Hawktalk

Digital Economy Bill data sharing provisions undermine Parliamentary scrutiny and create privacy risks

As promised in last Friday’s blog, an explanation why the data sharing provisions in Part V of the Digital Economy Bill (the “Bill”) should not be supported. The Bill completes its Commons stages today with hardly any detailed scrutiny of its data sharing provisions.

In privacy terms, this blog shows that the data sharing proposals demonstrate:

(a) a lack of understanding of how the Data Protection Act (DPA) works;

(b) a failure to explain how the interference inherent in data sharing complies with Article 8 of the Human Rights Act (HRA);

(c) a disregard for the views of the Information Commissioner (ICO).

However, these three are not my main concerns over this Bill. In my view the data sharing provisions in this Bill (e.g. data sharing for efficient public sector service delivery, for research and statistics, for debt recovery and for fraud):

(d) combined with the flexibility for Ministers to add to the list of data sharing objectives, provides a gateway that could allow future Governments to share personal data across the public sector by Ministerial edict;

(e) could replace many existing data sharing legislative provisions and negate the need for data sharing provisions in future legislation.

In my view, the Bill will diminish Parliament’s role in scrutinising future legislation which requires an element of data sharing. A future Government will not bother Parliament with data sharing provisions if generous data sharing provisions have already been enacted. This is especially concerning with respect to the provisions in the Bill that relate to debt and fraud.

This means any future Government can increasingly rely on the exercise of Ministerial powers via Statutory Instrument to push through any future data sharing that is required, especially whenever debt or fraud is an issue.

It is this risk (i.e. that future data sharing can be legitimised without reference to the detailed Parliamentary scrutiny associated with primary legislation) which makes the Bill’s data sharing provisions unacceptable.

The Bill reduces the protection in the DPA

Most data protection officers know that a disclosure of personal data can occur if failure to disclose would “prejudice” a criminal inquiry or tax assessment (section 29(3) of the DPA). The Bill reduces this threshold so that a disclosure of personal data can occur “in connection with” a fraud (or a debt).

The point being made is that the existing disclosure threshold of “prejudice” means the public authority requiring disclosure has to justify why “prejudice” would occur prior to any disclosure. By contrast, a disclosure associated with a threshold of “in connection with” requires very little by way of prior justification.

Population Register

As an aside, I also suspect that the data sharing provisions with respect to public registers (e.g. births and deaths, marriages etc) in conjunction with the availability of other public domain personal data (e.g. electoral rolls etc) will make the eventual emergence of another detailed national population register, by administrative fiat, an inevitability. Has this prospect been discussed by Ministers during the Bill’s passage? Of course not.

(P.S. Why “another” national population register? Because the national security agencies obtain a complete copy of all electoral rolls and other bulk personal datasets, one can assume they already have compiled one).

Who is a “specified person”?

The Bill provides for the disclosure of personal data between “specified persons… in connection with fraud” (clause 48(1)). A “specified person” is any public body identified in Regulations by any Minister and, surprisingly, any person “providing services to a public authority”.

In data protection terms, a provider of services to a public authority would be usually be a data processor. I therefore don’t understand why a private sector data processor should be included as being a “specified person” as processors are beholden to the instructions of their public-sector controllers. The drafting Clause 48(6) could therefore indicate a lack of understanding of the controller-processor relationship in the DPA.

However, the idea might indeed be to allow private sector controllers (e.g. credit reference agencies) to deliver anti-fraud services to public bodies by merging their immense databases with other public sector databases. I float this off as a suggestion as the powers are so broad, I do not know what data sharing this Bill will eventually legitimised in future?

Has the prospect of private sector involvement been discussed by Ministers during the Bill’s passage? Of course not.

A public body that likes to say “yes”

Ministers also stress that the disclosures in the Bill are permissive and not obligatory; a public body can in theory actually refuse to disclose personal data. This has impressed the ICO (sadly).

In practice, such refusals will hardly ever happen. That is why the draft Codes of Practice that accompany the Bill refer to “powers to share” (just as if any disclosure was obligatory) and not, for example, “seeking permission to share” (which is what you would expect if disclosures were genuinely permissive).

In other words, public sector bodies will be expected to share personal data with any other public sector body for a range of activities; data sharing will become the new norm.

“Action” against fraud (or debt) can involve profiling

The Bill states that data sharing in relation to fraud is permissible between “specified persons” for “the purposes of taking action in connection with fraud against a public authority”.

Note that an “action” is not limited to a specific investigation into a particular fraud. An action could be data sharing of databases in order to do some data matching or profiling or even to collect some bulk personal dataset (who knows – the list of possible actions is extensive).

It is important to understand that with the reduction of the threshold for disclosures “in connection with” fraud, in conjunction with the word “action”, will inevitably mean that data sharing will increasingly involve the disclosure of personal data concerning data subjects who have committed no crime or who are not under direct suspicion.

Existing data sharing powers become redundant

I will now explain why I believe the general data sharing powers in this Bill, with its the lower threshold of “in connection with” fraud (or debt), will eventually replace existing data sharing powers with respect to fraud (or debt).

In the context of benefit fraud, for example, consider the following questions:

• Can personal data be disclosed by law already to counter benefit fraud under existing powers (e.g. in the Social Security Administration (Fraud) Act 1997)?
• Can the National Fraud Initiative do wide scale data matching exercises to counter fraud in the public sector general (expanded by the Serious Crime Act 2007)?
• Can voluntary disclosures take place under Section 29(3) if failure to disclose would “prejudice” a particular criminal inquiry into any fraud?

The answer to these above questions is, of course, “yes”.

So do the DWP or HMRC need the “powers” in the Bill? Has there been an explanation as to why, for instance, the DWP’s or HMRC’s existing powers to demand personal data are deficient?  Is the “failure to disclose would prejudice a fraud investigation” threshold is too high for DWP or HMRC?  Answer there has been none.

However, when this Bill becomes law, why should public authorities like DWP or HMRC exercise precisely worded powers to demand limited personal data when any statutory restriction can be lifted by using generous “in connection with” data sharing provisions in this Bill?

Why would any law enforcement body pussyfoot around with a test of “prejudice” if it can rely on a test of “in connection with” instead?

Has the above been discussed by Parliament or raised by Ministers or in consultation documents – course it hasn’t.

Disclosures under the Bill do not need to be “necessary”!

To demonstrate the disregard for basic data protection norms, I will refer an amendment which dealt with onward disclosure of personal data collected by a data controller in the public sector.

In the Bill, an onward disclosure of personal data is permitted if it is “made for the purposes of a criminal investigation (whether or not in the United Kingdom)”.  The amendment wanted to change the word “made” to “necessary” (full debate details in references below).

Note that with respect to the onward disclosure, the test of failure to disclose would “prejudice” a fraud inquiry has been ditched, and by now, this should not surprise the reader.  It is yet another example where the protection afforded by the DPA has gone (without explanation, I add).

The amendment attempted to correct two failings:

• Provide a Schedule 2 legal basis in the DPA as any disclosure of personal data, in the absence of data subject consent, has to be associated with a test of being “necessary” (for something); and
• Establish that any interference has to be “necessary” and ensure that any disclosure of personal data was proportionate in Article 8 HRA terms.

The Minister in his response that rejected the amendment said it would “in practice, inhibit public authorities from disclosing information, or delay them from disclosing it until they were content it was “necessary” to do so.  The consequence of the amendments would therefore be to create an uncertainty where we are trying to provide legal clarity.” (my emphasis; read the bold italic text again)

The conclusion reached by the Minister is that “legal clarity” requires data sharing:

• that cannot meet the obligation that data sharing is necessary for the functions placed on a public body (the requirement in Schedule 2 of the DPA)
• that allows interference into private and family life by a public body which does not have to be “necessary” for the functioning of a democratic society (the requirement in Article 8 of the Human Rights Act).

In paragraph 6 of her evidence (DEB 36), the Commissioner called for “necessary”, “proportionate” and “justifiable” data sharing; a call that has (following the Minister’s comments) fallen on deaf ears.

That is why there appears to be a general lack of understanding of how the Data Protection Act works and a need to explain how the interference inherent in data sharing complies with Article 8 of the Human Rights Act.

Insubordination

In her written evidence (DEB 52; see references), the ICO states that she is “content that her concerns about the codes (in Part V the Bill) have been addressed” because the Bill’s codes would be “subordinate to the ICO’s statutory code of Practice on data sharing”.  This “get out of jail free card” has been gratefully received.

I do not know what the Commissioner was told privately but the Bill does not actually provide that the Ministerial Codes of Practice are “subordinate” to the Data Sharing Code; the requirement in the Bill is that any Ministerial Code is “consistent” with that Code.

The use of the word “subordinate” means that if there were a conflict between Codes, the provisions in the Data Sharing Code would prevail. This is not the case as the use of the words “consistent” ensures the codes are of equal standing and the Data Sharing Code might not prevail.

Another ICO proposal that fell on deaf ears was for a definition of “personal information” in the Bill which actually was the same as “personal data” in the DPA.  This has not happened (for reasons unexplained) so we are faced with the wholly confusing proposition that some personal information might not be personal data.

So, for public bodies that are subject to FOIA and hold category (e) personal data, here is an early Xmas pub quiz question: can you think of any recorded “personal information” held by a public authority that is not “personal data”?  Send the answer to the Minister please.

Concluding comment

I hope the above analysis explains why I signed the Daily Telegraph letter last Friday; the data sharing provisions in this Bill need a complete rethink.

The “statutory data sharing gateways” provided in this Bill is really a “data sharing motorway”; it is wholly disproportionate, expansive and shows little data protection understanding of the First Principle, especially in terms of Schedule 2. The Code of Practice on data sharing which is proffered as the ultimate in protection is not the superior Code that applies to data sharing. The provisions undermine future Parliamentary scrutiny.

Finally, I observe the 170 page Bill has been pushed through in rapid time (7 sittings in October); the Eighth Sitting (3 hrs) was devoted to the Part V and its 32 pages (40 clauses) which deal with data sharing.

This means each data sharing clause was allocated less than 5 minutes of scrutiny and each dense data sharing page of legislation received just over 6 minutes.

Remember these statistics, when any Minister claims that Brexit gives the UK more Parliamentary scrutiny.

Other Publicity

Forthcoming  Amberhawk’s courses in December/January:

• GDPR Workshops: 7 December (London); 23 February (London)
• DP Foundation Course: Starts 10-12 January (BCS syllabus; London)
• DP Practitioner Course: Starts 17 January (BCS syllabus; London)

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS http://www.amberhawk.com/bookevents.asp

References

I am referring to the Bill (before Report stage in the Commons on 28/11/2016) http://www.publications.parliament.uk/pa/bills/cbill/2016-2017/0087/17087.pdf

Other blogs by other signatories to the Daily Telegraph letter published last Friday

• http://blogs.lse.ac.uk/politicsandpolicy/can-data-sharing-improve-public-services-some-lessons-for-parliament/
• https://ntouk.wordpress.com/2016/11/25/dear-sir-about-this-data-sharing/
• http://amberhawk.typepad.com/amberhawk/2016/11/hands-off-our-data-a-data-sharing-free-for-all-in-part-v-of-the-digital-economy-bill.html

ICO written evidence submissions can be found at:

• http://www.publications.parliament.uk/pa/cm201617/cmpublic/digitaleconomy/memo/DEB36.pdf

• http://www.publications.parliament.uk/pa/cm201617/cmpublic/digitaleconomy/memo/DEB58.pdf

The debate and Minister’s mentioned in the blog starts at col 325 of https://hansard.parliament.uk/commons/2016-10-25/debates/7654915e-9860-4536-88c9-bac929c0df6d/DigitalEconomyBill(EighthSitting).

The range of fraud initiatives undertaken by the NFI: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/421224/NFI_matches_per_body__2015_.pdf

Hands off our data: a data sharing free for all in Part V of the Digital Economy Bill

The following letter has been published this morning in the Daily Telegraph. I will do a blog on Monday to provide one example where I suspect little thought has been given to data protection. In my view, Part V of the Digital Economy Bill needs completely re-assessing.

SIR – We wish to highlight concerns with “information sharing” provisions in the Digital Economy Bill. 

The Bill puts government ministers in control of citizens’ personal data, a significant change in the relationship between citizen and state. It means that personal data provided to one part of government can be shared with other parts of government and private‑sector companies without citizens’ knowledge or consent. 

Government should be strengthening, not weakening, the protection of sensitive information, particularly given the almost daily reports of hacks and leaks of personal data. Legal and technical safeguards need to be embedded within the Bill to ensure citizens’ trust. There must be clear guidance for officials, and mechanisms by which they and the organisations with whom they share information can be held to account.

The Government’s intention is to improve the wellbeing of citizens, and to prevent fraud. This makes it especially important that sensitive personal details, such as income or disability, cannot be misappropriated or misused – finding their way into the hands of payday-loan companies, for example. Information sharing could exacerbate the difficulties faced by the most vulnerable in society.

The Government should be an exemplar in ensuring the security and protection of citizens’ personal data. If the necessary technical and legal safeguards cannot be embedded in the current Bill and codes of practice, we respectfully urge the Government to remove its personal data sharing proposals in their entirety.

Dr Jerry Fishenden Co-Chairman, Cabinet Office Privacy and Consumer Advisory Group (PCAG)

Renate Samson Chief Executive, Big Brother Watch

Ian Taylor Director, Association of British Drivers

Jo Glanville Director, English PEN

Jodie Ginsberg Chief Executive Officer, Index on Censorship

Dr Edgar Whitley Co-Chairman, Cabinet Office PCAG and London School of Economics and Political Science

David Evans Director of Policy, BCS – The Chartered Institute for IT

Dr Gus Hosein Executive Director, Privacy International and Member of Cabinet Office PCAG

Rachel Coldicutt Chief Executive Officer, Doteveryone

Roger Darlington Chairman, Consumer Forum for Communications

Dr Kieron O’Hara Associate Professor Electronics and Computer Science, University of Southampton. 

Professor Angela Sasse Head of Information Security Research, University College London and Member of Cabinet Office PCAG

Dr Judith Townend Lecturer in Media and Information Law, University of Sussex

Dr Louise Bennett Chairman, BCS Security Group and Member of Cabinet Office PCAG

StJohn Deakins Chief Executive Officer, CitizenMe

Rory Broomfield Director, The Freedom Association

Sarah Gold Director and Founder, Projects by IF

Jim Killock Director, Open Rights Group

Guy Herbert General Secretary, NO2ID and Member of Cabinet Office PCAG

Dr George Danezis Professor of Security and Privacy Engineering, University College London and Member of Cabinet Office PCAG

Jamie Grace Senior Lecturer in Law, Sheffield Hallam University

Eric King Visiting Professor, Queen Mary University

Josie Appleton Director, Manifesto Club

Jen Persson Co-ordinator, Defend Digital Me

Dr Chris Pounder Director, Amberhawk and Member of Cabinet Office PCAG

Sam Smith medConfidential and Member of Cabinet Office PCAG

UK decision to implement the GDPR does not guarantee an adequacy decision, post Brexit

Many commentators have reported the statement from the Secretary of State at the Department of Culture, Media and Sport (DCMS) that the UK Government is to implement the General Data Protection Regulation (GDPR). However, those who reported the announcement have failed to follow through with a detailed analysis of this position.

For example, data controllers should not assume that UK’s adoption of the GDPR will automatically mean that the UK offers an adequate level of protection. This blog explains this important conclusion.

First, the announcement of implementation of the GDPR did not come as a formal Written Statement focusing on the GDPR; it came in as a throwaway oral response to a question that did not involve the GDPR. One hopes that the Secretary of State will table such a Statement soon.

The exchange, in the middle of a Parliamentary Committee meeting about the “Responsibilities of the Secretary of State for Culture, Media and Sport”, is as follows.

“Q72      Nigel Huddleston: A final question: it is this cross-departmental approach (towards Brexit) that I know is broadening. Is that working?

Karen Bradley: “…An example might be the General Data Protection Regulation, which of course comes into effect in the spring of 2018. We will be members of the EU in 2018 and therefore it would be expected and quite normal for us to opt into the GDPR and then look later at how best we might be able to help British business with data protection while maintaining high levels of protection for members of the public.” (my emphasis; see references)

This statement that “…it would be expected and quite normal for us to opt into the GDPR” is not a firm commitment. What one “expects” could become the unexpected, especially if Brexit negotiations go sour. For instance, after our DP courses “it would be expected and quite normal” for delegates to follow the results of Barnsley Football Club (Google “It’s just like watching Brazil” to see why).

In addition, the use of “opt into” the GDPR is a curious term to use given that the GDPR is a binding commitment on Member States; it implies the “opt-out” was explored in detail (and perhaps remains a residual possibility, as you will see below).

However, as GDPR was mentioned, one can assume more official GDPR commentary will soon be forthcoming. Indeed, I have heard reliable rumours of some relevant paperwork being published by DCMS before Xmas, perhaps as early as the end of the month.

So, let’s take assume the GDPR is going to be implemented. I read the Minister’s comment as saying the GDPR might be implemented in the UK in a pretty full form at first, but then the “Great Repeal Act” (GRA) powers (when enacted) could be used to reduce some of the burdens on some data controllers at a later stage (e.g. after there has been an adequacy assessment from the European Commission).

Note the Secretary of State focuses on “burdens on some data controllers” and NOT protections for data subjects.  This could allow the UK to relax such issues such as mandatory data protection officers, reporting data losses “as soon as reasonably practicable” rather than in 72 hrs and some of the other administrative minutia in the GDPR for those data controllers who do not sell into the European Union (i.e. not subject to Article 3).

Please remember that an “adequate level of protection” (the requirement of the current Eighth Principle) means “adequate level of protection” from the standpoint of the data subject.  This means that the UK version of the GDPR cannot mess too much with the Principles and Rights; to do so risks “an inadequate level of protection”.

However, an adequacy assessment is not a slam dunk, even if the UK adopts the GDPR. One assumes that Ministers have the wherewithal to ensure an adequate UK is an outcome of the Brexit negotiations as the UK will have implemented the GDPR.

However, if the UK obtains Brexit with no deal (the view of many hard-line Government Ministers who want no truck with the Single Market), then even though the UK has adopted the GDPR, there would be no assessment of adequacy.  And of course, if this is the outcome, why implement the GDPR at all (that explains why the Minister said “opt-in”; I suspect that “opt-out” of the GDPR was considered in detail).

I have to say that I think the latter aspect (i.e. Brexit with no deal) is a realistic outcome. The UK is one of the largest economies in Europe and the European politicians cannot agree a deal that risks giving the UK a competitive advantage over European economies.  One way to avoid all blame for a duff Brexit deal is for the UK to Brexit with no deal.

So, assume no Brexit deal but GDPR implemented. The UK, when it leaves, would have NO adequacy determination in the bag (as there is no Brexit deal) and will have to rely on the European Commission and Article 45 for it to make a determination of adequacy. Now, if there is Brexit with no deal, how long will it take for the Commission to do this?  Add in some acrimonious negotiations, and the length of time taken doubles.

It is important to understand that the UK cannot apply to the Commission for an adequacy determination; any adequacy determination is in the gift of the Commission.  With acrimonious or no deal Brexit, “gifts” will be rather thin on the ground.

The Commission could easily justify any delay citing the Investigatory Powers Bill (soon to be an Act) because its bulk personal data set collection powers are accompanied with a double lock that does not consider the data protection issues. In addition, the European Data Protection Board could consider that all the problems that afflict Privacy Shield now apply to the UK.

It follows that data controllers who are relying on an adequacy determination following the Ministerial announcement should not do so.

My final comment in this section relates to those Islands that rely of UK legislation and often incorporate UK legislation (e.g. Jersey, Isle of Man). If adoption of UK’s GDPR legislation in the above circumstances does not guarantee adequacy; perhaps the time has come to assure adequacy independently of the UK.

Of course, the above might not happen. However, you have to understand that lurking around is the following unanswered question which might come to the fore after any consultation on the GDPR: if adopting the GDPR is not a guarantee of adequacy, then why adopt it in the first place? 

Other Publicity

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS: http://www.amberhawk.com/bookevents.asp

Forthcoming  Amberhawk’s courses in November/December:

• GDPR Workshops: 10 November (Douglas IoM); 7 December (London)
• DP Practitioner Course: Starts 14 November (BCS syllabus; London)
• CISMP Course: Starts 28 November (BCS syllabus; London)

References

Oral evidence: Responsibilities of the Secretary of State for Culture, Media and Sport, HC 764, Monday 24 October 2016 (GDPR at Q72 on http://data.parliament.uk/writtenevidence/committeeevidence.svc/evidencedocument/culture-media-and-sport-committee/responsibilities-of-the-secretary-of-state-for-culture-media-and-sport/oral/42119.html)