPDATE session on May 11^th in London.

References:

Details of the UPDATE session (£225 - to be re timetabled to have a longer session on this document): http://www.amberhawk.com/bookevents.asp

Details of the 630 pages: Download Eu-council-dp-reg-4column-2015_April

“Ombudsman to probe EU's secret law-making” (on tripartite negotiations): https://euobserver.com/news/128428 

Party promises on Data Protection, FOI, Digital rights, Human Rights, Leveson and mass surveillance

At great risk to my mental health, I have extracted the relevant parts of the Party Manifestos.  Here they are without comment. URLs for each manifesto is at the end; address of my psychiatrist available on request. 

CONSERVATIVE

There is no explicit mention of data protection, freedom of information or privacy.

“The next Conservative Government will scrap the Human Rights Act, and introduce a British Bill of Rights. This will break the formal link between British courts and the European Court of Human Rights, and make our own Supreme Court the ultimate arbiter of human rights matters in the UK”.

The Leveson report noted and no further implementation but “Because the work of the free press is so important we will offer explicit protection for the role of journalists via the British Bill of Rights and we will ban the police from accessing journalists’ phone records to identify whistle-blowers and other sources without prior judicial approval.”

National security : “We will keep up to date the ability of the police and security services to access communications data – the ‘who, where, when and how’ of a communication, but not its content. Our new communications data legislation will strengthen our ability to disrupt terrorist plots, criminal networks and organised child grooming gangs, even as technology develops. We will maintain the ability of the authorities to intercept the content of suspects’ communications, while continuing to strengthen oversight of the use of these powers”.

“We will ensure digital assistance is always available for those who are not online, while rolling out cross-government technology platforms to cut costs and improve productivity – such as GOV.UK”. Labour and Lib Dems say something similar: As the main parties support GOV.UK (come to our Update session on 11th May as its very important for both public and private sectors) I will not say anything further on the topic. 

LABOUR

There is no explicit mention of data protection.

“Thanks to the Human Rights Act, some of our most vulnerable citizens, including disabled people and victims of crime, have been given a powerful means of redress. The Conservatives want to leave the European Convention of Human Rights, and abolish the Human Rights Act. A Labour Government will stand up for citizens’ individual rights, protecting the Human Rights Act and reforming, rather than walking away from, the European Court of Human Rights. And we will make sure that access to legal representation, a cornerstone of our democracy, is not determined by personal wealth, but remains available to those that need it.

“We will further develop digital government to enable better communication, more collaboration, and sharing of data between services”.

“Our Freedom of Information laws have shone a light into the darker corners of government and are a crucial check on the power of the Executive. We will extend their scope so that public services run by large private companies are included”.

“We remain strongly committed to the implementation of the recommendations of the Leveson Inquiry. We expect the industry to establish a mechanism for independent self-regulation, which delivers proper redress for individuals, as set out in the Royal Charter, and agreed by all parties in Parliament. We made a promise to victims of the phone hacking scandal. We stand by that promise and will keep it”. 

“With Labour, the security services will have the powers they need to disrupt and tackle terrorism. …. We will need to update our investigative laws to keep up with changing technology, strengthening both the powers available, and the safeguards that protect people’s privacy. This is why Labour argued for an independent review, currently being undertaken by David Anderson. We will strengthen the oversight of our intelligence agencies to make sure the public can continue to have confidence in the vital work that they do to keep us safe.”

LIB DEMS

“Require the highest standards of data protection by public service providers, including requiring that where data is used for research purposes it must be anonymised wherever possible, and impose a moratorium on the creation of new government databases without Parliamentary authority”.

“Introduce, after consultation on the detail, the changes to the 1998 Data Protection Act recommended by Lord Justice Leveson to provide a fairer balance between personal privacy and the requirements of journalism, ensuring that the position of investigative journalists is safeguarded”

“Give increased powers and resources for the Information Commissioner and introduce custodial sentences for egregious breaches of the Data Protection Act".

" Ensure privacy is protected to the same extent in telecoms and online as in the offline world".

"Public authorities should only invade an individual’s privacy where there is reasonable suspicion of criminal activity or where it is otherwise necessary and proportionate to do so in the public interest, and with appropriate oversight by the courts.”

“The Human Rights Act will remain, with children’s rights protected in law too. The culture of everyday sexism will be declining, with young people taught in school about respect in relationships and sexual consent. Online, people will no longer be worried that the government is monitoring their every keystroke: a Digital Bill of Rights will have enshrined enduring principles of privacy and helped keep the internet open”

“Protect the Human Rights Act and enshrine the UN Convention on the Rights of the Child in UK law. We will take appropriate action to comply with decisions of UK courts and the European Court of Human Rights”

“Pass a new Freedoms Act, to protect citizens from excessive state powers.”

“Extend Freedom of Information laws to cover private companies delivering public services.”

“Oppose the introduction of the so-called Snooper’s Charter. We blocked the draft Communications Data Bill and would do so again. Requiring companies to store a record of everyone’s internet activities for a year or to collect third party communications data for non-business purposes is disproportionate and unacceptable, as is the blanket surveillance of our paper post”.

“We will:

Ensure proper oversight of the security services.

Establish in legislation that the police and intelligence agencies should not obtain data on UK residents from foreign governments that it would not be legal to obtain in the UK under UK law.”

The Lib Dems will introduce a Digital Bill of Rights.

UKIP

No mention of data protection, Freedom of Information or Leveson.

“We will repeal the Human Rights Act and replace it with a new British Bill of Rights. The interests of law-abiding citizens & victims will always take precedence over those of criminals”.

With respect to “Human Rights Legislation” we will be…“Putting responsibility for law and order back into the hands of Parliament is key to UKIP’s approach to law and order, justice and internal security across the British Isles.

We will remove ourselves from the jurisdiction of the European Court of Human Rights: the Strasbourg Court whose interpretation of the European Convention of Human Rights has been known to put the rights of criminals above those of victims.

Our own Supreme Court will act as the final authority on matters of Human Rights. We will also repeal Labour’s Human Rights legislation. It has given European judges far too much power over British law making and law enforcement and prevented us deporting terrorists and career criminals and from implementing whole-life sentences.”

Our human rights will be enshrined in law via the introduction of a new, consolidated UK Bill of Rights. This will complement the UN Declaration of Human Rights and encapsulate all the human and civil rights that UK citizens have acquired under UK law since Magna Carta. This new UK Bill of Rights will apply across England, Wales, Scotland and Northern Ireland."

GREENS

“We live in the information age and we know that information is power. But how should information be controlled? What information should be available, and to whom?  The Green Party supports a world of open, freely flowing information. We don’t want disproportionate or unaccountable surveillance or censorship. We want a transparent state, but we want control over the data that our digital lives create. “

"Support the recommendations of the Leveson Inquiry into press ethics and for the cross-party Royal Charter. But if this is not supported by all the major newspapers we will support legislation to implement the Leveson system of independent press self regulation".

"We would consider combining elements of the policies below into a comprehensive Digital Bill of Rights."

"We will support and protect Internet freedom.

Follow human rights judgments limiting surveillance and data retention in full.

Support the EU’s proposals to strengthen data protection laws against opposition from large US data-driven companies."

"Oppose any case for secret unaccountable mass surveillance of the type exposed by Edward Snowden. We do accept that government law enforcement agencies may occasionally need to intercept communications in specific circumstances. Such specific surveillance should be proportionate, necessary, effective and within the rule of law, with independent judicial approval and genuine parliamentary oversight".

"Replace the Regulation of Investigatory Powers Act 2000, which has failed:

to regulate the deployment of undercover police;

to support the confidentiality of journalistic sources;

to support legal confidentiality; and

to enshrine an open and effective right of redress".

SNP

Protecting personal data:  "We do not support Tory plans for the reintroduction of the so-called ‘snoopers’ charter’, which would see all online activity of every person in the UK stored for a year. Instead, we need a proportionate response to extremism. That is why we will support targeted, and properly overseen, measures to identify suspected extremists and, if necessary, examine their online activity and communications".

Human Rights: "Given the central place of human rights in Scotland’s constitutional settlement, and their importance at the heart of our politics, we will oppose scrapping the Human Rights Act or withdrawal from the European Convention on Human Rights".

Leveson: The Scottish Parliament chose, on a cross party basis, to support the UK Government’s actions to implement Leveson. We will consider carefully the results of the first year review and work with other parties, in Scotland and at Westminster, to ensure effective regulation of the media on a non-political basis.

Nothing on Freedom of Information; this might be because FOI in Scotland (FOISA) is a devolved matter,

References

We have a key UK.GOV speaker at our Update session on May 11 in London: http://www.amberhawk.com/bookevents.asp

Manifestos

Conservative: https://s3-eu-west-1.amazonaws.com/manifesto2015/ConservativeManifesto2015.pdf

Labour: http://b.3cdn.net/labouruk/e1d45da42456423b8c_vwm6brbvb.pdf

Lib Dem: https://d3n8a8pro7vhmx.cloudfront.net/libdems/pages/8907/attachments/original/1429028133/Liberal_Democrat_General_Election_Manifesto_2015.pdf?1429028133

UKIP: https://d3n8a8pro7vhmx.cloudfront.net/ukipdev/pages/1103/attachments/original/1429096952/theukipmanifesto2015.pdf?1429096952

Green: https://www.greenparty.org.uk/assets/files/manifesto/Green_Party_2015_General_Election_Manifesto_Searchable.pdf

SNP: http://votesnp.com/docs/manifesto.pdf

Confirmation that the Data Protection Regulation reduces protection for data subjects from Directive 95/46/EC

It appears that DAPIX civil servants are burning the midnight oil in an attempt to agree a draft text of the Data Protection Regulation which can be put before the Council of Ministers at its June meeting. Such a Ministerial agreement would then trigger tri-partite negotiations with the European Parliament and the Commission with the objective of producing a final text of the Regulation (my guess is still January-March 2016; implementation early 2018).

To get to a June agreement, the DAPIX group of experts from Member States have been asked to agree or disagree with certain propositions relating to data subject rights; these propositions are set out in Latvian Presidency document which is the subject of this blog (for a copy; see references).

The Presidency text confirms (and in some places admits) that many of these propositions reduce the protection afforded to data subjects from the level established by Directive 95/46/EC.

This reduction in data subject protection is in addition to the twenty or so Articles mentioned in my previous blog about the Regulation (see references), where Member States are given flexibility as to how a provision in the Regulation is implemented.  For instance:

Article 21 has widened the categories of exemptions (e.g. from subject access ) from a list of 7 categories in Article 13 of Directive 95/46/EC to a list of 11 categories of exemption in Article 21 (with additional “flexibility” for each Member State to add more exemptions to suit the processing needs of the moment).

Article 1(2a) has been amended to allow each Member State to define the extent to which the Regulation applies to the public sector (i.e. some provisions might not apply).

To the above can be added the recent concerns raised by the Working Party of Data Protection Commissioners over the DAPIX-inspired change to the “purpose limitation principle” (in the UK’s DPA, the Second Principle states that any further processing of personal data cannot be for a purpose that is incompatible with the purpose of obtaining).

The DAPIX changes to this principle include conditions when a further processing purpose is deemed to be compatible with purpose of obtaining. As this change is very important, I will leave it to the Working Party to describe its impact; in its press release the WP29 states (see refererences):

“The Working Party considers that this situation would render one of the fundamental principles of the data protection framework, the purpose limitation principle, meaningless and void”.

“Such an approach, which conflates the notions of legal basis and further processing for compatible purpose, contradicts the EU data protection acquis and would be illegal under the current legal framework. It could furthermore have no other consequence but to undermine the whole new data protection framework and to dilute the level of protection for EU citizens in comparison to Directive 95/46/EC in force”.

 

CHANGES IN THE LATVIAN PRESIDENCY TEXT

I now highlight where the protection for data subjects, in my view, is weakened further by the Presidency text below the level of protection established by Directive 95/46/EC.

Personal data collected from the data subject

This Article concerns the Fair Processing Notice given to data subjects when they provide their own details directly to a data controller.  Evidently there is to be a decision on adding “where appropriate” or “where practicable” because “listing the information the controller is obliged to provide at the time the data is obtained because it might not be possible to do so at that moment”.

Such a change means that a data controller, when collecting personal data from a data subject, can give the Fair Processing Notice after data collection; the Presidency’s document comments that this change “would go below the level of protection under the 1995 Directive”.

Personal data not collected from the data subject

Some delegations have asked “to delete the last two points (d) and (e) from the list of information provided” in the Fair Processing Notice (when personal data about a data subject are obtained from other sources). This is a reference to the removal of the following paragraphs from Article 14A:

"(d) where the data originate from publicly available sources";

or "(e) where the data must remain confidential in accordance with a legal provision in Union or Member State law or because of the overriding legitimate interests of another person" (from DAPIX leak of 16th March 2015; see references).

If the deletion goes ahead, it means that data subjects might not know that their personal data can be obtained from somewhere in the internet or from any public register. How, for instance, are data subjects going to exercise the right to be de-listed (Google Spain decision), if data subjects are kept ignorant about where public domain information is collected to make a decision about them?

If, for example, someone gets turned down for job, why shouldn’t the applicant know what public sources have been used to check what that person says in his or her CV?

General reduction in “fairness” criteria

It is noteworthy that in the DAPIX leaked text of 16th March shows that with respect to Article 14, the Commission (COM) has entered a “reservation” on deletion of the words 'such as' (COM also have a reservation on Article 14A as well). The removal of the words “such as” is another reduction in the level of protection from the equivalent provision in Directive 95/46/EC.

This can be seen by reference to the current fair processing notice (FPN) provisions under the UK’s DPA which requires a FPN to contain the identity of the data controller, representative (if any), the intended processing purposes and anything else necessary to ensure fair processing. Note that this is an open ended list depending on the context of the processing purpose.

However, in the DAPIX version of the Regulation, the list is now fixed. So if fairness criterion is not in the list defined in Article 14 or Article 14A, it does not need to be declared even though it could be important. In this way, the removal of “such as” can reduce transparency to each and every data subject.

The right to object (Article 19)

The DAPIX text limits the data subject’s right to object to the processing of personal data to those circumstances when the processing is based on the legitimate interest of the controller (Article 6(1)(f) – or Schedule 2, paragraph 6 for the UK DPA equivalent).

This can be compared to Article 14(a) of Directive 95/46/EC which allows the right to object to apply to that processing necessary for the functions of the public body.  In UK DPA terms, the section 10 right to object can apply when the processing is justified in terms of Schedule 2, paragraph 5; it is this right that is being removed.

Although the Regulation makes the right to object easier with respect to that processing of personal data by the private sector (Article 6(1)(f) cannot be used by the public sector), the right is wholly removed for the public sector irrespective of the circumstances of the processing for every public body.

I cannot see why this blanket exclusion in the protection to data subjects should be afforded in every case, as Article 1(2a) of the DAPIX text allows for case by case derogations for the public sector as appropriate.

This Article can be seen as also reducing the protection afforded to data subjects from the standards of Directive 95/46/EC when the processing is undertaken by the public sector.

Profiling (Article 20)/right to object to automated decisions

I will let the Presidency document speak for itself: “Profiling is a fundamental question in the Regulation…. It has been discussed under many Presidencies…... Delegations are cautioned not to go below the level of protection in Article 15 in the 1995 Directive”.

Representation of data subjects (Article 76)

The DAPIX group is considering removing the ability of consumer/privacy groups such as Which?, Liberty, Privacy International, BigBrother Watch etc to represent the issues faced by data subjects in general.

The Presidency states “Delegations were quite concerned about paragraph 1a that allows for bodies, organisations or associations to lodge a complaint independently of a data subject's complaint and stated that such rights don't exist under national law”. Consequently “Delegations are asked to indicate if they would like to allow such possibilities” (and remove the ability of NGOs to protect the public independent of data subjects).

I can think of one word that describes the above: "shocking".

Penalties and fines

Amended Recital 119 in the Presidency document states “Member States may lay down the rules on criminal sanctions for infringements of this Regulation, including for infringements of national rules adopted pursuant to and within the limits of this Regulation”. It is well known that the UK Government is opposed to implementing the custodial element of the Section 55 offence in the DPA; the Regulation might not change that.

Amended Recital 120 states that “It should be for the Member States to determine whether and to which extent public authorities should be subject to administrative fines”. This implies that the UK Government could decide that the mass data losses that are already subject to Monetary Penalty Notices in the public sector in the UK, are no longer subject to fines.  Such a step could encourage non-compliance with data protection obligations by the public sector as a whole.

Concluding comment

The fact that I think that the Regulation could reduce the protection afforded to data subjects is not new; however, the Latvian text confirms this threat is real and immediate. In the scramble to agree a text the Regulation is being transformed, from an instrument that aims to protect the interests of data subjects in a brave new technological world, into one that could easily do the opposite.

If the Council of Ministers agree a text similar to that which has been leaked, I will be lobbying my Member for the European Parliament to vote down the Regulation and stick with Directive 95/46/EC; the risks are too great.

Indeed, if I were in a NGO with an interest in consumer or privacy protection, I would be actively making contingency plans for this eventuality.

References

We will be updating delegates on the Regulation at our Update session on May 11 in London: http://www.amberhawk.com/bookevents.asp

Reduction in protection for data subjects:  as identified in the Latvian Presidency DAPIX discussion document dated 27th March 2015; Download March 27 2015 DAPIX Options

DAPIX leak of 16th March 2015 covering Article 14/14A; Download March 16 2015 DAPIX Options

Reduction in protection for data subjects: mainly because of the flexibility introduced into the Regulation so that Member States to legislate for a reduction in protection from level established by Directive 95/46/EC: http://amberhawk.typepad.com/amberhawk/2014/12/italian-data-protection-regulation-text-exposes-member-states-disharmony-risk-of-weaker-protection-for-data-subjects-increas.html

The Italian DAPIX text (232 pages) can be accessed by a link at the end of the above link.

EDRI (European Digital Rights) a NGO have already published their concerns about the direction of the Regulation: https://edri.org/files/DP_BrokenBadly.pdf

Reduction in protection for data subjects: Working Party 29 concerns over the caused by qualifying the “finality principle” (Second Principle of DPA) http://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/20150317__wp29_press_release_on_on_chapter_ii_of_the_draft_regulation_for_the_march_jha_council.pdf

GCHQ to offer email services and obtain consent for mass communications data retention

One of the papers published by the Intelligence and Security Committee (ISC) with its report into “Privacy and Security” contained a five-page memo from GCHQ’s legal advisers (see last week’s blog and references).  It suggests that the secret organisation is about to offer email services to the public in order to allay concerns about the mass retention of communications data.

I have checked with a leading domain name registration company, and it appears that the first steps have already been taken.  I can confirm that the “patriot.me.uk” and “patriot.uk” domain names have been registered to a certain “Professor Gordon C. H. Quatermass, P.O. Box 500, Hubble Road, Cheltenham  GL51 0EX” (a joke name if ever there was one).

The memo anticipates that GCHQ’s free email service will start in January 2016 and will be targeted at domestic subscribers; it also anticipates the development of special cookies and cloud services. The move allows the use of powers by GCHQ to be focused on the non-consensual circumstances (i.e. users who don't use the patriot.me.uk” and “patriot.uk" domains).

The analysis outlines how GCHQ’s email service “will enhance the on-line security experience of those who use the ‘patriot’ domains” and assumes that recent public opinion surveys which show good public support for the mass retention of communications data are correct (e.g. a YouGov Poll of January 18th shows 53% in favour of mass data retention; a similar Australian poll shows 66% support).

The memo then outlines GCHQ procedures as follows:

• Subscribers in favour of mass data retention associated with their emails can open an account associated with the new GCHQ “patriot” domain names from the New Year. GCHQ will have obtained data subject consent for any data retention as individuals “are not compelled to open a ‘patriot’ email account”.
• GCHQ in its fair processing notice will stress that communications data for all “patriot” domains are to be retained for one year; there is no Article 8 human rights issue as users of the “patriot” domain names are freely consenting to this retention.
• Those sending email messages to a “patriot” domain (e.g. from the Hotmail.co.uk or gmail.com domain) have also consented to communications data retention by GCHQ. This is because “such users are not obliged to send an email to a ‘patriot’ domain; if they do so, they are freely choosing to send the email knowing the retention criteria”.
• GCHQ stresses that because an email is transmitted using its services, it does not mean that the content will be read by GCHQ or that communications data will be retained. Emails associated with “innocent subscribers will only be examined if they need to be cleared of suspicion”.
• As more and more subscribers see the benefit of a GCHQ account, the “patriot” domain names will be in demand. Indeed, “we expect business use to increase exponentially” because “employees will not send inappropriate messages via these domain names and are more likely to conform with their employer’s acceptable use policy”.
• Use of the ‘“patriot” domains will help reduce spam and phishing as “spammers are unlikely send bulk emails to GCHQ because they risk subsequent tracing and exposure”.  Indeed “the evidence we collect might help the Information Commissioner serve monetary penalty notice on spammers”.
• On an individual basis, “cyber-bullies and those who trash reputations anonymously” are unlikely to risk exposure given GCHQ’s “ability to trace senders from IP addresses”.

From public comments made yesterday by leading politicians during the Election campaign, GCHQ’s email service is gaining considerable political support.

Mrs Theresa May, former Home Secretary, has approved the GCHQ initiative. Seeking re-election as the MP for Maidenhead, she told her constituents: “An email address in the form ‘[email protected]’ or ‘[email protected]’ demonstrates where each citizen’s heart and mind lies”.

She added “Not only will a ‘patriot.me.uk’ account demonstrate that the user is not a terrorist, child abuser, wife beater or member of the mafia, it will show that senders and/or recipients of emails can be trusted as they trust GCHQ”.

The UKIP leader, in his speech at Dover yesterday, said he also supported the GCHQ initiative. “I am proud of my ‘[email protected]’ email address” he said, adding “I think we can draw obvious conclusions if individuals, especially those who come to our shores from abroad, fail to obtain a patriot email account when they reside in the UK”.

In an echo of Norman Tebbit’s infamous cricket test (“Immigrants who support their native countries rather than England at the sport of cricket are not significantly integrated into the United Kingdom”), Mr Farage added: “the failure to use a ‘patriot’ account sends a message about the commitment of each citizen to the preservation of customs and social values that are cherished in the UK”.

Mr. Farage used the event to announce a new UKIP policy: those who successfully apply for a passport will be given a “patriot” email address so “we know where we stand if they refuse to use it”.

The memo suggests that if the email initiative is successful, that GCHQ should consider producing its own surveillance cookies modelled on adware. Because of the volume of data hoovered-up by these cookies, they are colloquially known by GCHQ techies as ‘suckies’ (a shorthand for “surveillance cookies”).

According to the report, GCHQ should also consider offering new Cloud services such as “MaaS” (Monitoring as a Service) and “SaaS” (Surveillance as a Service). The memo notes that if the UK banks were to use these GCHQ cloud services, then this would ease the Government’s problems associated with tax evasion and help the police trace money transfers to terrorists and organised crime.

The memo states that “The public would not understand why the banks failed to use GCHQ Cloud services as the Treasury and taxpayer is the obvious beneficiary”; there would “be a strong public interest to oblige the financial services industry to use them”.

After all, the memo concludes, “if members of the public, for their own online protection, use the patriot domain names, why should we not expect the financial sector to be equally patriotic?”.

References

Because of the implications of this memo, I will be raising this issue at our UPDATE conference on May 11th – details of the program from http://www.amberhawk.com/pdf/Amber_UPDATE_CONFERENCE_advancebookingform.pdf

ISC Press statement, report and evidence accessible from: http://isc.independent.gov.uk/

Written evidence from: http://isc.independent.gov.uk/public-evidence  (date posted is 12 March 2015)

YouGov Poll https://yougov.co.uk/news/2015/01/18/more-surveillance-please-were-british/