Hawktalk

UK membership of Council of Europe has implications for data protection after Brexit

There are whispers circulating in the aether that if PrivacyShield is deemed adequate for transfers of personal data from the European Union(EU) to the USA, then in a post-Brexit Britain, something akin to PrivacyShield can allow for adequate transfers of personal data to the UK. Such an “adequacy” determination would mean that the UK would not need to implement the General Data Protection Regulation (GDPR).

Indeed, if PrivacyShield is deemed adequate, why can’t the UK also replace the current Data Protection Act 1988 (DPA) with something as “flexible” as PrivacyShield; after all the DPA is based on a European Data Protection Directive 95/46/EC which will no longer apply in a post-Brexit Britain.

In other words, at one end of the “Brexit means Brexit” spectrum of meaning, there is a vision of a UK free of data protection law (just like the USA). This blog shows that this view, if adopted by a Brexit Government, presents major risks to the free flow of personal data into the UK irrespective of any ‘PrivacyShield’ type agreement that might cover the UK.

Indeed, to the contrary, being a Member of the Council of Europe is likely to require the UK amend the DPA closer to the GDPR. The blog assumes the UK is a Third Country outside the EU with no obligation to implement the GDPR.

Importance of the Council of Europe

Any step towards a UK without a data protection law would require the UK to withdraw from the Council of Europe and its European Convention of Human Rights (ECHR), something that Mrs. May has categorically stated will not happen under her watch as Prime Minister.

Being a Member State of the Council of Europe means that the “Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data” (Convention 108) applies to the UK. The Convention was drafted in 1981 to ensure that all processing of personal data was consistent with Article 8 of the ECHR (which concerns respect for private and family life etc).

Unlike the GDPR, the Convention applies to all data controllers, although there are some provisions that provide for exemptions that are linked to Article 8(2) of the ECHR (e.g. necessary and proportionate exemptions with respect to data controllers involved in policing, state security etc).

The universality of the Convention is specified in Article 3 which requires Member States of the Council of Europe to “undertake to apply this Convention to automated personal data files and automatic processing of personal data in the public and private sectors” (my emphasis). In other words, the UK is required to enact general data protection legislation based on the Convention’s provisions.

Thus if the UK adopted a PrivacyShield option (i.e. repealed the Data Protection Act 1998 and did not implement a replacement law), then the UK would be in breach of the Convention.

Article 12(2) of the Convention then states that “A Party shall not, for the sole purpose of the protection of privacy, prohibit or subject to special authorisation, transborder flows of personal data going to the territory of another Party” (i.e. if a Member State has enacted a data protection law that meets the Convention’s requirement, then transfers of personal data between signatories to the Convention cannot be halted on data protection grounds).

So if a future UK Government were to decide to leave the Council or Europe (or were to repeal the DPA without replacement), then transborder flows of personal data from a Member State that has signed the Convention can be prohibited on the grounds specified in Article 12(2). Notice that such a prohibition has nothing to do with the concept of adequacy in the GDPR or Directive 95/46/EC or even the content of any putative PrivacyShield type agreement.

Those steeped in the history of data protection will remember that it was to counter the threat of European States that had signed up to the Convention, imposing a blanket transfer prohibition on the UK, which pushed Mrs. Thatcher’s Government into introducing the Data Protection Act 1984.

Mrs. T. enacted a minimalist Act in order to prevent those “Johnny Foreigners” from using the Convention to stop the flows of personal data to the City of London (something which, in my view, will become a major risk if the UK pussyfoots around with the current data protection regime or fails to move the current DPA towards the requirements of GDPR).

In addition, many forget that Directive 95/46/EC was agreed to give effect to the Convention; this is made clear by Recital 11 to the Directive:

“(11) Whereas the principles of the protection of the rights and freedoms of individuals, notably the right to privacy, which are contained in this Directive, give substance to and amplify those contained in the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data”.

As stated previously, the European Commission has been threatening infraction proceedings as it considers the UK’s DPA a deficient implementation of the Directive; the UK Government has refused since 2005 to publish details (or inform Parliament) as to what these deficiencies are because their release would prejudice international relations (Not a joke! See comments about FS50577377 below).

It follows that if the Europeans see the DPA as not meeting the requirements of Directive 95/46/EC, it cannot be viewed as adequate in relation to the GDPR (see references). It also follows that the UK has arguably not enacted a data protection law that “gives substance” to the Convention, although this point has not been tested.

Could the DPA remain in some form?

Article 3 of the GDPR does not apply to a Controller established outside the EU if the processing activities do not involve:

1. “the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
2. the monitoring of their behaviour as far as their behaviour takes place within the Union”.

So, for example, the vast majority of public sector bodies in a post-Brexit UK would not offer goods and services to data subjects on the Continent, and many small private sector companies do not have a website whereby goods and services are offered to Europeans. For these types of data controllers, it appears that the current DPA could remain instead of the GDPR.

However, the Council of Europe Convention is being modernised from the text formalised in 1981. Given that most Member States of the Convention have also agreed the GDPR, it does not take a rocket scientist to see that any proposed change to the Convention text is likely to be in the direction of the GDPR text.

Thus, in the short-term the current DPA could apply to data controllers that do not provide services into the European Union but in the longer term, any change to the Convention will require the UK to modify the current DPA so it is closer to the GDPR. By contrast, all controllers who do see the European Union as a marketplace, the GDPR will have to be implemented.

In summary, the Council of Europe Convention provides another reason for saying that the GDPR or something very similar is likely to be implemented in the UK for all controllers.

It also follows that those who delay any preparatory work to plan for implementation of the GDPR are merely procrastinating unnecessarily.

Publicity

Amberhawk is holding all day GDPR Regulation Workshops in London , Leeds, Douglas (Isle of Man) and Edinburgh in the September and October; details on http://www.amberhawk.com/bookevents3.asp In these workshops I present a plan of action of what can be done now until the Government’s road-map on the GDPR is clarified.

We have BCS DP Foundation Courses Qualification (starting in London on September 27 and in Edinburgh on October 4. We have a PIA course in London on September 30)

Full details of courses from September (e.g. FOI and DP Practitioner courses) are on the Amberhawk home page: www.amberhawk.com

References

“Why does the European Commission think the UK’s Data Protection Act is a deficient implementation of Directive 95/46/EC?”. http://amberhawk.typepad.com/amberhawk/2013/02/question-answered-why-does-the-european-commission-think-the-uks-data-protection-act-is-a-deficient-implementation-of.html

Modernisation of the European Convention 108: http://www.coe.int/t/dghl/standardsetting/dataprotection/modernisation_en.asp

All my blog “GDPR and Brexit: what are the options?” is still relevant, except this blog includes Convention 108:  http://amberhawk.typepad.com/amberhawk/2016/06/gdpr-and-brexit-what-are-the-options.html

Why the UK introduced Data Protection Act 1984? see “Mrs Thatcher’s data protection legacy”: http://amberhawk.typepad.com/amberhawk/2013/04/mrs-thatchers-data-protection-legacy.html

My latest failure to obtain the details as to why the UK DPA is deficient; see FS50577377:  https://ico.org.uk/media/action-weve-taken/decision-notices/2016/1623824/fs_50577377.pdf

Comment on FS50577377

I found the Decision Notice FS50577377 (dated March 2016; three months after the UK had agreed the GDPR) a very poorly reasoned Decision that ignored the main findings of Tribunal Decision EA/2012/0110 (and much more as well) without justification.

However, the main problem (again) was a Decision Notice that considered my request at the time of the request which was made on July 2014. Prior to the issuing of the Decision Notice, I asked the ICO to contact the relevant public authority to check whether it still maintained its refusal after the considerable passage of time, so to avoid the “at the time of the request” problem. This was especially important as the UK had agreed the GDPR (whereas the Decision considered the GDPR as being in the early stage of negotiations).

The ICO surprisingly refused to make such contact, even though I see no provision in the FOI Act that stops him from doing so. I decided that there was no point in wasting another year going to the Tribunal as it would also consider my request “at the time of the request” thus ignoring Brexit vote and the UK’s adoption of the GDPR.

I think the ICO made a serious error in procedure by not asking the public authority for its views on my request when it is obviously key external factors, quoted in the Decision as justifying it, had changed fundamentally.

Suppose there is an EIR request about flood defences two years ago which was subject to an exemption; suppose at the beginning of the year a Tsunami had overwhelmed the flood defences. The ICO’s policy is to consider that EIR request at the time of the request (i.e. as if the Tsunami had not occurred) – completely bonkers if you ask me.

 

Data Protection and the bulk personal datasets covering political campaigns, Referendums, Electoral Rolls etc

Were you phoned up by the Leave or Remain Campaigns on your ex-directory telephone number during the Referendum Campaign (probably in breach of PECR)? I was.  If so, how did they my number?

How did one of the Campaigns, for example, know who was a Millwall fan so the caller from a Campaign gloated (sorry, I mean commiserated) with him or her over the 3-1 defeat by Barnsley at Wembley in May?

Intrigued, I have done a little digging; first in relation to the Referendum Campaigns and then secondly with respect to the UK political parties. This blog summarises what I have found, mainly based on a reading of many turgid Privacy Policies; in short, some important privacy issues need attention.

The items of personal data used

As far as I can see the various Referendum Campaigns (and most political parties during an election campaign) have access to the following personal data obtained from the data subject and from public sources.

• Electoral rolls from all UK constituencies (names and address nationality)
• Whether an individual voted in 2015 (General) and 2016 (Local) Elections
• Telephone numbers (including those ex-directory) and email addresses
• Siblings living at home (from electoral roll one presumes)
• Linkedin profile – gives photo, racial, profession/job, contact details, social classification (e.g. professional status) and of course a contacts list
• Facebook profile – this gives usually location, age, social class and hobbies (e.g. what football team they support) and of course a “friends” list
• Twitter activity
• I also assume there are also have fields (e.g. voting intentions) depending on what campaigners are told over the phone.

There are many other legitimate sources of public information (e.g. Land Registry, Companies House) and commercially available sources (e.g. Credit Reference Agencies provide a range of non-credit related data services) that may be used. The Lib Dems Privacy Policy states that it uses such sources of personal data, but these sources are not identified in the Privacy Policies of either Campaign or other political parties.

Ex-directory telephone numbers could also be obtained from third party list providers; this emerged at the Leveson Inquiry where journalists often used such list providers to obtain them. Lord Leveson (at line 9, page 17 of evidence 25th Jan 2012) states “It just concerns me that I simply do not know whether somebody has got hold of my personal data, and I don't know how I would ever find out, and therefore, if I never find out, I don't know to make the complaint” (to the ICO about the use of an ex-directory telephone number).

It is clear that the personal data above provides a detailed profile of the data subject’s social and political views, their economic and social status and points to other contacts who are then become a potential target. It is also easy to see how in future that such profiles have the potential to be assessed against a collection of Big Data to make predictions concerning the data subject.

Privacy Policies of the Campaigns

The Leave Campaign (as do most other political parties) use a platform called “NationBuilder” hosted in the USA. The way in which this platform works is well worth viewing to see how all the personal data identified above are inter-linked (see references for a link to a ten-minute demo).

It is also clear that NationBuilder could be a data controller. This arises from NationBuilder’s Terms and Conditions relating to “Law Enforcement and Third-Party Complaints” which states that the company will disclose customer data to others if “required to do so by law or subpoena”. I am not convinced that NationBuilder or its clients are aware of this rather fundamental data protection issue; NationBuilder is not a mere data processor.

The Leave Campaign’s Privacy Policy does not make it clear what items of personal data are collected on this platform; it infers all personal data are directly provided by the data subject to the Campaign when, as far as I can see, this is not the case (e.g. electoral roll personal data).

The statement in the Leave Campaign’s Privacy Policy “You can read more about that company and its features and policies at nationbuilder.com, and how the NationBuilder service interacts with and protects your information at “nationbuilder.com/privacy” and “nationbuilder.com/confidentiality” does not reassure. It does not make it clear which of these policies (i.e. the “privacy” one or “confidentiality” one applies to ordinary voters).

NationBuilder’s two thousand word Privacy Policy raises three concerns:

1. First it contains an obligation to read it. The Policy warns that “if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them”.
2. Second it states that “If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes” (this is a curious form of consent).
3. Finally, the Privacy Policy is dated 1st Feb 2014, and refers at the bottom of the webpage to the fact that Safe Harbor is used to protect the personal data (e.g. from the Leave Campaign) when they are transferred in the USA. In other words, the Privacy Policy is not up to date.

However, the Leave Campaign does state that “Vote Leave will authorise the complete destruction of its database, including the electoral register, as soon as reasonably practicable following polling day” and that “Data will not be retained or transferred to any successor organisation for any non-referendum purpose”.

By contrast, the Privacy Policy of the Britain Stronger in Europe Campaign (which also uses NationBuilder) is silent on the deletion of personal data after the Brexit vote, and does not refer to the transfer personal data to the USA (although transfers of personal data to Google in the USA are mentioned).

Other political parties

Given the paucity of relevant information on the Referendum Campaign websites, I decided to look at the UK main political parties; in summary, the lack of relevant information continues (although there is in my view, a great deal of unnecessary detail). The Political Parties, unlike the Referendum Campaigns, are likely to retain their bulk personal datasets from one election to the next so the data protection problems are exacerbated.

The Labour Party uses NationBuilder; its Privacy Policy “reassuringly” states: “We are compliant with the Safe Harbor scheme, which is recognised by the European Commission as providing adequate protection for the rights of data individuals in connection the transfer of their personal data to signatories of the scheme in the USA”. In other words, the demise of Safe Harbor has yet to register at Labour HQ.

From the website’s look and feel, I suspect the Conservative website uses NationBuilder; however, there is no statement in this regard or of any specific transfer to the USA.  The Privacy Policy merely states that a transfer outside the EEA “may happen if one of our service providers is located in a country outside of the EEA”.  UKIP uses NationBuilder, but says nothing about transfers outside the EEA.

I now suspect the dataset built on NationBuilder allowed the Labour Party to vet the political views of those applying for a vote in Leadership elections, and permitted Conservative Party workers to talk of databases of 20 million voters (“Facebook, Twitter – if it’s in the public domain it’s not off limits”, see references). If this suspicion is correct, it highlights the privacy concerns (and suggest the political parties have the capability of undertaking limited surveillance of its membership if/when the need arrives).

The Lib Dem website is hosted by NationBuilder fails to mention the USA at all (although in many other respects, the Privacy Policy provides a description of the harvesting of personal data from social media usage which is missing from other websites I looked at).  It is silent on the Safe Harbor position.

For completeness, I am not sure about the Greens or Scottish National Party (these sites do not have the NationBuilder look and feel).  However, I have to admit when I got to these Policies (they took some finding), a kind of Privacy Policy fatigue set in.

Concluding comments

My comments that relate to the Referendum Campaigns and most of the political parties are as follows:

• I am not convinced that data subject consent is explicit with respect to the processing of sensitive personal data (e.g. political opinions)
• That processing which is justified in the absence of consent should be identified as to the source of personal data and a description of the personal data collected in the absence of consent (especially if it relates to, or combined with, sensitive personal data).
• The status of NationBuilder needs resolution; it would be a data controller if NationBuilder discloses personal data to law enforcement and national security agencies without approval of its client. This is an important issue if all or most UK Electoral Rolls and bulk datasets on political views are processed in the USA. The Safe Harbor position also needs to be updated.
• I could find no detail concerning voter profiling (but I suspect it occurs) and no reference to a Privacy Impact Assessment concerning the processing of sensitive personal data. Such a PIA is a mandatory requirement of the GDPR.
• Privacy Policies need updating to describe what personal data are collected from sources other than the data subject; they should explain the harvesting of personal data via social networking, the extent of any profiling and what retention policies applies to the personal data. A few comments on the management of the NationBuilder platform would not go amiss.
• There is no simple mechanism whereby data subjects can object to the processing of personal data, request the deletion of personal data or reverse consent; one should be provided as a matter of urgency.

Finally, I would assume that the above problems are not unique to political parties (e.g. they could afflict supporters of a single issue campaign group or charity).

Publicity

To train your Data Protection Officer, we have a BCS DP Practitioner Qualification (starting in London on July 12). Full details of courses from September (e.g. FOI, Foundation DP courses) are on the Amberhawk home page: www.amberhawk.com

Amberhawk is holding all day GDPR Regulation Workshops in London , Leeds, Douglas (Isle of Man) and Edinburgh in the next three months; details on http://www.amberhawk.com/bookevents3.asp

References

Could the Conservative Party’s electoral database breach the Data Protection Act? http://amberhawk.typepad.com/amberhawk/2013/03/could-the-conservative-partys-electoral-database-breach-the-data-protection-act.html

Voting for Jeremy? Labour Party’s vetting ensures approved voters score low Marx. http://amberhawk.typepad.com/amberhawk/2015/08/voting-for-jeremy-labour-partys-vetting-ensures-approved-voters-score-low-marx.html

NationBuilders 10 minute demo: http://nationbuilder.com/for_campaigns  and Privacy Policy http://nationbuilder.com/privacy

Vote Leave Privacy Policy: http://www.voteleavetakecontrol.org/privacy; Vote Remain Privacy Policy: http://www.strongerin.co.uk/privacy_policy#oVlyU2UkELLe0HGt.97

Political Party privacy policies: http://www.libdems.org.uk/privacy ; http://www.labour.org.uk/pages/privacy ; https://www.conservatives.com/Privacy ; https://my.greenparty.org.uk/content/privacy-policy; http://www.snp.org/privacy_statement and http://www.ukip.org/privacy.