Hawktalk

Untargeted, bulk, indiscriminate data retention is unlawful and creates risks to adequacy determination post Brexit

In this blog, I look at the main findings of the Court of Justice of the European Union (CJEU) which confirmed, yesterday, that EU law precludes national legislation that requires a general, bulk and indiscriminate retention of traffic data and location data.

The judgement (in the UK context) relates to the Data Retention and Investigatory Powers Act 2014 (DRIPA) which according to the judgement “exceeds the limit of what is, strictly necessary and cannot be considered to be justified, within a democratic society“. DRIPA by the way expires at the end of the year to be replaced the Investigatory Powers Act 2016 (IPA).

It should be said at the outset that the ruling does not relate to national security as this subject is not within CJEU competence; this explains why the judgment is couched in terms of “serious crime”. However, as the national security agencies have a statutory role in supporting the police in cases of serious crime (e.g. see Security Service Act 1996), it follows that the judgment should apply to such support.

In addition, if any litigation on bulk dataset collection under the IPA were to wend a path to the European Court of Human Rights, that Court is likely to follow the CJEU’s analysis. After all, there is not much difference between the interference to privacy caused by DRIPA’s bulk communications data retention and IPA’s bulk personal dataset collection.

It follows the ruling should have some consequences for national security agencies and IPA just enacted; however, I am not sure whether the IPA will need much changing to meet the requirements of this judgment. In this blog, I explain why.

What is clear is that if the UK fails to make changes to IPA procedures (and possibly modify the IPA itself), then transfers of personal data into the UK post Brexit are at considerable risk.

The Home Office says publicly it is going to robustly appeal the decision (don’t know how by the way). However, the more it contests, the more the UK can kiss good-bye to any adequacy determination under the GDPR post Brexit.

In the following paragraphs, I summarise what the judgement is stating and comment on how I think its impacts on the IPA (in italics). I have also emphasised some key words in the text by bold, italic & underline

Court ruling details

The press release associated with the judgement states that “it is open to Members States to make provision, as a preventive measure, for targeted retention of that data solely for the purpose of fighting serious crime, provided that such retention is, with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the chosen duration of retention, limited to what is strictly necessary”.

CP comment: the word “solely” excludes using retained communications data by many law enforcement authorities for lesser crimes (i.e. non “serious crime”). For example, Section 55 of the Data Protection Act which is non-custodial and therefore “non serious” crime (which ironically is explicitly proffered by Section 1(5)(b) of IPA as a key privacy protection!). The use of the word “targeted” suggests that mass retention and bulk personal datasets have significant Article 8 problems as they are not targeted at all.

The legislation must indicate in what circumstances and under which conditions a data retention measure is, in practice, actually limited to what is strictly necessary. CP comment: IPA refers to the test of “necessary” not “strictly necessary” which is far higher; it carries a sense of “really this is a last resort” interference into private life.

The fact that the communications data are retained without the users of electronic communications services being informed is likely to cause the persons concerned to feel that their private lives are the subject of constant surveillance. CP comment: it has yet to be seen whether data subjects will be informed of mass data retention (and indeed any bulk personal dataset collection). In my evidence to Parliament, I showed that this has been done without prejudice to operations (see references).

Consequently, only the objective of fighting serious crime is capable of justifying such interference (my emphasis). CP comment: the use of “only” is at odds with the Code of Practice on telecommunications data that, according to Schedule 7, para 3(2)(d) will permit “(d) the processing of the data for purposes otherwise than in connection with the purposes for which it was obtained or retained” (i.e. a whole host of other purposes). The Code will thus need revision in my view.

Access can, as a general rule, be granted, in relation to the objective of fighting crime, only to the data of individuals suspected of planning, committing or having committed a serious crime or of being implicated in one way or another in such a crime. CP comment: the use of "only in conjunction with “suspected” or “implicated” excludes the possibility of mass personal data collection on, individuals “who are not of interest to the intelligence services” (as per Section 199(1) of IPA).

The Court states that any national legislation must be clear, precise and must provide for sufficient guarantees of the protection of data against risks of misuse. CP comment: Reference to the non-custodial sentence of Section 55 of the DPA (in Section 1(5)(b) of IPA) and a maximum penalty of £50,000 (in Section 7 of IPA) for a flagrant unlawful breach of the IPA law does appear to me form any guarantee at all. The maximum Monetary Penalty can be seen to be derisory when compared to the GDPR for instance.

National legislation must lay down the substantive and procedural conditions governing access by law enforcement authorities to the retained data for serious crime. CP comment: The detail of the substantive and procedural conditions is found, not in the lPA legislation itself, but in the associated Codes of Practice (Schedule 7 of IPA).

Given the quantity of retained data, the sensitivity of that data and the risk of unlawful access to it, national legislation must make provision for that data to be retained within the EU and for the irreversible destruction of the data at the end of the retention period. CP comment: Brexit means we are outside the EU! This could make it difficult for instance, GCHQ to monitor French communications in bulk for the French authorities or for bulk personal data on Europeans be shared with USA national security agencies.

General comment

There has been a lot of press coverage that the UK’s Snoopers’ Charter (the populist description for the IPA) is in trouble from future legal challenge.

I am not so sure about this because the Judicial Commissioner procedures and textual changes to the relevant Codes of Practice could pick up many of the CJEU requirements. In addition, there is no actual evidence that IPA has gone wrong; just the widespread suspicion that it will.

I also suspect the Judicial Commissioner’s cannot ignore this judgment in the short term as we have not left the EU. For instance, the Judicial Commissioner as part of the IPA’s double lock could:

• Tone down any bulk personal dataset collection, content or retention request so that it is “strictly necessary” and “targeted”
• Check that retention times are appropriate to the nature of the serious crime
• Permit any onward use or disclosure is limited to that “strictly necessary for a serious crime”
• Require the timely and secure irreversible destruction of personal data
• Require a comprehensive audit trail so that problems can be dealt with.

Codes of Practice can be changed to reflect the above requirements as well as ensure that data subjects are informed that their personal data are being used (as required by the judgment). Such information can be made public in a way that does not prejudice an inquiry.

When you look at the above list, they are all related to recognisable Data Protection Principles. It shows again the great mistake of not including data protection considerations as part of the warrant authorising procedures (in particular the extent to which the Section 28 national security exemption applies; see references).

It can also be seen that if the UK fails to accommodate the CJEU changes, it is unlikely to be a safe place for transfers even if it gets an assessment of adequacy in Brexit negotiations. This is because of the Schrems decision (see references) and because, inevitably, there will be suspicions that the bulk personal dataset provisions are misused.

And how do you allay such suspicions? Well it’s a mixture of transparency, good independent oversight and a firm approach to the concept of “necessity”. If the Judicial Commissioners and Investigatory Powers Commissioner can do their job properly (and the Codes of Practice reflect these objectives), then the changes to IPA could be minor.

Will it happen? I suspect not, but only time will tell.

Can I wish you a good holiday period; Hawktalk returns in the New Year

Other Publicity

Forthcoming  Amberhawk’s courses in January

• Next GDPR Workshops: 23 February (London)
• DP Foundation Course: Starts 10-12 January (BCS syllabus; London)
• DP Practitioner Course: Starts 17 January (BCS syllabus; London)

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS http://www.amberhawk.com/bookevents.asp

References

The judgment in “Cases C-203/15 Tele2 Sverige AB v Post-och telestyrelsen and C-698/15 Secretary of State for the Home Department v Tom Watson and Others”: http://curia.europa.eu/juris/liste.jsf?num=C-203/15

I cannot see the UK being adequate following Brexit if no adjustment is made to IPA procedures. This is a consequence of the Schrems CJEU judgment which empowers European Data Protection Authorities considerably: http://amberhawk.typepad.com/amberhawk/2016/02/politicians-agree-a-privacy-shield-as-the-working-party-of-data-protection-commissioners-display-a-s.html

Blogs on national security and data protection etc:

• Put privacy first! Parliamentary report calls for national security agencies to apply Data Protection Principles: http://amberhawk.typepad.com/amberhawk/2016/02/put-privacy-first-parliamentary-report-calls-for-national-security-agencies-to-apply-data-protection.html
• National security agencies should be subject to Data Protection law. http://amberhawk.typepad.com/amberhawk/2014/10/national-security-agencies-should-be-subject-to-data-protection-law.html
• Should national security certificates exclude the Data Protection Principles? http://amberhawk.typepad.com/amberhawk/2014/02/should-national-security-certificates-exclude-the-data-protection-principles.html
• My evidence to relevant Parliamentary Committees on this subject: http://www.publications.parliament.uk/pa/cm201516/cmpublic/investigatorypowers/Memo/IPB51.htm and http://amberhawk.typepad.com/files/blog_evidence-to-isc.pdf

Minister speaks in adjournment debate on GDPR - Government still undecided on what to do re Brexit

Adjournment debate on GDPR - last Monday December 12

Full debate on: https://hansard.parliament.uk/Commons/2016-12-12/debates/6EB0C615-2571-4B26-A75B-8CD1CF5FD854/EUDataProtectionRules

Key quotes from the Minister for Digital and Culture (Matt Hancock) are below.

"We were clear in the negotiations on the GDPR that any new data protection legislation needs to meet the need for high standards of protection for individuals’ personal data while not placing disproportionate burdens on businesses and organisations. The UK was successful in negotiating a more risk-based approach to the GDPR, allowing for greater flexibility in relation to the regulation’s mandatory requirements, such as on data protection impact assessments and data protection officers. We want a scheme that works effectively, protects data and is flexible to ensure that our data economy thrives. Therefore, we were successful in negotiating a reduction in some of the red tape and bureaucracy for ordinary businesses whose primary activities are not data processing but who have data that need to be protected. We succeeded in the negotiations to give greater discretion to the UK’s Information Commissioner in the way it enforces breaches of the regulation".

"The hon. Gentleman asked a series of questions about the implementation of the GDPR. We now need to press ahead with implementation. It will become directly applicable in UK law on 25 May 2018, but a lot of preparatory work needs to be done in the meantime, both in government and by businesses throughout the country. We are now working on the overall approach and the details of that implementation. Details of any new legislation in this area will be made in due course and announced in the normal way, but I can tell him that we are considering these matters in great detail as we speak."​

"It is important for businesses and organisations to prepare now for the new standards of data processing. A lot of work has already taken place, but there is much for businesses to do to ensure that their processes and practices are aligned with the GDPR. The Information Commissioner is providing regular updates on the steps that organisations and individuals should take to prepare for the new legal framework and will continue to provide guidance over the next few months. We plan to consult with stakeholders on key measures where we have the opportunity to apply flexibilities, which the hon. Gentleman mentioned, in the regulation to maximise and to protect our domestic interests and to get the balance right between delivering the protection that people need and ensuring that the regulation operates in a way that ensures that the UK’s data economy can be highly successful. For example, one measure will be on what the age of consent should be for children who wish to access information services. We want a data protection framework that works best for the UK and meets our needs. Those consultations will be forthcoming."

"We have made progress in our argument within the EU that data localisation rules are not appropriate". (CP comment: the Russian DP law is a localisation law that requires processing of personal data on Russian Citizens to be in Russia)

"There is also work to be done between now and 2018 to make sure that we achieve a coherent data protection regime and that data flows with the EU are not interrupted after we leave"

"I hope that I can reassure the hon. Gentleman and the tech industry in the UK that we are doing all we can to ensure that our future data standards are of the very highest quality, including their international links, and that we get the balance right between ensuring the high levels of protection that individuals and companies need and ought to expect with the appropriate levels of flexibility to make sure that our data economy can be one of the strongest in the world".

Other Publicity

Forthcoming  Amberhawk’s courses in January:

• GDPR Workshops:  23 February (London)
• DP Foundation Course: Starts 10-12 January (BCS syllabus; London)
• DP Practitioner Course: Starts 17 January (BCS syllabus; London)

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS http://www.amberhawk.com/bookevents.asp