Hawktalk

The Recitals are essential to your understanding the General Data Protection Regulation

There are a spate of articles and blogs on the Regulation at the moment; how do you know which ones are worth reading?

Well, in my view, if the text does not include reference to the impact of the Recitals that are associated with any Article mentioned in the text, then the blog or article is likely to be incomplete.

The reason for this is that the role of the Recitals has been enhanced by the consistency mechanism of the Regulation; understanding this change is essential to your understanding of how the Regulation will be interpreted by the Data Protection Authorities.

Normally, Recitals are used by the Court of Justice of the European Union (CJEU) in order to establish what any Directive or Regulation means in the context of a particular case before the Court. Thus, for example, in the Google Spain or Ryneš, the Court explored the Recitals in order to justify its judgments (see references).

Note that for a case to be heard before the CJEU, someone (usually a data subject) has to undertake the long march through the legal institutions. For instance, Max Schrems, in order to get his day before the CJEU (re Facebook and Safe Harbor), had first to be rebuffed by the Irish Commissioner and the Irish Courts. This process requires enormous and persistent effort.

However, the General Data Protection Regulation is rather special; it is not only the CJEU that will use these Recitals; it will be the European Data Protection Board (EDPB) when it exercises its role of ensuring the Regulation is consistently applied across Europe.

An example will help explain the consequences of this change.

Suppose the UK’s Information Commissioner (ICO) interprets the definition of “personal data” in a similar way as in the current Data Protection Act (e.g. identifiability of the data subject has to be by the data controller) whereas the rest of Europe includes the impact of Recital 23 in the Regulation (i.e. identifiability of the data subject has to take account of all the means reasonably likely to be used …”either by the controller or by any other person to identify the individual directly or indirectly”).

Clearly the inclusion of “by any other person” means that the range of personal data subject to the Regulation would be narrower in the UK to the likely detriment to the position of UK data subjects.

Suppose further that the consistency mechanism is then applied, and the issue eventually reaches the EDPB for a decision. As an EDPB decision on interpretation is binding as far as the UK is concerned, the EDPB will use the Recitals to come to its conclusions (and as the Recital refer to identification “by any other person”, the ICO’s interpretation will be overturned).

Of course, there can be an appeal to the CJEU that the EDPB’s interpretation is wrong. However, in practice, the ICO will want to avoid being hauled through the coals to the EDPB and the way to do this is to incorporate the “by any other person” interpretation in his guidance on “personal data”.

A “long march through the institutions” by a data subject is therefore not needed; any long march, if required, is to the EDPB.

There is another reason why the Recitals are important as they contain important detail missing in the Article. For example, “when should you report a data loss?”.

Article 31 provides criteria when to report a data loss, but Recital 67 provides detailed examples of when actual data losses should be reported:

when a loss could “result in physical, material or moral damage to individuals such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorized reversal of pseudonymisation, damage to the reputation, loss of confidentiality of data protected by professional secrecy or any other economic or social disadvantage to the individual concerned”.

There is a final structural issue which is very important to note. When I was asked to contribute to the European Parliament’s discussions on the Regulation, I can remember a question from the floor of the Parliament on the lines of: Who should have the day to day responsibility for interpretation of data protection law in for example Codes of Conduct?

I replied by saying that such Codes could not carry much authority if they were produced by bodies representing data controllers or data subjects as they had vested interests to protect. I also added that Government was an enormous data controller (with the obvious conclusion following).

This left the Data Protection Authorities as the only organisations that would achieve an independent balance between the interests of data subjects and data controllers, subject to recourse to Courts in any case where a Code was inconsistent with the law.

This structure is not new; it was the formulation derived by the Lindop Committee back in 1978, when it too placed the responsibility on the Data Protection Authority to produce/approve Codes. So I am pleased to report on Data Protection Day, Lindop’s prescient recommendations have finally been implemented in the Regulation’s approach to Codes of Conduct.

In conclusion, however, don’t look at any Article without considering the related Recital; it is the Recital that is likely to carry some very important detail you need to consider.

Publicity

If you want more, am holding half day DP Regulation Workshop in London on March 2^nd

We also have a BCS DP Practitioner Qualification (starting in London on April 12 and in Edinburgh on April 25). BCS DP Foundation Certificate (starting in London on March 15-17). The day long PIA and Audit Courses are held on Feb 29 and March in London. Details of all our DP/FOI/CISMP courses in Leeds, London and Edinburgh are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com.

References

“C-131/12 Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González” can be downloaded from http://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&

Domestic CCTV and Directive 95/46/EC (European Court of Justice (ECJ) Judgment in Case C-212/13 Ryneš): http://amberhawk.typepad.com/amberhawk/2014/12/what-does-the-ecj-ryne%C5%A1-ruling-mean-for-the-domestic-purpose-exemption.html

Report on Data Protection: Chair Sir Norman Lindop (Cmnd 7341, December 1978)

Data Protection Regulation Update: precise implementation depends on exceptions and Recitals

This blog is a report of yesterday’s meeting in the House of Lords with the Minister (Baroness Neville-Rolfe), three ICO officials, four DCMS civil servants and thirty other stakeholders representing primarily the interests of data controllers. It concerned the Government’s implementation of the General Data Protection Regulation (GDPR).

First of all, it appears that the negotiated GDPR text has been accepted by the UK Government; the Minister referred to the remaining EU processes as being “formalities”. She said that there would be a Council of Ministers (Justice and Home Affairs) meeting in March and that a final nod of approval is expected then (if not earlier).

Given that EU lawyers will then have to crawl over the published text so the new law means the same in all EU jurisdictions, I expect the GDPR to appear in the Official Journal in June/July this year. The subsequent two-year implementation period means that commencement is in the second half of 2018.

The countdown clock is definitely ticking.

Minimising the burdens on data controllers

However, the devil for implementation is in the detail as Member States have flexibility to adapt more than 50 GDPR provisions. Thus, until these exceptions are expressed by UK national law, the precise GDPR implementation in the UK is up in the air. The Minister said that with respect to such flexibility, the UK would take advantage of “all possible legislative discretion” in order to minimise the burden on business.

Warming to this theme, the Minister stated that the UK Government had managed to remove several prescriptive elements from the draft Regulation text.

These included: a small business exception from the need to have a Data Protection Officer; the imposition of disproportionate financial penalties for transgressions; excessive personal data loss reporting to the ICO; the requirement for “explicit consent” of the data subject (it is now “unambiguous consent”) and parental consent being required for under 16 year olds (it is now left to Member States to decide the age of “data protection consent”).

However, there were a few Ministerial moans re provisions that were judged as still being burdensome; these included the so called “Right to be forgotten” and the prospect of lengthy “one stop shop” shenanigans.

Recital issue

Another problem relates to the Recitals which are intended to guide the European Court of Justice when the law is interpreted. Reading the GDPR, it is clear that a great deal of controversial stuff has been dumped into the Recitals by the negotiators.

For instance, subject access can be inferred to be free in Article 15(1b) but is explicitly free in Recital 47. So at the meeting I asked the simple question: “will the UK national law and ICO take account of the Recital 47 in the drafting? Will Subject Access be free?”.

No-one knew the definitive answer; but definitive answer there has to be. I am convinced that the European Data Protection Board (EDPB), whose job is to have a Euro-wide consistent interpretation of the GDPR, will say “free access”. In general, I suspect the deliberate placement of difficult issues into the Recitals is a device to boot difficulties into the long grass.

This is not an academic point. For instance, Recital 26 of Directive 95/46/EC states that if identification of an individual by a third party is fairly straightforward, then the data controller is processing personal data even if the data controller does not have the information that leads to identification of the data subject. This interpretation does not feature in the definition of "personal data" in the Data Protection Act 1988 nor in ICO Guidance on "personal data".

This is the same for the GDPR. The relevant Article 4 definitions say nothing about this third party identification point, but Recital 23 clearly does. In other words, it will be interesting to see whether the ICO Guidance and the UK Government law will reflect the Recitals or not.

If it is the latter, I suspect the EDPB will be making a number of judgments about the UK law. UK Politicians in future can then blame any subsequent hiatus on an unelected Euro body – which is par for the course with the current political discourse.

ICO actions

The ICO representatives at the meeting stressed that the GDPR implementation was now their “top priority” and that the ICO is aiming to start producing implementation documentation. The first document is to be published in time for the ICO’s Annual Conference Bash in Manchester on March 15th; this will be a “key issues” document. One key issue is that the ICO is expecting a 10 fold increase in data loss reports to it.

However, the ICO is keen to manage expectations as many guidance issues will be taken out of its hands (eventually). For example, if one looks a decade into the future and assume a functioning EDPB which is operating its consistency mechanism, then the ICO’s general guidance could easily be the EDPB euro-wide advice, translated into English.

With that in mind, the ICO reported that the Article 29 Working Party is morphing into a shadow EDPB ready to activate once the GDPR is commenced in 2018. This in turn means it will be prudent therefore to have regard for future WP29 reports, especially if the text relates to the interpretation of the Regulation.

Given that many large organisations need to make budgetary commitments to implement the GDPR in the year before commencement in 2018 (i.e. in the FY 2017/2018 at the latest), I expect the pressure will be on the ICO to have detailed GDPR guidance completed by the end of 2016. This is a very tight deadline given that we have no idea of the precise form of the legislation in the UK (e.g. which exemptions are going to apply).

There was a lot of discussion on implementation and it is clear that the Minister would prefer secondary legislation which would minimise Parliamentary Scrutiny. My own preference is for a draft Bill procedure that will minimise errors as it guarantees maximum involvement from data subjects as well as data controllers.

In addition, I don’t think it is proper to enact wide ranging national UK exemptions that impact on 60 million UK data subjects in secondary legislation where debate is minimal.

Such a new Data Protection Act could also include the new Data Protection Directive in the field of law enforcement and unify UK legislation in one place. This step would also be inclusive as all stakeholders have a chance to engage with the democratic process.

Darth Vader returns

I was quite surprised to learn that the Home Office is leading the implementation of the Data Protection Directive in the field of law enforcement. This is a backward step and returns to the dark ages of 1984 when the Home Office was responsible for data protection policy, and parked the subject in odds and ends units such as the “Home Office Liquor, Gambling and Data Protection Unit”.

My objection to the Home Office involvement is simple to express. The Department of State that is responsible for the agencies of the state that need to invade privacy as part of the day-job (e.g. Police, MI5 and Immigration) should not be deciding the level of legislative protection for data subjects from such invasion.

In short, putting the Home Office in charge is like putting Count Dracula in charge of legislation to determine who can access NHS blood banks. Where on earth is the Ministry of Justice on this?

Safe Harbor hopes

Finally, there were comments on Safe Harbor 2. The Civil Servants close to the negotiations were “hopeful” that agreement would be reached but the UK was powerless to do anything (other than to “encourage” agreement) as it was the European Commission who were doing the negotiating with the USA Administration.

The Minister stated that these negotiations “always go up to the wire” and pessimistic press briefings were par for the course. She also said that it was in the interest of both parties (the EU and USA) to come to agreement and that a “no agreement” result benefitted no one. That explained why she was “hopeful”.

Anyway if you want more, I am holding half day DP Regulation workshops in London on Jan 25th and March 2nd. See you there, perhaps?

Publicity

We have a BCS DP Practitioner Qualification (starting in London on Jan  26 and April 12, and in Edinburgh on April 25). BCS DP Foundation Certificate (starting in London on March 15-17). Details of all our DP/FOI/CISMP courses in Leeds, London and Edinburgh are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com.

 

Draft Investigatory Powers Bill ignores data protection when collecting bulk personal datasets

Tomorrow the Information Commissioner will give his views on the draft Investigatory Powers Bill (“the Bill”) to a cross party Parliamentary Committee examining the Bill.

The Bill proposes a power for the national security agencies to collect Bulk Personal Datasets (BPD) by a warrant signed by the Secretary of State which is subject to review by a Judicial Commissioner (the “double lock”). A Bulk Personal Dataset is any collection of personal data, where the “majority of the individuals are not, and are unlikely to become, of interest to the intelligence service” (Clause 150(1)(b) of the Bill). The Bill promises a Code of Practice with respect to the processing of Bulk Personal Datasets, but provides no detail as to what that Code contains.

The main questions addressed in this Blog are:

• should the comprehensive Section 28 national security exemption in the Data Protection Act continue when most personal data in a Bulk Personal Dataset concerns those who are not of interest to the national security agencies?
• if the Section 28 exemption is to continue, how good is the protection for individuals in the Bill?

This blog provides an overview of the weaknesses in the protection on offer, identifies how the absent privacy protections should be implemented and provides a link to my full written evidence to the Committee.

Article 8 of the Human Rights Act

The first structural problem is that there is no detailed explanation in the Bill as to how Article 8 of the Human Rights Act is to be satisfied given that the national security agencies will collect Bulk Personal Datasets when there is no prior suspicion with respect to the vast majority of data subjects.

The legal advice that the Government has relied on to substantiate Article 8 compliance should be published so that this issue can be debated properly; at the moment, compliance with Human Rights obligations has been asserted without evidence. The whole purpose of the draft Bill procedure is to facilitate a fully informed debate on the issues; failure to publish the legal advice on Article 8 undermines that debate.

This is especially important as there might be changes to Article 8 regime that arises from the Government’s review of the Human Rights Act (i.e. the Committee might assume Article 8 protection but these protective goalposts might be moved by the Government after this Bill becomes law).

A Commissioner who polices himself

The next structural problem is that the main protection for individuals lies with the post of “Investigatory Powers Commissioner” where the Commissioner is also one of the Judicial Commissioners who checks the warrants, signed by the Secretary of State, that authorise the collection of Bulk Personal Datasets.

This means that the Investigatory Powers Commissioner, in order to meet the obligation to “keep under review the acquisition, retention, use or disclosure of bulk personal datasets by an intelligence service” (clause 169(3)(a)) may be investigating the consequences of his own warrant authorisation decisions as a Judicial Commissioner.

The lack of separation between the roles of the Investigatory Powers Commissioner and the Judicial Commissioners could easily undermine public confidence in ALL the double lock protection in ALL aspects of the Bill’s powers. For instance, if in future, you have something akin to the Snowden revelations what would be the public response if the Investigatory Powers Commissioner were to investigate his own actions as a Judicial Commissioner and then subsequently exonerate himself?

In my view the Investigatory Powers Commissioner must not be conflicted in any investigation of the actions of any Judicial Commissioner; hence the need for separation.

Code of Practice on Bulk Personal Datasets

With respect the Bulk Personal Dataset provisions, paragraph 74 of the Bill’s preamble (which appears under a heading “What safeguards will there be?”) states that “A statutory Code of Practice will set out additional safeguards which apply to how the agencies access, store, destroy and disclose information contained in the BPDs”. The Bulk Personal Dataset Code of Practice is hence proffered as a safeguard in addition to the “double lock”.

However, in Schedule 6 which concerns Codes or Practice, there is no detail as to what should appear in this Code of Practice. In other words, the Bulk Personal Dataset Code is no more than a blank canvass to be completed by the Secretary of State once a future Bill becomes law.

One can also see that the fact that this Code of Practice is offered as a protection implies that the Government is anticipating the continuation of an unchanged Section 28 national security exemption in the Data Protection Act.

Before the Bill becomes law, this Code of Practice should be published as a draft.

Code of Practice on Communications Data

With respect to the processing of communications personal data (Part 3 of the Bill), there is another Code of Practice proposed. However, unlike the Bulk Personal Dataset Code, the Principles underpinning this Communications Data Code of Practice have been published.

The Principles underpinning the Communications Data Code of Practice are truly awful; they are likely to be the Principles underpinning the Bulk Personal Dataset Code. I say this because if these Principles were different, one would have different Principles applying to personal data depending on whether the personal data were Communications Data or not.

In addition, given that a database containing bulk Communications Data will also be Bulk Personal Dataset, there is no information in the draft Bill as to how these Codes interact with each other (e.g. which one prevails). In summary, the provisions relating to these two Codes of Practice possess the hallmarks of an idea drafted on the back of a fag packet.

The Principles (I call them “Ersatz Principles”) underpinning the Communications Data Code of Practice are as follows:

“(a) why, how and where the data is held,

(b) who may access the data on behalf of the authority,

(c) with whom, and under what conditions, the data may be disclosed,

(d) the processing of the data for purposes otherwise than in connection with the purposes for which it was obtained or retained,

(e) the processing of the data together with other data,

(f) the processes for determining how long the data should be held and for the destruction of the data” (in Schedule 6, paras 3(2)(a)-(2)(f)).

Note that these Ersatz Principles are phrased in a permissive way that allows the national security agencies to do things, unlike the Data Protection Principles which restricts things from happening.

For example, the Second Principle in the Data Protection Act requires that any personal data obtained for specific purposes should not be further used or disclosed for an “incompatible purpose” (i.e. the use of "not" and "incompatible" restricts the further purpose). By contrast, the Ersatz Principles (c) and (d) clearly allows for far wider uses/disclosure purposes by the national security agencies as the words “incompatible” and “not” are missing (i.e. permissive).

Indeed any consideration of the “purpose” of any disclosure, which is crucial to several Data Protection Principles including the Second Principle, is absent from Ersatz Principle (c).

The Fifth Principle requires that personal data “shall not be kept for longer than is necessary for that purpose or those purposes” (i.e. restrictive); the Ersatz Principle (f) clearly omits the word not (i.e. permissive) and has no consideration of the “purpose” of retention and is inferior for that reason.

If the intended function of these Ersatz Principles is to reassure the public, they will fall well short that objective. In my view (and this comment might be uncharitable), the Ersatz Principles are not designed to protect the data subject; they are there to facilitate further processing (perhaps function creep) on the part of the national security agencies.

In general, these Ersatz Principles should be replaced by the Data Protection Principles in both Codes of Practice.

Structured safeguards

A Section 28 national security certificate (if needed) is timeless. This is illustrated by the Investigatory Powers Tribunal case involving Privacy International in October last year ([2014] UKIPTrib 13_77-H; para 19) where barrister for GCHQ produced a certificate signed by David Blunkett thirteen years previously (in 2001) to show that key obligations in the Data Protection Act were exempt.

In the Bill, any national security exemption should be applied to the acquisition of bulk personal datasets or communications personal data when the agencies apply for each warrant (or on warrant renewal) from the Secretary of State and a Judicial Commissioner. This step will integrate data protection considerations as part of bulk personal data warrant considerations.

There is an opportunity for Parliament to review the whole Section 28 exemption scheme which commenced with the Data Protection Act 1984 at the heart of the Cold War. For example, the Investigatory Powers Commissioner could have a role in supervising all Section 28 certificates under the Data Protection Act and Parliament could consider whether each application of the Section 28 exemption should be covered by a certificate which needs to be renewed on a six monthly basis (i.e. same as the warrants under the Bill).

A review of Section 28 should be undertaken as a matter of urgency

The role of the Investigatory Powers Commissioner

Clause 169 of the Bill should provide for an independent Investigatory Powers Commissioner separate from the Judicial Commissioners. The Investigatory Powers Commissioner should possess the following powers and obligations to enforce the application of the Data Protection Principles to the national security function and where appropriate, protect the rights of data subjects.

1. The Investigatory Powers Commissioner should exercise powers in the Data Protection Act with respect to bulk personal datasets and communications personal data in the same way as the Information Commissioner does in relation more normal personal data. Where the Investigatory Powers Commissioner exercises powers, these can be appealed to the Investigatory Powers Tribunal (e.g. by the data controllers – the national security agencies).
2. The Investigatory Powers Commissioner under the current Bill has no role in handling or investigating complaints from data subjects. As the majority of data subjects are “not of interest” to the national security agencies, the Commissioner should be able to consider complaints directly from them.
3. Organisations that are required to provide bulk personal dataset and communications personal data should be able to raise a formal complaint to the Investigatory Powers Commissioner that the warrant or authorisation approved by a Judicial Commissioner provides for disproportionate data sharing (i.e. organisations should have the right to ask for a review of a warrant/authorisation procedure if they have concerns over proportionality). To avoid prejudicing an operation, disclosure should first occur; however, any disclosed personal data should be destroyed if the Investigatory Powers Commissioner arrives at the same conclusion as the complainant (subject to appeal to the Investigatory Powers Tribunal).
4. The Investigatory Powers Commissioner should have a role in assessing whether bulk personal dataset and communications personal data, once approved under the warranting arrangements, have proved to be useful. The Commissioner ought to be able to establish Key Performance Indicators that demonstrate effectiveness of obtaining such datasets (with the implication that if access is not worthwhile, the warrant can become void and the datasets destroyed).
5. All holdings of bulk personal dataset and communications datasets should be reported to the Investigatory Powers Commissioner as well as the Secretary of State; this should be on the face of the Bill. This step will ensure the Commissioner knows the extent of bulk dataset collections and will be able to comment on these in his annual report, and where necessary exercise powers with respect to such personal data
6. Data matching across any combination of bulk personal datasets and communications datasets should be considered in the context of any data sharing to other bodies of the product of data matching/profiling. However, intended or actual data sharing and data matching should be identified in an authorisation, or on a warrant, or on warrant renewal, or reported to the Investigatory Powers Commissioner when a warrant lapses. The intent here is to allow the Investigatory Powers Commissioner to compile a complete picture of such activities and be able to investigate any data sharing or data matching/profiling arrangements.
7. The Investigatory Powers Commissioner should ensure that there is a commitment, as far as possible, to transparency with respect to bulk dataset acquisition/communications personal data. Such transparency already occurs without harm to national security. For instance with respect to Police & national security access Congestion Charge ANPR data, the TfL website states:

“… we use to enforce our Road User Charging schemes, for the purposes of preventing and detecting crime…..….This was an expansion of a pre-existing arrangement with the MPS established in 2007, under which they were given access to TfL's ANPR data specifically for the purpose of using it to safeguard national security. This arrangement was approved by the Home Secretary, who signed a certificate confirming that TfL, and the MPS, are exempt from certain provisions of the Data Protection Act 1998 for that purpose.” (my emphasis; see references).

Concluding comments

Finally, there should be a “sunset clause” on this Part of the Bill as Parliament needs to review the legislation in the context of future technological developments that will result in further bulk personal datasets being created (e.g. Internet of things, smart metering, ANPR datasets).

The problems identified above explains why I have concluded that the Bill does not currently offer adequate protection for individuals with regards its bulk personal data provisions.

The same applies to the Codes of Practice that apply to the processing of personal data.

Publicity

We have a BCS DP Practitioner Qualification (starting in London on Jan  26),  BCS DP Foundation Certificate (starting in London on Jan 19). Also we have a DP Regulation workshop on in London on Jan 25. Details of all our DP/FOI/CISMP courses in Leeds, London and Edinburgh are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com.

References

Download my evidence to the Committee about the Bill here: Download BLOG_Submission Draft Investigatory Powers Bill Dec 2015 

The draft Bill can be accessed here: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/473770/Draft_Investigatory_Powers_Bill.pdf

TfL Fair Processing Notice re national security: https://tfl.gov.uk/corporate/privacy-and-cookies/road-user-charging