Hawktalk

Digital Economy Bill promises a Statutory Code of Practice on Direct Marketing covering DPA and PECR

Clause 77 of the Digital Economy Bill will establish a statutory Direct Marketing Code of Practice that has the same status as the Data Sharing Code of Practice. This Code should finally put to bed all the controversial issues with respect to Direct Marketing (e.g. whether there should be “opt-in” or “opt-out”), the meaning of “consent” in the context of marketing and when it is possible to engage in Direct Marketing without the consent of the data subject.

The Code, by law, will cover practical guidance in relation to the carrying out of direct marketing in accordance with the requirements of the Data Protection Act (DPA) and the Privacy and Electronic Communications Regulations (PECR). A reference to “good practice” in Clause 77 means that guidance on direct marketing is not limited to compliance with the PECR and DPA.

I also expect that the timing associated with the Bill (when it becomes law; say in the middle of next year) and the time spent consulting on a draft Code (say 3 months) will dictate that the final text will have to contain guidance on marketing and the impact of the General Data Protection Regulation (GDPR).

The ICO is obliged to consult the Secretary of State, trade associations, data subjects and NGOs who represent the interests of data subjects. The Secretary of State must lay the Code before Parliament and either House of Parliament can vote against the Code and if this happens the Code falls. I cannot see that happening without Government organising its payroll vote against the Code.

So what do I hope will be the content of the statutory Direct Marketing Code.

First, a Code that does not conflate “consent” with “fair processing” when considering data protection. If, for example, there is an “opt-out” marketing box in an obscure location or in the small print, this is not an example of unfair processing of personal data; it is an example of processing that does not have properly formed data subject consent. As a result, the processing is not associated with a Schedule 2 condition and therefore should cease.

For far too long, most ICO Guidance over relies on fair processing. For an extreme example, consider the Caerphilly County Borough Council Undertaking (see references) which related to covert surveillance of an employee suspected of fraudulently claiming to be sick.

The ICO concluded that in this case “the employer must be satisfied that there are grounds for suspecting criminal activity or equivalent malpractice”, and that as the data controller did not have sufficient evidence to warrant the authorisation of covert surveillance on an employee and as a result the covert surveillance of the employee’s activities was “unfair”. Urrrggggghhhh!!! .

I contend the processing of personal data was either unlawful or had no Schedule 2 grounds. The ICO’s focus on fairness leaves the misleading impression that the Caerphilly’s surveillance was somehow legitimate or lawful or both – when it isn’t.

In general, Schedule 2 raises the question: “can a controller process personal data?” and requires a legal basis ground for the processing. If a ground exists, next question is “how does the controller processes personal data? Answer is via the Data Protection Principles (e.g. securely, fairly, accurately etc etc). If there are no grounds associated with the processing, there can be no processing and the question of compliance with the Principles (e.g. fairness) does not arise.

Second, the Code should identify what constitutes properly formed “consent” and anticipate the GDPR requirements for consent in the marketing context. For example: what records should be kept in relation to consent; refreshing consent; what happens if consent is withdrawn and the operation of the objection to marketing (under the GDPR, current DPA and PECR). Recital 32 of the GDPR states that pre-ticked boxes do not constitute consent, so ICO Guidance on the importance of this and other relevant Recitals would be welcome.

I should add that I am not a fan of the phrase “opt-in model of consent” as used in recent Undertakings (e.g. British Red Cross; see references) as it implies “opt-out” consent is somehow different (which it isn’t if you follow my recent blog; see references). I should add that I am quite comfortable with a properly formed “opt-out” consent for marketing, especially as the right to withdraw consent/object to marketing is strengthened by the GDPR.

Third, as the right to be informed (and the right of access) includes the prospect of identifying Recipients of the personal data, the Code should cover the identification of those to whom personal data have been disclosed for a marketing purpose. This would allow data subjects to follow through with their marketing objections to the controller with objections to associated Recipients and so on.

It is interesting to note that this would resolve the query raised by Lord Justice Leveson in his phone hacking inquiry (transcript 26/1/2012, p17, morning session). Leveson discovered that Third Party list providers are a major source of ex-directory telephone numbers (e.g. usually provided by members of a family when they sign-up to something and miss out an obscurely position “opt-out”). As a result, he explained:

“And it just concerns me that I simply do not know whether somebody has got hold of my personal data, and I don't know how I would ever find out, and therefore, if I never find out, I don't know to make the complaint”.

As far as I can see, the GDPR fixes this problem; Lord Leveson should be able to find out. In this context, it is interesting to note that in the Optical Express Tribunal determined that the identity of Third Parties marketeers had to be identified to data subjects (see references).

Fourth, there has to be clarity of when personal data can be processed for marketing that is in the legitimate interests of the data controller which first surfaced in British Gas Trading Limited -v- Data Protection Registrar. As is well known (to delegates to my GDPR workshops), Recital 47 states that processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest – so when does this occur. Guidance please.

Finally, there has to be clarity as respects to all aspects of PECR and profiling for a marketing purpose.

The Code’s objective will be to ensure that the Code will be taken into account when a Court or Tribunal are considering a case (i.e. non-compliance with the Code can potentially increase any penalty). It anticipates the likely status of Codes of Conduct as specified in the GDPR.

In summary, a draft Marketing Code of Practice should surface towards the end of next year when the Digital Economy Bill becomes an Act. At this time, the UK approach to the GDPR should be clear: the options appear to be between a hard Brexit, a soft Brexit or, at the moment, a dog’s Brexit.

I therefore expect that the Code will become live at about the same time the GDPR comes into effect. However, one thing will be clear; being compliant with the Code will be a comfortable place to be.

So watch out for it and then engage with the Commissioner’s consultation.

Publicity

Forthcoming  Amberhawk's courses in November/December:

• GDPR Workshops: 10 November (Douglas IoM); 7 December (London)
• DP Practitioner Course: Starts 14 November (BCS syllabus; London)
• CISMP Course: Starts 28 November (BCS syllabus; London)

References

Marketing by opt-in, opt-out, consent or legitimate interest? Consider your ABC: http://amberhawk.typepad.com/amberhawk/2016/05/marketing-by-opt-in-opt-out-consent-or-legitimate-interest-consider-your-abc.html

Optical express enforcement: https://ico.org.uk/media/action-weve-taken/enforcement-notices/1042983/optical-express-enforcement-notice.pdf

Caerphilly undertaking (ENF0522453): https://ico.org.uk/media/action-weve-taken/undertakings/1560555/caerphilly-cbc-undertaking.pdf

Red Cross Undertaking: https://ico.org.uk/media/action-weve-taken/undertakings/1623625/british-red-cross-undertaking-20160226.pdf

Should Computer Misuse Act offences committed in the UK be prosecuted in the UK?

At this week’s Conservative Party Conference there will be a lot of talk about making Brexit happen, putting the “Great” back in Britain, and taking back control of our laws. However, there is one law where the Government is reluctant to express much enthusiasm for sovereignty at all; it is the Computer Misuse Act (CMA) 1990.

Indeed, it has allowed UK officials to defer to the interests of a foreign state (without a murmur) even though serious custodial offences are likely to have been committed in the UK.

In 1990, I can remember that Tam Dalyell MP sought confirmation that the offences in the Computer Misuse Bill (as it then was in 1990) could be tried in the UK, even though the unauthorised access was to a computer outside the UK from someone in the UK. The answer was “yes”.

Lauri Love is a 31 year-old hacker on the autistic spectrum; he is accused of doing some totally stupid/misguided things and has allegedly hacked into all sorts of places that should not have been hacked. He is accused of obtaining information including personal data from computers belonging to various governmental agencies, the US Army, NASA, the Federal Reserve and the Environmental Protection Agency.

Unsurprisingly these USA bodies that have been hacked are hopping mad. The National Crime Agency (NCA) arrested Mr. Love in 2013 for CMA offences but then decided not to prosecute, deferring instead to USA prosecutors. On 15 July 2015, Mr. Love was arrested by UK officials at the behest of the US government and the well-publicised extradition proceedings commenced.

Section 1 of Computer Misuse Act (CMA) 1990 states that an offence is committed if an individual “causes a computer to perform any function with intent to secure access to any program or data held in any computer” when that individual knows the access is unauthorised.

Section 2 of the CMA also states that the offence becomes far more serious if unauthorised access in Section 1 has been occurred with intent to commit or facilitate commission of further offences (e.g. an offence connected with terrorism, fraud etc).

The maximum penalty for a Section 2 CMA offence can be really serious. For instance:

• In R v Adam Penny at Kingston Crown Court (12/9/2016) a hacker accessed a gold bullion firm’s website to obtain names, addresses and tracking numbers of customers to enable associates to intercept the gold deliveries. He was sentenced to five years and four months in jail.
• In R v Nazariy Markuta at Southwark Crown Court (22/9/2016) a member of a hacking group obtained 300k usernames and passwords from Yahoo and offered them for sale. He was jailed for two years after guilty pleas to three offences under CMA 1990 (see references).

In other words, if Mr. Love were to be found guilty of a Section 2 offence by the UK Courts, he faces a significant custodial sentence as both the CMA offence plus the aggravating offence are taken into account when sentencing occurs. The judgment associated with the extradition proceedings confirms that a Section 2 offence could have been committed by Mr. Love (see references).

It is claimed that Mr. Love faces a 99 year prison sentence, something that equates hacking with murder and rape. Now I don’t believe that applies in practice, but I do believe that a sentence of decade or more is possible.

In the USA, there is something called plea-bargaining; it means that if the offender pleads guilty, the custodial sentence is reduced by agreement and there is no trial. So suppose you were in Mr. Love’s position, and you are offered a plea-bargained 8 year prison sentence. You are also told that the prosecutors would go for 20 years sentence if you did not accept. What would you do?

In addition, any custodial sentence occurs in the USA and not in the UK; thousands of miles away from the support that those on the autistic spectrum need.

The part of case that has not been tested relates to the security surrounding the websites of the hacked organisations. Since personal data were accessed, if this happened in the UK, any poor website security could attract enforcement action by the Information Commissioner. For instance:

• Staysure.co.uk Limited (an online holiday insurance company) was fined £175,000 by the ICO after IT security failings let hackers access customer records (e.g. 100,000 live credit card details, medical details, credit card CVV numbers despite industry rules that they should not be stored).
• Worldview Limited (a hotel booking website) was fined £7,500 (reduced from £75,000 as the company was in financial trouble) following a failure to undertake patches that removed a vulnerability on the company’s site (attackers accessed the full payment card details of 3,814 customers).

So if the USA had enacted a European Data Protection law, the hacked organisations could have been vulnerable to enforcement action if their website security was at a level that left personal data vulnerable to hacking attacks. That does not negate the fact that Mr. Love committed a hacking offence, but clearly if website security was weak, then this allowed Mr. Love’s attacks to succeed.

In the UK, a prosecution under the Computer Misuse Act would likely to include consideration of the security procedures implemented by the hacked organisation because of the word “unauthorised” in the CMA offence, means that “authorisation” procedures are tested. However, if there is a plea bargain in the USA, then any security inadequacies are not even raised.

In other words, there is an uncomfortable suspicion that public officials in the UK are agreeing to the extradition of Mr. Love in order to invoke its plea bargaining procedure and avoid any embarrassing exposure of an inadequate level of security procedures adopted by USA public bodies. Another possibility is that UK authorities do not want to incur the costs of an investigation and is content for US prosecutors to “take the strain” on costs.

Whatever the reason that underpinned the decision not to prosecute under CMA, it was taken by UK officials at an early stage in the investigation. Why was such a decision taken?   Was that decision scrutinised by managers? What level of official is responsible for that decision? The answer to these questions are needed to reassure the public that the decision to extradite is the correct one.

Back in 1990, the UK Parliament voted for the CMA offences to have global effect so that a hacking offence committed in the UK could be prosecuted in the UK. So when Conservatives say this week they are “taking back control of UK laws” remember such statements do not apply to a defendant on the autistic spectrum facing a long time in jail in the USA.

References

For a really valuable list of CMA offences (including offences which could have been undertaken by S.55 of the DPA) can be found on: http://www.computerevidence.co.uk/Cases/CMA.htm

Extradition proceedings which identified CMA offences were committed in the UK (see para 15): https://freelauri.com/wp-content/uploads/2016/09/usa-v-love-judgment.pdfc

See also “What lies beneath the extradition of hacker Gary McKinnon to the USA” on http://amberhawk.typepad.com/amberhawk/2009/10/what-lies-beneath-the-extradition-of-hacker-gary-mckinnon-to-the-usa.html

Publicity

Forthcoming  Amberhawk courses in October:

• GDPR Workshops: 7 October (Edinburgh) and 7 December (London)
• FOI Practitioner Course: Starts 18 October (London)
• DP Practitioner Course: Starts 14 November (BCS syllabus; London)
• CISMP Course: Starts 28 November (BCS syllabus; London)