Search

Simple instructions on subscribing to the blog

« January 2016 | Main | March 2016 »

February 2016

22/02/2016

“Leave” or “Stay” in the Referendum? GDPR has to be implemented by the UK whatever the result.

This brief blog is to explain why, “in” or “out”, the UK has to implement the General Data Protection Regulation (GDPR). This is important given that some organisations might think that a “Leave” vote might change matters with respect to the GDPR compliance (especially as the Cabinet Minister responsible for GDPR implementation, John Whittingdale, is a prominent “outer”).

Obviously, if the vote in June is for “Stay” then the UK remains a Member of the European Union (EU) and the GDPR implementation has to be delivered. However, what would the position if the vote is for “Leave”?

The first point to make with a “Leave” vote is that the UK would become a State outside the European Economic Area (EEA) and therefore would have to offer an “adequate level of protection”. As is well known to blog readers (see references), the European Commission sees the UK Data Protection Act as a defective implementation of Directive 95/46/EC and has threatened infraction proceedings to make sure the Data Protection Act 1998 is brought into compliance with Directive standards.

How do I know this? Well consider my latest FOI request for information that explains why the European Commission thinks the UK Act is deficient implementation of Directive 95/46/EC and why the UK Government thinks it isn’t?

The request (which is awaiting a Decision Notice from the ICO – for nine months I hasten to add) was refused because legal action by the Commission concerning the UK DP Act was under active consideration. The Government told me that:

“… the Commission confirmed that the (infraction) proceedings remain live, that the particular information remains under consideration and therefore should not be released at this time.”

“The Commission has been clear in each of its separate responses (in February 2013, January 2014 and October 2014) to the Ministry of Justice that infraction proceedings in relation to the UK remains a live issue, and subject to ongoing review and consideration…”.

“The Commission has indicated that a decision is going to be taken in relation to the infraction proceedings which will in part be based on the information that you have requested. The proceedings therefore are actively under consideration by the Commission…”.

Can we now draw the one obvious conclusion? If the Commission’s infraction proceedings are being threatened because that the Commission is of the opinion that the UK Data Protection Act does not meet the requirements of the Directive, it must then follow the UK Act cannot be viewed as meeting the requirements of the GDPR.  The current DP Act is therefore at risk of offering an inadequate level of protection.

Now, I am going to ask you some simple questions.  If the UK votes to leave the European Union….

  • Would German bankers in Frankfurt wanting supplant the City of London argue that the personal data cannot be transferred to the UK on inadequacy grounds?
  • If the consequential Euro-divorce becomes messy, could the European Commission use the fact that the Data Protection Act 1998 is inadequate level of protection as a negotiating tactic?
  • Could the European Parliament argue that UK national security access to personal data remains as expansive as that in the USA and therefore the UK is not a safe place to transfer personal data concerning Europeans (see last blog)?

Answer to all questions is, in my opinion, “yes”.

So how does the UK defuse the risk and offer an “adequate level of protection”? Why it implements the essential parts of the GDPR, even if the UK votes to leave the European Union. To do otherwise, could threaten the transfers of personal data into the UK from the EU

Of course, the Government might argue that the Data Protection Act 1998 is perfectly sound or the Commission might be not telling the truth in respect to its "active consideration"  of infraction proceedings. However, that would be wholly inconsistent with the reasons they gave to me for not releasing the infraction information that is the subject of my FOI request.

The UK Government and European Commission cannot both be telling me porkies? Surely not?

Publicity

We also have a BCS DP Practitioner Qualification (starting in London on April 12 and in Edinburgh on April 25).  BCS DP Foundation Certificate (starting in London on March 15-17).  The day long PIA and Audit Courses are held on Feb 29 and March in London.

We hold GDPR Regulation Workshops in London (March 2), Edinburgh (May 20) and Douglas (IoM; May 5); details of all our DP/FOI/CISMP courses in Leeds, London and Edinburgh are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com.

References

Blog of 24/10/2014: “European Commission raises infraction threat to UK on failing to implement Directive 95/46/EC properly via the Data Protection Act”; http://amberhawk.typepad.com/amberhawk/2014/10/european-commission-raises-infraction-threat-to-uk-on-failing-to-implement-directive-9546ec-properly.html

List of UK deficiencies in:  “Why does the European Commission think the UK’s Data Protection Act is a deficient implementation of Directive 95/46/EC?” http://amberhawk.typepad.com/amberhawk/2013/02/question-answered-why-does-the-european-commission-think-the-uks-data-protection-act-is-a-deficient-implementation-of.html

Posted at 10:54 AM in Data Protection, News, Other Information Law | | Comments (1)

11/02/2016

Put privacy first! Parliamentary report calls for national security agencies to apply Data Protection Principles

For a long time, I have been arguing that the national security agencies should apply the data protection principles to their processing of personal data subject, if necessary, to exemptions from subject access and fair processing requirements. Today’s report from the Joint Committee on the Draft Investigatory Powers Bill (DIP) supports that position.

In summary, if the criminal intelligence processed by the police relating to serious crime can be subject to most data protection requirements without mishap (since the 1984 Act), then so can the intelligence held by the national security agencies. It follows that these agencies do not need the comprehensive exemption in Section 28 of the Data Protection Act; all they need is an exemption that is more targeted (e.g. similar to that available to the Police in Section 29 which is based on a test of “prejudice” and “necessity”).

The two Parliamentary Reports on the Government’s Draft Investigatory Powers Bill published this week recommend that general data protection/privacy requirements are integral to maintaining public trust in the post Snowden era. Both raise concerns that the protection of privacy is inadequate.

Intelligence and Security Committee (ISC) Report

The first report published earlier this week is from the Intelligence and Security Committee which has Parliamentary oversight of the national security agencies; it states that the Government has drafted legislation that is back to front.

The Report recommends that a revised DIP Bill should specify the primacy of individual privacy before carving out national security exemptions from these privacy obligations.

Instead the Committee concludes that the draft DIP Bill has identified the requirements of the national security agencies first, before considering what privacy protection should be attached to each operational requirement.

This back to front approach to privacy requirements can be seen from the following quotes from the ISC Report (some of which are quite damning of the Government’s imbalanced approach to the subject):

  • “It is the view of this Committee that privacy protections should form the backbone of the draft legislation, around which the exceptional powers are then built”.
  • “Privacy considerations must form an integral part of the legislation, not merely an add-on.”
  • “It is surprising that the protection of people’s privacy – which is enshrined in other legislation – does not feature more prominently”.
  • “Overall, the privacy protections are inconsistent and in our view need strengthening.”
  • “One might have expected an overarching statement at the forefront of the legislation, or to find universal privacy protections applied consistently throughout the draft Bill. However, instead, the reader has to search and analyse each investigatory power individually to understand the privacy protections which may apply”.
  • “The Committee considers that the acquisition, retention and examination of any Bulk Personal Dataset is sufficiently intrusive that it should require a specific warrant. We therefore recommend that Class Bulk Personal Dataset warrants are removed from the new legislation” (i.e the proposal that the national security agencies to get a host of Bulk Personal Datasets in one warrant swoop should be removed).
  • “The new legislation should include a single additional Part that addresses privacy safeguards and clearly sets out universal privacy protections which apply across the full range of investigatory powers”.

Note that applying the Data Protection Act to the national security function, subject to a suitable exemption does all what the ISC want. At the moment, the section 28 exemption can exclude all of the Principles, rights and enforcement powers.

The Joint Committee Report

The second report (published today) is from the Joint Committee on the Draft Investigatory Powers Bill; members of the Committee are drawn from both Houses of Parliament.

Here the Committee agreed with specific data protection concerns I raised in my written evidence with respect to Bulk Personal Datasets (BPDs). Namely: the absence of data protection requirements, the lack of safeguards from misuse of powers, and the lack of detail with respect to why invasive powers were needed.

In further detail, the Joint Committee’s recommendations with respect to BPDs are:

  • “We urge the Investigatory Powers Commissioner to scrutinise the automated analysis of bulk datasets conducted by the security and intelligence agencies to ensure that they are conducted appropriately and proportionately and with regard to privacy and data protection requirements”. (I argued that the Commissioner should consider these data protection issues when a national security agency applied for a bulk personal dataset warrant).
  • “We recommend that the Home Office should produce its case for bulk personal datasets (BPDs) when the Bill is published”. (I argued that the case was not made).
  • “We recommend that the Government should publish a fuller justification for each of the bulk powers alongside the Bill.” (I argued that the case had not been made).
  • “The safeguards for BPDs are not sufficiently explained in the Bill.” (I said there was no explanation at all!).
  • “We further recommend that the examples of the value of the bulk powers provided should be assessed by an independent body, such as the Intelligence and Security Committee or the Interception of Communications Commissioner” (I said the Commissioner should establish Key Performance Indicators to assess whether each exercise of BPD obtaining powers had worked in practice).
  • “While the Committee acknowledges the case made by the Home Office for not providing detailed information as to the contents of bulk personal datasets (BPDs), the lack of that detail makes it hard for Parliament to give the power sufficient scrutiny. (I said that scrutiny was impossible if no detail is provided!).
  • “We also agree that existing powers for acquiring BPDs should be consolidated in this Bill and that any other powers for the security and intelligence agencies to acquire BPDs should be repealed”. (Blob-on! No more powers such as “Section 94 of Telecommunications Act 1984” lurking around for decades; see references for a shocking history lesson!).
  • “We believe that a draft Code of Practice on BPDs should be published when the Bill is introduced to provide greater clarity on the handling of BPDs, not least in relation to the provisions of the Data Protection Act 1998. To the greatest extent possible, the safeguards that appear in the Data Protection Act 1988 should also apply to personal data held by the security and intelligence agencies”.

The last recommendation is immensely satisfying; for the first time compliance by the national security agencies with the Data Protection Act is on the Parliamentary Agenda. My previous blogs (see references) will guide the reader as to why this step is essential.

The Committee did not follow me all the way with respect to the role of the Investigatory Powers Commissioner, but I am satisfied that a first step down the a very long path has been taken. At the very least a public debate about data protection and national security can commence.

Publicity

I am holding half day DP Regulation Workshops in London on March 2nd

We also have a BCS DP Practitioner Qualification (starting in London on April 12 and in Edinburgh on April 25).  BCS DP Foundation Certificate (starting in London on March 15-17).  The day long PIA and Audit Courses are held on Feb 29 and March in London.  Details of all our DP/FOI/CISMP courses in Leeds, London and Edinburgh are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com.

References

Parliamentary Reports:

Blogs relating to Data Protection and the National Security function:

Posted at 09:29 AM in Data Protection, News, Other Information Law | | Comments (0)

05/02/2016

Politicians agree a Privacy Shield as the Working Party of Data Protection Commissioners display a six pack

In this blog, I make a few comments about “Safe Harbor 2” (or the “Privacy Shield” to use the flash marketing term for the recently announced agreement).  In summary, there is no published evidence that the Privacy Shield actually provides an adequate level of protection: so contrary to all those optimistic news reports, can you please “hold your horses” if you are anticipating transfers to the USA under Privacy Shield.

Also, be aware also that some serious contingency planning might be needed if Europe’s Data Protection Commissioners judge that the Privacy Shield does not provide an adequate level of protection.

The importance of Schrems

The first thing to understand is that the European Commission, which is trying to finalise a replacement deal for Safe Harbor, is not in the driving seat; neither are the USA negotiators.

This is because the most important part of the Court of Justice of the European Union (CJEU) in Schrems was not that Safe Harbor agreement was made void; it was that Data Protection Authorities can assess whether any “transfer” to a territory outside the European Economic Area (EEA) provides an adequate level of protection.

In its judgement, the CJEU said that the Data Protection Authority’s ability to independently assess adequacy applied universally. It said the existence of an international agreement such as Safe Harbor that claimed adequacy:

 “….does not prevent a supervisory authority of a Member State, within the meaning of Article 28 of that directive as amended, from examining the claim of a person concerning the protection of his rights and freedoms in regard to the processing of personal data relating to him which has been transferred from a Member State to that third country when that person contends that the law and practices in force in the third country do not ensure an adequate level of protection”.

Note the implication of this. If a Data Protection Authority found that the level of protection was inadequate, then it could act to protect the interests of data subjects (e.g. by banning transfers to that territory) despite any political agreement asserting adequacy.

As will be seen, this independence generalises to any transfer to any non-EEA country for any purpose and any agreement (e.g. transfers subject to BCRs or European Commission Standard Contract Terms).

This issue appears to have escaped notice by the USA negotiators who almost appear to consider Privacy Shield to be a done deal. Secretary of Commerce, Penny Pritzker, for instance delivered the following statement on the completion of the EU- U.S. Privacy Shield:

“This historic agreement is a major achievement for privacy and for businesses on both sides of the Atlantic. It provides certainty that will help grow the digital economy by ensuring that thousands of European and American businesses and millions of individuals can continue to access services online.

Beyond being essential to transatlantic commerce, the EU-U.S Privacy Shield also underscores the strength of the U.S.-EU relationship. It demonstrates our commitment to working together as leaders in the global economy, promoting our shared values, and bridging our differences where they exist”.

“Shields down!”: back to Earth with a bump

Anyway, back to reality and the Article 29 Working Party of Data Protection Authorities (WP29). In its press statement on Privacy Shield, it is clear that the WP29 has not accepted any fait accompli.

Its press release says that WP29 need “four essential guarantees” before the USA is deemed as offering an adequate level of protection.  These guarantees, which relate to access by the national security agencies in the USA, to personal data transferred to the USA, are:

“A. Processing should be based on clear, precise and accessible rules: this means that anyone who is reasonably informed should be able to foresee what might happen with her/his data where they are transferred;

B. Necessity and proportionality with regard to the legitimate objectives pursued need to be demonstrated: a balance needs to be found between the objective for which the data are collected and accessed (generally national security) and the rights of the individual;

C. An independent oversight mechanism should exist, that is both effective and impartial: this can either be a judge or another independent body, as long as it has sufficient ability to carry out the necessary checks; (CP comment: can we have an effective independent oversight mechanism in the UK as well please?).

D. Effective remedies need to be available to the individual: anyone should have the right to defend her/his rights before an independent body. The WP29 stresses that these four guarantees should be respected whenever personal data are transferred from the EU to the United States and to other third countries, as well as by EU Member States.” (My emphasis to show WP29 considers Schrems is NOT limited to transfers to the USA).

The WP29 press statement then states it needs to see the detail of the agreement (e.g. WP29 “will examine whether the (Privacy Shield) provisions respect the powers of Data Protection Authorities as laid down in Article 28 of Directive 95/46/EC”).  Roughly translated into English, this means that “WP29 wants to be satisfied that there is a valid mechanism to sort out any data protection issue before it approves the Privacy Shield as adequate”.

Accordingly, “the WP29 calls on the Commission to communicate all documents pertaining to the new arrangement by the end of February”. This can be translated as:  “WP29 does not trust the politicians to get the detail right; WP29 gives you four weeks to provide the details”.

In the meantime “EU Data Protection Authorities will therefore deal with related cases and complaints on a case-by-case basis” (Translation: a Data Protection Authority “reserves the right to enforce its national data protection legislation where transfers do not use the alternatives to Safe Harbor”).

There is also a sting in the WP29 tail arising from another aspect of the Schrems decision (see references).  In summary, in Schrems, the CJEU criticised the absence of any “due process” when the USA’s national security agencies gained access to personal data in Safe Harbor.

This criticism applies to any transfer of personal data to the USA, a fact that has been picked up by the WP29.  Its press statement states that once the WP29 has assessed Privacy Shield documents “the WP29 will consider whether transfer mechanisms, such as Standard Contractual Clauses and Binding Corporate Rules, can still be used for personal data transfers to the U.S”.(my emphasis).

This emphasised comment explains the headline about WP29’s new muscle on display. Prior to Schrems, WP29 documentations were largely left unread except by the cognoscenti; however, post Schrems (and the morphing of WP29 into a European Data Protection Board of the Regulation), such documentation is a must read.

It can be seen that the implied threat to transfers is very clear; if Privacy Shield documents do not pass muster in relation to adequacy, then other arrangements for transfers to the USA (Contract Clauses, BCRs) could be in trouble.

Of course, there is a long way to go before any decision like this is made; WP29 showing that it has muscle is not the same as WP29 using that muscle.

However, it explains why I said at the beginning of this blog, that some contingency thinking (if needed) might not go amiss.

Publicity

I am holding half day DP Regulation Workshops in London on March 2nd

We also have a BCS DP Practitioner Qualification (starting in London on April 12 and in Edinburgh on April 25).  BCS DP Foundation Certificate (starting in London on March 15-17).  The day long PIA and Audit Courses are held on Feb 29 and March in London.  Details of all our DP/FOI/CISMP courses in Leeds, London and Edinburgh are accessible by clicking the relevant buttons on the Amberhawk home page: www.amberhawk.com.

References

Understanding Safe Harbor, Schrems v Facebook in less than 300 words: http://amberhawk.typepad.com/amberhawk/2015/10/understanding-safe-harbor-schrems-v-facebook-in-less-than-300-words.html

CJEU Case C‑362/14; Maximillian Schrems v Data Protection Commissioner; 6 October 2015

Secretary of Commerce Penny Pritzker press statement: https://www.commerce.gov/news/press-releases/2016/02/statement-us-secretary-commerce-penny-pritzker-eu-us-privacy-shield

WP29 views: http://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/2016/20160203_statement_consequences_schrems_judgement_en.pdf

Posted at 09:01 AM in Data Protection, News | | Comments (0)

Archives

Categories

All materials on this website are the copyright of Amberhawk Training Limited, except where otherwise stated. If you want to use the information on the blog, all we ask is that you do so in an attributable manner.