Hawktalk

EDPS warns that data processing under the Regulation “must be both lawful and justified”

I wasn’t going to publish this blog until I saw the above headline from the European Data Protection Supervisor (EDPS) recommendations for the Data Protection Regulation (see references). This headline reads: “All data processing must be both lawful and justified”.

This issue has been a concern of mine for sometime but I had convinced myself that my concerns were misplaced.  However as the EDPS has raised them, I think it is worth resurrecting the point for consumption by the data protection community.

Translated into current UK data protection terms, the EDPS is saying that any processing of personal data has to be lawful in general (e.g. lawful under other legislation), and has to possess a Schedule 2 grounds as a further justification. 

"And what is the problem", I hear you say – isn’t that an obvious statement of most of the First Principle? Well, actually, “no”! 

About a decade ago, there was a legal argument that “lawful processing” in the First Principle should mean “lawful just under the DPA”; for instance if there was a Schedule 2 grounds for the processing, then the processing was lawful in data protection terms.

This argument arose in the context of a report  “Personal data for public good: using health information in medical research.  A Report from the Academy of Medical Sciences,  January 2006”.  This stated (under the heading “Lawful processing”): 

“The prevailing view is that for data processing to be lawful, it must not contravene laws external to the DPA, such as the common law of confidentiality, the Human Rights Act or administrative law.  An alternative view submitted to the Working Group has argued that the statutory phrase ‘lawful processing’ means no more than compliance with a condition in Schedule 2 and 3, for instance, the public interest condition of Schedule 2 or the medical purposes condition of Schedule 3” (see paragraph 2.2.1, page 24).

I was concerned whether the Regulation text could be interpreted in a way that “lawful” processing meant “lawful just under the DPA” and that this view might prevail.  If this were the case, it would be a very serious degradation in the level of data protection. 

The argument for this proposition

All three versions of Article 6(1) of the Regulation text now in Triolog says something like: “Processing of personal data shall be lawful only if and to the extent that at least one of the following applies……..”. This is followed by a choice from a revised list of grounds similar to that found in Schedule 2 of the DPA  (e.g. processing is made lawful with data subject consent or necessary for the vital interests of the data subject or necessary for a legal obligation other than a contractual one). 

Recital 31 (Council of Minister’s text) confirms that “In order for processing to be lawful, personal data should be processed on the basis of the consent of the person concerned or some other legitimate legal basis laid down by law…” (a link to Article 8 Treaty of Lisbon right to data protection). 

If you then look at Article 5(a), there is a requirement for any processing of personal data “to be processed lawfully, fairly and in a transparent manner in relation to the data subject” and of course means the data controller needs an Article 6 ground. 

Could these provisions be interpreted to mean that if a data controller has a grounds for the processing in Article 6,  then the processing of personal data is lawful in terms of Article 5?  If so, a ground for the processing would make the processing “lawful” and the much diminished level of data protection would result. 

The counter argument to the above proposition 

This relies on a Court concluding that the Article 5 reference to lawful processing is wider than the Article 6 reference to lawful processing.  For example, if the proposition is that the argument about lawful processing is limited to the equivalent of an Article 6 ground, then there is no need for Article 5 to refer to “lawful" processing at all. 

However, because both Articles 5 and 6 refer to lawful processing, it follows that the proposition is incorrect. It follows that the A.5 reference to lawful processing involves general lawful processing and includes A.6 reference but is not limited to it.

So logically, I don’t have a concern! The only problem is whether European judges follow suit.  Lord Denning, that famous Master of the Rolls, in the latter part of the last century is reported as having said that the public can always “trust the judges”; so that is what I was doing. 

This was the position until the EDPS recommendations. Comments such as  “. We recommend avoiding any conflation and thereby weakening of these principles” have resurrected some concerns. What lawful processing means should be explicit on the face of the Regulation.

Over to you: which side of the argument are you on?  On a different point: the EDPS has a "Regulation App" which allows navigation of the various forms of the text (see references).

References

A 15 page summary of the EDPS recommendations: https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2015/15-07-27_GDPR_Recommendations_EN.pdf

 Annex: Comparative table of GDPR texts with EDPS recommendations (a mere 520 pages): https://secure.edps.europa.eu/EDPSWEB/edps/Consultation/Reform_package

The EDPS has produced an APP to navigate the various versions of the Regulation; downloadable from https://secure.edps.europa.eu/EDPSWEB/edps/Consultation/Reform_package

Liddell K (2005) “The Mythical Connection Between Data Protection Law and Confidentiality: Processing Data “Lawfully”. Bio-science Law Review 6, 215–22.

Our next Data Protection regulation workshop is in London is on Sept 29th-1st October: http://www.amberhawk.com/DPFoundation.asp

ICO warning: "enforced subject access" used by insurance industry is an abuse of data subject rights

The Information Commissioner (ICO) has told the Association of British Insurers (ABI) that their members who ask data subjects to exercise their rights of access to health records in order to obtain insurance products are making several breaches of the Data Protection Act.

Clearly, the ICO is expecting the ABI's variant of enforced subject access to cease; the only remaining question is whether the Insurance Industry disagrees and wants to “have its day in court”.

In a letter to the ABI (see references), the ICO states that the Access to Medical Reports Act (AMRA) “sets out a statutory regime - with appropriate safeguards - by which medical information about an individual may be obtained by an insurer for insurance purposes.  It should be noted that AMRA makes provision for GP reports to be provided to insurers, and is not a regime for obtaining medical records.”

Despite this, the letter continues: “We believe that use of subject access rights in the manner described sidesteps the statutory regime under AMRA”.

The letter points out that there might be a competition issue as “Section 8(3) of the DPA provides that a data controller is not obliged to comply with a subject access request if they have previously complied with a request and a reasonable interval – having regard to the nature of the data, the purpose for which it is processed and the frequency with which it is altered – has not elapsed”.

The letter continues that this provision allows the data controller (e.g. the GP) “to refuse to comply with a SAR where it has already done so within a close period of time.  As it currently stands, it is likely that section 8(3) would apply in the case of individuals seeking a quote from a number of insurers, and therefore individuals may be prevented from obtaining the most competitive price for a policy. This could create competition and other regulatory concerns that insurers should consider”.

The letter points out that “An insurer who processes an individual’s entire medical record is likely to fall foul of the third principle” (because a subject access request will provide details that are excessive in relation to the insurance purpose).  In related paragraphs the ICO refers to breaches of the First and Fifth Principles for similar reasons.

The Commission hints of breaches of the UK’s International obligations. This is because “subject access is a key element of the fundamental right to the protection of personal data provided for under Article 8 of the EU Charter of Fundamental Rights which is conferred upon individuals”; the right of subject access “is not designed to underpin the commercial processes of the life insurance industry”.

In summary, “the Commissioner takes the view that the use of subject access rights to access medical records in this way is an abuse of those rights”.  He adds that “if the specific statutory mechanism provided by legislators for obtaining medical information for insurance purposes is failing to provide the information within the timescales the industry needs, then those affected should seek to review that mechanism and have this subjected to proper parliamentary scrutiny with a view to changing it".

The ICO concludes: “Using individuals’ own data protection rights to side step the current statutory arrangements designed to meet the insurance industry’s needs, and including important safeguards for individuals, is not the appropriate approach”.

Biff, bang, bong, pow, smash!  See you in court, if you want,.

References

A lot of the ICO’s letter was anticipated in my blog 2012 which links to references which explains how the Insurance uses enforced subject access:  http://amberhawk.typepad.com/amberhawk/2012/02/enforced-subject-access-raises-its-ugly-head-in-the-context-of-medical-insurance.html

Download the ICO letter to the ABI here: Download ABI - Letter - 20150714 BLOG

Legal and General; how they use the Subject Access procedure at the moment: http://www.legalandgeneral.com/advisercentre/protection/underwriting/legislation-and-regulation/access-to-your-medical-history/

Our next Data Protection Foundation leading to the BCS qualification in London is on Sept 29th-1st October: http://www.amberhawk.com/DPFoundation.asp

Council of Ministers’ Regulation text negates ECJ rulings in Lindqvist and Ryneš

Note added: 21/12/2015 after GDPR Trilog text published:

Article 2b of the consolidated text states that the domestic purpose is processing “by a natural person in the course of a purely personal or household activity”; Recital 15 of that text allows for limited social media use. I therefore expect that Lindqvist and Ryneš rulings to remain relevant to the GDPR

Original posting

The Lindqvist decision of the European Court of Justice (ECJ) in 2003 has always caused problems.  In Data Protection Act (DPA) terms, it means that the domestic purposes exemption (in Section 36 of the DPA) does not automatically apply to personal data which are published on the Internet.

This, in turn, means that social media aficionados, who are happy to post personal data about other individuals, have to apply the data protection principles to their postings.  In addition, as data controllers, they should pay a £35 notification fee to the Information Commissioner (ICO); since failure to notify is a criminal offence, the Lindqvist decision has had the potential to make criminals of them all.

This helps to explain why the ICO has avoided the implications of Lindqvist like the plague; a position maintained until the “Solicitors from Hell” case in late 2011 (see references).  In that case, the ICO’s advice on the domestic purpose exemption was politely but comprehensively trashed; Tugendhat J. concluded that “I do not find it possible to reconcile the views on the law expressed in the Commissioner's letter with authoritative statements of the law” (paragraph 100).

I should add that since 1998, the Government has had the powers to take the processing of personal data for social media purposes out of notification (see section 17(3) of the DPA) and therefore decriminalise social media users.  It has failed to do so, thus compounding the ICO’s problems in this regard.

Now with the Regulation in trilog discussions, the Council of Ministers are set upon rewriting data protection history so the impact of Lindqvist (and Ryneš) is expunged.  This rewriting is another example where the protection for data subjects is being lowered from that offered by Directive 95/46/EC (see references).

ARTICLE 3(2) OF DIRECTIVE 95/46/EC

The main impact of the Lindqvist  and Ryneš judgements is that the ECJ interpreted Article 3(2) of Directive 95/46/EC narrowly.  Article 3(2) states that the Directive does not apply “to the processing of personal data …by a natural person in the course of a purely personal or household activity” (my emphasis).

In Lindqvist, the ECJ judgment interprets a “purely personal or household activity”  to mean:

 “That exception must therefore be interpreted as relating only to activities which are e carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people” (paragraph 47; my emphasis).

In Ryneš, the Court said: “Article 3(2) of Directive 95/46 falls to be narrowly construed as ... the processing is carried out is a ‘purely’ personal or household activity, that is to say, not simply a personal or household activity” (my emphasis; paragraph 30). 

Note that it is the word “purely” that narrows the scope of Article 3(2). It is this word that is replaced by the Commission and European Parliament, but removed completely in the Council of Ministers version of the Regulation.

THE VARIOUS FORMS OF ARTICLE 2(d) OF THE DATA PROTECTION REGULATION

The Commission’s revision of Article 3(2) states that the Regulation does not apply to that processing of personal data  “…by a natural person without any gainful interest in the course of its own exclusively personal or household activity” (Article 2(d)). 

The relevant Recital explains that “This Regulation should not apply to processing of personal data by a natural person, which are exclusively personal or domestic, such as correspondence and the holding of addresses, and without any gainful interest and thus without any connection with a professional or commercial activity”. 

Commentary on the Commission’s version.  I think the use of “exclusively” and “its own” limits the posting of personal data via social media to a posting by the data subject about himself; it would therefore mean that a posting of personal data of someone else could be subject to the Regulation depending on the circumstances.  “Without any gainful interest” excludes any commercial activity. 

There is no explicit reference to social networking in the Commission’s text, but I think limited social networking between family members and real “friends” would be OK (e.g. the data subject is sharing personal data about himself with other family members and friends and vice-versa in the context of himself or his household). 

The Parliament’s revision of Article 3(2) is close to the Commission’s version and states that the Regulation does not apply to that processing of personal data “by a natural person in the course of an exclusively personal or household activity.  This exemption shall also apply to a publication of personal data where it can be reasonably expected that they will be only accessed by a limited number of persons”. 

Parliament’s Recital explains that “This Regulation should not apply to processing of personal data by a natural person in the context of a personal or household activity, thus without any connection with a professional or commercial activity. Personal and household activities include social networking and online activity undertaken within the context of such personal and household activities”. 

Commentary on the Parliament’s version.  The use of “an exclusively personal or household activity” (rather than “its own exclusively personal or household activity” as per Commission) does not limit the posting to the personal data about the posting data subject.  It allows limited exchange between the data subject who might be sharing personal data about himself and/or about his friends with his friends (and vice-versa). 

In other words, the Parliament’s text slightly broadens the social networking position established by the Commission’s text. 

The use of “exclusively” and “limited number of persons” also reinforce the idea that the personal data are not widely distributed.  The Recital, unlike the Commission’s text, clearly extends the exception to “social networking and online activity undertaken within the context of such personal and household activities”; its intent is clearly to ensure that limited social networking between a small number of friends and family members is exempt from the Regulation. 

The Council of Ministers’ text states that the Regulation does not apply to that processing of personal data “by a natural person in the course of a personal or household activity”; the Recital is exactly the same as the Parliament and includes “social networking and on-line activity undertaken within the context of such personal and household activities”. 

Commentary on the Council of Ministers’ version.  Compared with the Parliament’s text, the key differences are the absence of the words “exclusively” and  “limited number of persons”.  The removal of these constraints implies the Council of Ministers seek a broad “personal use” category involving an unknown (perhaps unlimited) number of persons. 

Note that the Council of Ministers’ text directly undermines Ryneš.  In Ryneš, the Court said: “Article 3(2) of Directive 95/46 falls to be narrowly construed as ... the processing is carried out is a ‘purely’ personal or household activity, that is to say, not simply a personal or household activity”  (paragraph 30).  

The mere absence of the word “purely” in the Council of Ministers’ version of the Regulation text changes the conclusions in Ryneš,  as the Ministers’ proposed text does indeed refer to “simply a personal or household activity”. 

Thus, if the Council of Ministers version of the text prevails, the ECJ ruling in Ryneš is likely to be overturned.  Someone who attaches a camera that undertakes surveillance of the public space outside his house in order to protect a household is likely to be successful in the argument that such processing is in the course of “simply a household activity”. 

There is also an issue with the absence of the word “limited” (which appears in the Parliament’s text). For instance, FaceBook has a maximum number of 5000 friends; more than 5000 then you have to have a “fan page” (of which I have several anonymous ones).  The Council of Ministers’ text opens up an argument that a posting to say 500 friends is “personal” (because it is “limited” to well below the 5000 maximum). 

In other words, if one school student posts Third Party personal data to a limited number of students in the same year at school in order to bully or get “revenge”, then this could easily be a “personal activity”; after all getting revenge and bullying is often a very personal pursuit.  If this is the case, there will be little the Regulation could do to protect the data subject (except by the Right to be forgotten, perhaps).

Conclusion: what should happen?

The use of the Internet often throws up difficult questions in the context of freedom of speech versus privacy; the domestic purpose exemption is just another of those difficult questions.  However, because the question is difficult, does not mean that it should be avoided or exempted from a data protection response. 

My preference is to keep the construction of Directive 95/46/EC; this means that Lindqvist and Ryneš rulings are maintained.  However, I would add to the list of “Codes of Conduct” the requirement to produce European wide data protection advice on the “personal or household activity” exclusion, so that it is clear the extent of this exemption from the data protection rules. 

This guidance would also identify therefore when the Regulation could be enforced;  it is relevant to note that the UK’s Information Commission has published guidance on the domestic purpose exemption under the UK Act (see references). 

Instead the Council of Ministers have proposed an exemption that is likely to exclude important data protection considerations, neuters the role of data protection authorities, and undermines the balance established under the Directive. It clearly weakens the protection for data subjects below that of the Directive. 

Obviously, there is a balance between privacy and the use of social media when expressing oneself.  However, instead of engaging with notions of balance, the Council of Ministers intend to throw away the scales. 

References

Our next half day workshop on the Data Protection Regulation is on: 28th September in London: http://www.amberhawk.com/bookevents3.asp

Why the Data Protection Regulation is likely to provide a lower level protection than Directive 95/46/EC: http://amberhawk.typepad.com/amberhawk/2015/02/why-the-data-protection-regulation-is-likely-to-provide-a-lower-level-protection-than-directive-9546.html

Lindqvist summary and implications: http://www.out-law.com/page-4051 and http://www.out-law.com/page-8401

Ryneš summary and implications: http://amberhawk.typepad.com/amberhawk/2015/01/ecj-ryne%C5%A1-ruling-implies-ip-addresses-are-personal-data-in-themselves.html

Ryneš  and Lindqvist Case references:  European Court of Justice (ECJ) Judgment in Case C-212/13 (Ryneš) and Case C-101/01 (Lindqvist)

ICO Guidance on social media and the domestic purpose exemption: https://ico.org.uk/media/for-organisations/documents/1600/social-networking-and-online-forums-dpa-guidance.pdf

Solicitors from Hell case; Law society & Ors v Kordowski [2011] EWHC 3185 (QB) http://www.bailii.org/ew/cases/EWHC/QB/2011/3185.html

Can the Information Commissioner assess relevance, retention and unlawful processing at GCHQ?

Whilst awaiting the arrival of another enthralling, multi-megabyte, download about the General Data Protection Regulation, I started reading the judgement (Case Number IPT 14/85/CH), delivered by the Investigatory Powers Tribunal last February.  This is one of the cases between Privacy International and Government Communications Headquarters (GCHQ) which identified some unlawful processing of personal data by the latter (see references).

Paragraph 109 of this Tribunal’s judgment refers to the National Security Certificates established by Section 28 of the DPA;  it states:

“Those certificates certify that personal data that are processed in performance of the Intelligence Services’ functions are exempt from the first, second and eighth data protection principles (and are also exempt in part from the sixth data protection principle). Thus the certificates do not exempt the Intelligence Services (including GCHQ) from their obligation to comply with the fifth and seventh data protection principles, which provide:

5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. …

7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”

The reference to “those certificates” is a reference to National Security Certificates dated 2001; they were signed by David Blunkett and Jack Straw when they were Home and Foreign Secretaries respectively.

This in turn implies the current Home/Foreign Secretaries have not seen them contrary to the practice established for the Transport for London’s Congestion Charge National Security Certificates (when Jacqui Smith in 2007 and her replacement in the following Coalition Government, Theresa May, signed it in 2011).  Why successive Home/Foreign Secretaries have not followed the Transport for London practice for the 2001 Certificates is one of those unanswered questions.

Of course, there is no obligation in Section 28 of the Data Protection Act to refresh Ministerial approval of Certificates (or indeed to have Certificates at all). But it is astonishing that the national security agencies have relied on them for well over a decade, without any evidence of any review of their effectiveness, by any other later Cabinet Minister who has political responsibility for these agencies.  In relation to any concept of accountability, there is something not quite right here.

One plausible reason for the lack of review could be the fact that these Certificates, fashioned just after 9/11, are over engineered as they exempt the First, Second and Eighth Data Protection Principles.  So for instance, the exemption:

• from Schedule 2 and 3 of the First Principle allows that processing of personal data which is not necessary for the national security purpose.
• from the Second Principle is consistent with the notion the national security agencies might want to use or disclose personal data for purposes that are incompatible with the national security purpose.
• from the Schedule 4 (and the Eighth Principle) is consistent with the idea that the national security agencies want to transfer personal data without any regard for any “substantial public interest” or the adequacy of protection in the territory to which personal data are transferred.

In other words, if I wanted to fashion an exemption that would allow me to secretly transfer personal data to North Korea for any purpose, without regard for the lawfulness of the processing, my exemption of choice would have to include all of the First, Second and Eighth Principles.  That, in a nutshell, is why these Certificates are over-engineered.

However, taking paragraph 109 at face value, it appears that the Information Commissioner can undertake an assessment under the Fifth and Seventh Principles.  Namely, to assess whether GHCQ has taken;

• appropriate  organisational and technical measures against unlawful and unauthorised processing, and
• appropriate steps to ensure that the retention of personal data such as communications data are kept no longer than are necessary for the national security function.

In addition, as the Third Principle is not exempted by the Certificates, such an assessment can include the issue of whether personal data are processed in a way that is relevant to the processing purposes.

The use of “unlawful processing” and “necessary” creates links between the Fifth and Seventh Principles to Article 8(2) of the Human Rights Act.  In the context of national security purpose, we can read A.8(2) as:

“There shall be no interference by a public authority”  (e.g. data retention by a national security agency)  “with the exercise of this right except such as is in accordance with the law” (i.e. not unlawful) and “is necessary in a democratic society in the interests of national security….”.

As each Principle stands by itself, the fact that the First Principle is exempt (i.e. the requirement to process personal data lawfully),  does not mean that an assessment cannot be done into management processes to prevent “unlawful processing” in terms of the Seventh Principle.

Given that GCHQ has appeared to have processed personal data unlawfully (see press references below), it is reasonable for the ICO to assess whether GCHQ management has done its best to ensure that any future processing is not unlawful (as alleged by the press) and that all proper “authorisations” for processing are in place.  An assessment in terms of data retention and relevance seems also to be possible (unless a new Certificate is produced) if the Commissioner wants to do one.

Of course there might be issues such as concerning security clearance of the Commissioner’s auditors or overlap between the functions of different Regulators. However, these are not insurmountable as there are many contractors and staff of regulators, with the correct level of security clearance, who can be trained to deliver a data protection audit (by us, perhaps?).

Concluding point

In summary, the national security agencies should comply with several data protection principles and refashion the 2001 Certificates in order to precisely define when and why the exemption from the Principle is needed.

In the post Snowdon era, it would reassure the public if these agencies had, by law, to commit to the following obligations:

• Limit the processing to that which is necessary for their statutory functions.
• Ensure that personal data are processed in a way that is not incompatible with the national security purpose.
• Ensure that personal data are kept no longer than necessary for the national security purpose.
• Ensure that personal data be kept secure and only transferred if there is a substantial public interest in the transfer.

My conclusion is that far from exempting the above Principles, the national security agencies should publicly embrace them.

Of course,  I am not expecting this to happen; however this does not stop the ICO from establishing the important principle that some processing of personal data for a national security purpose falls within his responsibilities as a data protection authority.

References

The Tribunal Case No. IPT 14/85/CH:  http://www.ccc.de/system/uploads/174/original/Privacy_Greennet_Open_Response_6_Feb_2015.pdf

GCHQ press coverage of existing “unlawful processing”:

• 6th Feb 2015: GCHQ's Internet surveillance with US ruled unlawful: http://www.telegraph.co.uk/news/uknews/law-and-order/11394860/GCHQs-mass-Internet-surveillance-ruled-unlawful.html

• 29th April 2015: GCHQ conducted illegal surveillance, investigatory powers tribunal rules; http://www.theguardian.com/uk-news/2015/apr/29/gchq-destroy-legally-privileged-communications-rendition-victim-sami-al-saadi-ruling

The National Security Certificates (Straw; date 8/12/2001) and (Blunkett; date 10/12/2001) are published at the end of: http://amberhawk.typepad.com/amberhawk/2014/02/should-national-security-certificates-exclude-the-data-protection-principles.html

Data Protection and the national security function; written evidence to the Intelligence and Security Committee: http://amberhawk.typepad.com/files/blog_evidence-to-isc.pdf