Hawktalk

Has President Trump’s Executive Order on “Public Safety” killed off Privacy Shield?

[Note added: 16 March 2017. The Executive Order has been rescinded. However, the analysis of Privacy Act 1974 in the USA is valid.  It does not apply to EU nationals and even if it did, the analysis shows that there is very little in the way of privacy protection.  It appears to me to be data sharing legislation]

President Trump’s Executive Order (Enhancing Public Safety in the Interior of the United States) has caused controversy over its temporary ban on all Muslims entering the USA from certain countries. It has consequences for data protection.

However, law-firm Hunton and Williams has just published a blog which concludes that “the Order should not impact the legal viability of the Privacy Shield framework” (see references). This conclusion is reached because, in the blog’s view, EU nationals still have access to USA courts by the Judicial Redress Act which is unaffected by the Executive Order (unless this access is revoked by the USA).

I agree with the blog’s conclusions relating to the Judicial Redress Act; however, I am not convinced that this overcomes the main data protection problem associated with this Order.

This is because implementation of this Order requires enhanced data sharing between Federal Agencies in the USA.  As this data sharing involves EU nationals it directly raises the question: “whether or not the provisions of USA’s Privacy Act 1974 itself offers an adequate level of protection for transfers of personal data to the USA?”.

In other words, the Executive Order will inevitably focus attention on the quality of protections provided by Privacy Act and not on whether these protections are accessible to EU citizens via Judicial Redress Act.

So what are these protections when there is data sharing? In this blog, I explore them.

President Trump's Executive Order

Section 14 of the Executive Order states that “Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information”.

Note that this exclusion relates to data subjects of all visitors and foreign nationals lawfully working in the USA irrespective of nationality.

In addition, there will be increased data sharing of personal data about EU data subjects (permitted by the Privacy Act as we shall see). For instance, Section 4 of the Order “direct agencies to employ all lawful means to ensure the faithful execution of the immigration laws of the United States against all removable aliens” (my emphasis).

One such “lawful means” includes maximising lawful sharing of personal data between Federal Agencies as legitimised by the USA’s Privacy Act.

Section 2(b) of the Order reinforces this increased data sharing impetus as Federal Agencies should “Make use of all available systems and resources to ensure the efficient and faithful execution of the immigration laws of the United States”. Systems and resources obviously include the immense personal datasets now held by Federal Agencies.

The definition of “removable alien” also increases to range of data sharing; a removable alien includes non-USA citizens:

• who engage in “willful misrepresentation in connection with any official matter” (i.e. even if unconnected with immigration);
• who “have abused any program related to receipt of public benefits”; or
• who in “in the judgment of an immigration officer, otherwise pose a risk to public safety”.

Finally, the Order states that is “the policy of the executive branch to empower State and local law enforcement agencies across the country to perform the functions of an immigration officer in the interior of the United States to the maximum extent permitted by law”.

The point being made is that it seems quite easy for any non-USA national to qualify for the status of “potential removable alien”, especially if a large number of officials can investigate any individual if they judge that person to be “a risk to public safety” (whatever that means).

It is these low thresholds that can trigger data sharing which will focus attention to the actual protection afforded by the Privacy Act itself. Additionally, if these protections do not exist (as they do in some disclosure circumstances), then access to them by the Judicial Redress Act is rendered irrelevant.

The USA Privacy Act of 1974

According to the Department of Justice (DoJ) website, the Privacy Act of 1974 establishes a code of fair information practices that govern the collection, maintenance, use, and dissemination of personal data processed by Federal Agencies.

Back in 1974, computer technology was largely mainframe based (e.g. a much loved IBM 370 series around the time of my PhD) so at the time of the Privacy Act, much of the detail in personal records, held by Federal Agencies, were in manual form.

Also in data protection terms, 1974 is seven years before Council of Europe Convention (No. 108) of 1981 which is the leading European agreement on Data Protection and just after Younger’s Report into Privacy in 1972 (from which the ubiquitous Data Protection Principles emerged).

The point being made is that, without looking at any text, it would not surprise anybody if the forty-three year old provisions in the USA’s Privacy Act 1974 were found to be out of date. Provisions that were enacted and debated at a time when detailed personal records were manually stored, are now being regularly applied in a wholly different electronic era.

By contrast, most of Europe is enacting its third generation of comprehensive data protection law (i.e. the GDPR) to update the level of data subject protection in an inter-connected world. This alone raises serious doubt as to the adequacy of the level of protection afforded by a 43-year-old piece of legislation.

The DoJ’s own description of the Privacy Act on its website reinforces these doubts (see references). It states that “the Act’s imprecise language, limited legislative history, and somewhat outdated regulatory guidelines have rendered it a difficult statute to decipher and apply” and “Moreover, even after more than forty years of administrative and judicial analysis, numerous Privacy Act issues remain unresolved or unexplored”.

So, in the forthcoming Trumpian era, if data sharing goes wrong, are the European Commission and EU Data Protection Authorities expecting EU Citizens to cover the expense of litigation in the USA Courts in order to deal with the many “unresolved or unexplored” issues the DoJ have identified?

Does this look like “an adequate level of protection” to you? It doesn’t to me.

Data sharing under the Privacy Act

The Privacy Act 1974 requires that Agencies place a public notice about their processing in a Federal Register and prohibits the disclosure of personal data in the absence of written consent of the data subject, unless the disclosure is exempt from the Privacy Act altogether, or unless the disclosure is pursuant to one of twelve statutory exceptions.

As the Executive Order states that Agencies “privacy policies exclude persons who are not United States citizens”, one can assume that details of any data sharing required by the Order will be absent from such policies.

This raises an immediate question: if EU citizens do not know about data sharing because of the Order’s exhortations, how can such persons know that they can use the Judicial Redress Act to access the protection afforded by the Privacy Act with respect to such data sharing? If you have an answer, can you tweet it to @realDonaldTrump?

Three of these dozen conditions mentioned above are relevant to the further use or disclosure of personal data by Federal Agencies. These conditions are:

• "need to know" within an Agency; this allows an Agency to use the personal data for any official purpose (e.g. if they need to know about potential “removable aliens”).
• “routine uses”; this will allow any Federal Agency to use personal data held by other Agencies in the same set of circumstances (i.e. relating to “removable aliens”).
• “law enforcement request”; a senior officer must make the request and specify the requirements. There is no test of prejudice or necessity associated with the request for personal data (e.g. as per the UK Data Protection Act).

It can be seen that the Privacy Act itself is a “flexible friend” from the perspective of a Federal Agency wanting to use or share personal data. For example, with respect to any potential removable alien:

• if an Agency “needs to know”, the Order states that there is no need for that further purpose to be described in any privacy policy available to data subjects.
• if another Agency seeks “routine use”, then it is very likely that the Agency has a remit in relation to a removable alien and therefore the processing is compatible with its functions. There again the privacy policy will not describe the data sharing purpose (which, by the way, will have nothing to do with law enforcement as that is covered by an even more flexible “law enforcement request” described above).

Finally in the section, data sharing for a data matching purpose linked to a law enforcement is not subject to the Privacy Act at all. For example, if a dataset was identified for a data matching purposes in relation to criminal offences or law enforcement associated with removable aliens.

Concluding comments

In my view, the Executive Order will inevitably focus attention on the limited privacy protection afforded by the USA’s Privacy Act 1974; I suspect that any detailed analysis of that Act will show that the protection to be patchy and deficient.

It is only a matter of time before an event involving a EU citizen (or European NGO) is raised with a data protection authority. The question is not whether there will be a problem with the Privacy Act 1974, but when such a problem manifests itself in a way that cannot be ignored.

Of course, the Working Party 29 could easily maintain its stance on Privacy Shield (i.e. review Privacy Shield once the GDPR has been implemented and the powers of the European Data Protection Board become available). Such a review has to consider the Privacy Act itself.

For instance, last Friday, EU Justice Commissioner Vera Jourova told the press in Malta that "I need to be reassured that Privacy Shield can remain". Can I use this blog to exhort Ms Jourova to at least ask the right question; it is “whether the USA’s Privacy Act 1974 offers an adequate level of protection for EU Citizens”.

However, the USA is a Third County outside the EEA. If I were a data controller relying on Privacy Shield, I would look at contingency arrangements just in case this Order (or another Trumpian policy) goes horribly pear-shaped. For ideas, see my blog on a Hard Brexit for options (see references).

When Privacy Shield was hurriedly negotiated under President Obama, all the negotiators wanted to extract themselves from a “Safe Harbor” pit, dug for them by the CJEU decision in Schrems. The politicians negotiating the deal were willing to gloss over the actual level of protection afforded by the USA’s Privacy Act of 1974 in order to agree Privacy Shield.

This is not an option given Executive Orders like this; I cannot see how this Privacy Act offers an adequate level of protection.

Indeed, I suspect this was known to be the case with the original Safe Harbor agreement.

Other Publicity

Forthcoming  Amberhawk’s courses in February/March

• DP Audit 20 February (London)
• GDPR Workshop: 23 February (London)
• DP Foundation Course: Starts 7 March (BCS syllabus; London)
• DP Practitioner Course: Starts 28 March (BCS syllabus; London)

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS http://www.amberhawk.com/bookevents.asp

References

Enhancing Public Safety in the Interior of the United States (Executive Order): https://www.whitehouse.gov/the-press-office/2017/01/25/presidential-executive-order-enhancing-public-safety-interior-united

Hunton and Williams Blog: “Privacy Shield: Impact of Trump’s Executive Order”: https://www.huntonprivacyblog.com/2017/01/28/privacy-shield-impact-of-trumps-executive-order/

DoJ website on the Privacy Act 1974: https://www.justice.gov/opcl/privacy-act-1974 and https://www.justice.gov/opcl/introduction

The options facing a controller in Privacy Shield are the same as in my blog: “If a hard Brexit a-gonna fall what then happens to overseas transfers of personal data? Replace “hard Brexit” with “Privacy Shield implosion” in the text http://amberhawk.typepad.com/amberhawk/2017/01/if-a-hard-brexit-a-gonna-fall-what-then-happens-to-overseas-transfers-of-personal-data.html

Schrems CJEU decision C362/14: http://curia.europa.eu/juris/documents.jsf?num=c-362/14

 

House of Lords Report into Digital Economy Bill confirms extensive data sharing powers are unaccountable

A House of Lords Committee has heavily criticised the data sharing provisions in Part V of the Digital Economy Bill; it has reported that the provisions should not be supported in their current form.

The Report confirms my comments in previous Blogs (see references) that the data sharing provisions (e.g. for efficient public sector service delivery, for research and statistics, for debt recovery and for fraud) are untrammelled. Namely the provisions:

• combined with the flexibility for Ministers to add to the list of data sharing objectives, provides a gateway that could allow future Governments to share personal data across the public sector by Ministerial edict without reference to Parliament;
• could replace many existing data sharing legislative provisions and negate the need for data sharing provisions in future legislation.

The following quotes (in italics) from the Report are enough to convince you that that these provisions are seriously deficient:

“We infer that at least some of the clauses in Part 5 are intended to supersede existing and more specific information-sharing gateways”

We observe that those provisions are drafted in very general terms, and would appear to permit any purpose connected with the provision of a public service to be prescribed as a “specified objective”.

“The provisions of the Government’s draft regulations would allow for large scale disclosures of confidential personal information from one “specified person” to another.”

For example, the DWP would have power to disclose social security information on a bulk basis to all local authorities, and/or the police, and/or schools, with a view to allowing the recipients to match this against data that they already hold to facilitate the identification of individuals facing multiple disadvantages.

“We consider it inappropriate for Ministers to have the almost untrammelled powers given by clause 30 which would allow them to prescribe

• extensive lists of public authorities as “specified persons”, either by name or description; and
• non-specific purposes for which the information may be disclosed or used, which need only meet the general conditions about improvement of public services”

“We are also deeply concerned about the power to prescribe as a “specified person” a person “providing services to a public authority” (see clause 30(3)(b)). ….This means that any person with whom one of those authorities chooses to contract for the provision of services connected with the “specified objective” would then become entitled to disclose and receive information under this gateway for the purpose of that objective. This applies whether the service provider concerned is in the public sector or is a charity or a commercial organisation.” (Report’s emphasis)

Despite “assurances that the power would be used only for “slight modifications”, there is in fact nothing to prevent a Minister from using the power to make extensive amendments to the Chapter, for example by removing the safeguards”

Get the idea? These provisions in their current form are dangerous extension of Ministerial powers – as awful as those associated with the National Identity Register of the ill-fated ID Card Act 2006.

Other Publicity

Forthcoming  Amberhawk’s courses in February

• DP Audit 20 February (London)
• Next GDPR Workshop: 23 February (London)
• DP Foundation Course: Starts 7 March (BCS syllabus; London)
• DP Practitioner Course: Starts 28 March (BCS syllabus; London)

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS http://www.amberhawk.com/bookevents.asp

References

Report from House of Lords:

http://www.publications.parliament.uk/pa/ld201617/ldselect/lddelreg/95/9503.htm#_idTextAnchor001

Blogs on this topic

Digital Economy Bill data sharing provisions undermine Parliamentary scrutiny and create privacy risks: http://amberhawk.typepad.com/amberhawk/2016/11/digital-economy-bill-data-sharing-provisions-undermine-parliamentary-scrutiny-and-create-privacy-ris.html

Hands off our data: a data sharing free for all in Part V of the Digital Economy Bill: http://amberhawk.typepad.com/amberhawk/2016/11/hands-off-our-data-a-data-sharing-free-for-all-in-part-v-of-the-digital-economy-bill.html

If a hard Brexit a-gonna fall what then happens to overseas transfers of personal data?

This blog tries to answer a simple question: “what can a data controller do if there are transfers between the UK and the European Union(EU) if the Article 50 button is pressed and there is a no subsequent agreement between the UK and the European Commission within the two-year timeframe?”.

In other words, what happens if there is a very Hard Brexit? The assumptions I am therefore making are as follows:

• there is no deal re Brexit and the UK is completely outside the EU;
• the UK has implemented a form of the GDPR;
• the European Commission has not made an assessment of adequacy for the UK; and
• there is a requirement to transfer personal data between European Union (EU) and the UK (and/or vice-versa).

Given yesterday’s speech, there is now a considerable risk of the above; matters could get very acrimonious and messy.

Indeed, Mrs May’s speech can be interpreted as blaming the EU in advance of the actual negotiations (e.g. the EU failed to give the UK a “good deal” thus forcing the UK to accept a “no deal” over a “bad deal” and become a tax-haven to attract more foreigners with lots of money – ironic isn’t it?).

In short, those controllers who transfer personal data between UK and EU should do some contingency planning.

No need to worry about Brexit

Data controllers who do not fall within Article 3(2) of the GDPR do not have to worry about Brexit (e.g. a controller that is based in the UK but is not offering services to data subjects residing in the EU).

Examples of such controllers include many UK public bodies that do not share personal data with European counterparts and many UK based SMEs that have a customer database only of those who are resident in the UK.

All such controllers need to do is comply with the new UK data protection law based on the GDPR when it comes into force (e.g. adopt new fair processing notices as per the ICO Code of Practice; follow UK version of GDPR rules re onward transfers of personal data to other Third Countries).

One assumes the Government will maintain its commitment to implement the GDPR, but if it starts throwing the toys out of the pram, one does not know what will happen.

Post-Brexit UK is not automatically adequate

The fact that the UK has implemented the GDPR does not mean the UK offers an adequate level of protection in accordance with Article 45. The UK does not qualify for adequacy if it has implemented the GDPR; the European Commission assesses the UK’s data protection law to see if it is adequate (or if a sector in the UK offers an adequate level of data protection).

Such an assessment is likely to take some time especially if there is an acrimonious Brexit divorce. In addition, I am not confident that the UK will obtain an assessment of adequacy (for reasons explained in previous blogs; see references).

Controllers that need to worry about hard Brexit

Assume that a controller or processor in the European Union is transferring personal data to UK based controller/processor. Following a hard Brexit, the controller in the EU has to consider the GDPR rules associated with a transfer of personal data to a Third Country (as a Brexit UK is a Third Country).

The controller or processor in the EU will look at the provisions in Articles  44-49 and chose one options for transfer to the UK controller or processor.

These options (in the assumed absence of a UK adequacy determination) are:

• Use European Commission’s standard contract terms or on contract terms (or other terms) approved by supervisory authority (Article 46(2)(c) & Article 46(2)(d))
• Have a legally binding & enforceable contract if the transfer is between public bodies (Article 46(2)(a))
• Implement Binding Corporate Rules (Article 46(2)(a) & Article 47).
• The particular transfer qualifies for an exemption from the need to assess adequacy (via something like the current Schedule 4; Article 49), but this is more likely to be case-by-case data transfers for a very few data subjects.
• Follow a Code of Practice approved by the relevant European supervisory authority associated with transfers (Article 40)
• Approved Certification Scheme for transfers (Article 42)

If there are joint data controllers (e.g. one in the UK and one in the EU), I would raise the issue with any business-related controller in Europe who is transferring to the UK to select what options are appropriate to the business.

I would also ensure that the responsibilities relating to such joint data controllers (in Article 26) are identified in any transparency processing notice is in place (Articles 13&14).

If an organisation in the UK is a data processor who has a client controller in the EU, the processor should raise the transfer options issue with their clients in the EU. In addition, the European based controller will also need to be sure of the Processor provisions in the GDPR are satisfied (e.g. Articles 28-30).

If such UK data processors do not raise this issue, their controller clients on the European mainland certainly will have to do so at some time before May 2018. I think it is better for the UK processor to show that it is “on the ball” rather than risk fallout with its clients following a highly publicised hissy-fit from a British politician (i.e. something worse than Boris Johnson joke comments about President Hollande and Nazi prison guards).

Finally, include any onward transfers to other Third Countries in your arrangements if they occur.

Representative (Article 27)

A UK controller offering services into the EU is likely to need a “representative” established in the EU. I say “likely” because public bodies processing in the EU do not need to appoint a representative (Article 27) as they are largely examples of controllers that do not offer services into Europe (see Article 3(2)).

The representative has to be appointed in a Member State where the data subjects are located and has to be mandated to deal with issues on behalf of the controller (note: only one representative in one Member State; the Member State where most data subjects reside springs to mind).

However, low risk “occasional processing” that does not involve Sensitive Personal Data (Articles 9&10) does not need a representative (e.g. a UK University attracting foreign students and collecting personal data at an event held in a European city).

So does Amberhawk need to find a representative? After-all we are a data controller and have customers who come from Europe to our courses on the GDPR or for data protection officers want to be qualified in the UK’s Data Protection Act (see references if you want to come; surreptitious marketing alert).

My answer is “No” because we do not offer training services designed to attract Europeans residing in the EU; the fact that such Europeans choose to attend is incidental.

In my view, the fact that Amberhawk has a website in the UK that can be used by data subjects residing in European Union does not trigger Article 3 unless our website has specific services designed to target such data subjects (e.g. Amberhawk were to offer courses in German Data Protection Law).

What about UK citizens residing in Europe (e.g. a UK-based controller promoting services designed for UK ex-pats domiciled in Spain?). The answer is a representative will be needed (in Spain) as the test in Article 3(2) relates to the fact that data subjects reside in the EU, not that the data subjects are EU or UK citizens.

Could another organisation (e.g. in the same group or a processor based in the EU) could be designated your “representative”? The answer is “yes”, but that representative should know it is fully liable for the actions of the controller/processor in the UK and might have to pay any fine (see Recital 80; last sentence).

Finally include any onward transfer to other Third Countries in your arrangements if they occur.

Caveats

Please ensure you check the above against national implementation or future guidance of the GDPR when they are implemented as Member State variants might arise.

Also, please recognise that some supervisory data protection authorities might consider that the UK does not offer an adequate level of protection and will investigate transfers to the UK in any event.

There is a lot to work through; so do it now. I would not take the risk that the political shambles that is Brexit becomes a complete and very public dog’s Brexit.

Finally, if you liked the above, come to our GDPR workshop or UPDATE (see below).

Other Publicity

Forthcoming  Amberhawk’s courses in February

• DP Audit 20 February (London)
• Next GDPR Workshop: 23 February (London)
• DP Foundation Course: Starts 7 March (BCS syllabus; London)
• DP Practitioner Course: Starts 28 March (BCS syllabus; London)

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS http://www.amberhawk.com/bookevents.asp

References

UK decision to implement the GDPR does not guarantee an adequacy decision http://amberhawk.typepad.com/amberhawk/2016/11/uk-decision-to-implement-the-gdpr-does-not-guarantee-an-adequacy-decision-post-brexit.html

Why also the UK is unlikely to get an adequacy determination, post Brexit http://amberhawk.typepad.com/amberhawk/2017/01/why-the-uk-is-unlikely-to-get-an-adequacy-determination-post-brexit.html

“A Hard Brexit is a-gonna fall”

Bob D. popped over the pond to watch Barnsley play recently and in a following jamming session with the club’s poet laureate (Ian McMillan), he penned a new verse to his classic “Hard Brexit” protest song of the 1960s. It goes as follows:

Oh, where have you been, my blue-eyed son

And where have you been, my darling young one

I’ve been to a place where politics are poisoning

And watched the results of division and hating

I walked on a land where hospitals are for bombing

And floated on seas where migrants are sinking

I travelled through parts where racism is rising

And garnered a sense that jackboots are stirring

I lived in a system that is known to be failing

Where the sky is filled with clouds that are darkening

And it's a hard, and it's a hard, it's a hard, and it's a hard

It's a hard Brexit a-gonna fall.

 

Why the UK is unlikely to get an adequacy determination post Brexit

Happy New Year (and welcome back to the daily grind).

This blog adds two further reasons why I think a post-Brexit UK is very unlikely to offer an adequate level of protection in terms of the General Data Protection Regulation (GDPR).

One reason relates to recent comments made by Prime Minister Mrs May about human rights. The other relates to the non-compliance of the national security agencies with their existing data protection obligations under the Data Protection Act 1998 (DPA).

“Mayday! Mayday! Mayday!” for human rights

According to the Daily Telegraph (see references), Mrs May is planning to withdraw from the European Convention of Human Rights (ECHR) in favour of a UK based Human Rights law that gives the Supreme Court the last say in how a human rights regime applies in the UK.

The plans will be headlined in the Conservative manifesto for the next General Election. The consequence of such plans can be illustrated by the case of Marper v UK dealing with the retention of DNA samples by the police (see references).

In Marper, the UK’s highest Court (the House of Lords as it then was) came to a unanimous decision (with a panel of 5 judges) that retention of DNA profiles, on individuals who had been arrested but who had been subsequently acquitted, comprised a lawful interference of private life in terms of Article 8 of the ECHR.

This meant that their DNA profiles could be retained lawfully by the police and profile details could be stored lawfully in the National DNA database.

The same position applied to the retaining of DNA profiles in circumstances where DNA was taken from a person at the point of arrest but where the prosecution was discontinued. Such retention of DNA profiles and related personal data also did not breach Article 8.

By contrast, the European Court ruled unanimously (this time a panel of 17 judges) that retention in the two circumstances identified above was an unlawful interference with private life. This judgment overruled the House of Lords and required the UK to enact new DNA rules which can be found in Chapter 1 of the Protection of Freedoms Act 2012.

In other words, if Mrs May’s policy were in place at the time of Marper, the UK police could have continued its DNA retention policy, storing records on innocent people (contrary to the practice of other European police forces).

Why the divergence?

Basically, the House of Lords in Marper expressed the view that to engage Article 8 to any significant degree, there had to be something more than mere retention of DNA profiles.

For example, suppose personal data just sit in a database without any further use or disclosure. Applying the Marper judgment, one would conclude that there is not a significant interference with private life as nothing happens to the personal data; they are just stored passively.  It is a subsequent use or disclosure that activates the stored personal data and which creates any interference with private life.

By contrast, the European Court of Human Rights have always found that the fact of retention of personal data engages the Article 8 right to a significant degree.  From its perspective, no further use or disclosure is required.

This divergence of view is also at the heart of the bulk personal data provisions in the Investigatory Powers Act 2016 (which, no doubt, will be challenged as being inconsistent with Article 8).

Section 199(1) of that Act states that in a bulk personal dataset “the majority of the individuals are not, and are unlikely to become, of interest to the intelligence service in the exercise of its functions”. My emphasis to show there is bulk collection and retention of personal data on individuals who are not of interest to the data controller.

If the ECHR follows previous judgments, it is likely to find such bulk personal dataset retention unacceptable in terms of Article 8. By contrast, the UK Courts might not make such a finding, especially if they do not have to follow previous European Court of Human Rights judgements on this topic (which is, of course, is the objective of Mrs May’s plan).

This means that, over time, divergences between UK and European Courts over Article 8 will occur in other areas (data retention being only one obvious area), and different human-rights based privacy standards will be the inevitable outcome.

That is why I cannot see how a Brexit UK can ever be deemed adequate in data protection terms if it does not abide by data protection judgments (e.g. on data retention), linked to Article 8, which are accepted by the rest of European Union.

Obvious counter-measure

The counter-measure is obvious: the European Commission merely makes any adequacy determination for a post-Brexit UK contingent on the UK implementing judgments of the European Court of Human Rights that relate to data protection (e.g. no Article 8 compliance, then any UK adequacy determination automatically lapses).

For good measure, I think the same argument applies for data protection rulings on the GDPR made by the Court of Justice of the European Union (CJEU). Any adequacy determination could be made contingent on compliance with relevant CJEU judgments and, indeed, majority decisions of the European Data Protection Board on GDPR interpretation.

Finally, even if the Commission does not link any adequacy determination for the UK to Article 8, following the Schrems CJEU judgment, any of Europe’s data protection authorities can do so (see references for more details).

National security agencies breach the DPA?

The second reason which indicates that the UK does not offer an adequate level of protection is that the UK’s national security agencies (MI5, MI6 and GCHQ) have not implemented their minimal data protection obligations for two decades. I suspect they do not know they exist.

At the time of the Data Protection Act 1984, these agencies processed personal data for “national security” purposes (whatever that purpose entailed) and were wholly exempt from that Act.  This broad national security exemption carried over to the 1998 Act.

However, in 1989, the Security Service Act put the MI5 on a statutory footing with the Intelligence Services Act doing the same for MI6 and GCHQ in 1994. This legislation gave all national security agencies additional responsibilities which are not always linked to a national security function.

It is these additional obligations which could result in these agencies being accused of being in breach of their data protection obligations.

GCHQ and the Data Protection Act 1998

I present the argument for GCHQ but it applies to the other national security agencies.

Section 3(2) of the Intelligence Services Act 1994 states that GCHQ can interfere with private life (e.g. collect a bulk personal dataset):

• (a) “in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty’s Government in the United Kingdom; or

• (b) in the interests of the economic well-being of the United Kingdom in relation to the actions or intentions of persons outside the British Islands; or

• (c) in support of the prevention or detection of serious crime”.

Note that Parliament, through the use of the word “or”, has distinguished para(a) which relates to the national security function:

• from para(b) which relates to the machinations of those who threaten the UK’s economic well-being; and
• from para(c) which relates to serious crime.

“National security” is still an undefined term whilst “serious crime” is a defined term in many Acts.  For example, in the Investigatory Powers Act 2016, it is defined as a crime, committed by an adult, that “involves the use of violence, results in substantial financial gain or is conducted by a large number of persons in pursuit of a common purpose”.

It can be seen from the definition that although some serious crimes (e.g. terrorism) impact on national security, not all serious crimes do. Similarly, some interests that impact on the economic well-being of the UK might not raise national security concerns (nor even a serious crime issue).

The point being made is that the Intelligence Services Act 1994 defines three distinct functions. This means any processing of personal data for the purposes associated with para(b) and para(c) do not always overlap with the processing of personal data for a national security purpose as identified in para(a).

Which DPA exemption applies?

Now consider Section 28 of the Data Protection Act. It introduces an exemption from all the main data protection obligations if an exemption “is required for the purpose of safeguarding national security”. It follows that this broad Section 28 exemption only applies for processing of personal data falling within para(a) above.

Therefore, it follows that the correct exemption for GCHQ to apply for much of its processing of personal data for serious crime purposes is the exemption in Section 29 dealing with prevention and detection of crime etc and not the Section 28 exemption dealing with national security.

The Section 29 exemption (relating to all aspects of crime) is limited to an exemption from the fairness and lawfulness requirements of the First Principle (i.e. a Schedule 2 & 3 justification is needed) and the right of access; additionally, the exemption is subject to a test of prejudice.  All the other data protection obligations apply.

It follows that the Information Commissioner can, if need be, enforce the rest of the Data Protection Act with respect to GCHQ for personal data processed purely for serious crime and economic well-being where there is no national security overlap.

It also follows that the statutory Data Sharing Code of Practice should apply to and sharing of a personal data collected via Investigatory Powers Act 2016 powers with respect to serious crime and economic well-being (and indeed any onward data sharing purpose not linked to national security).

Omissions from the Home Office Code

Section 7 of the draft Home Office Code of Practice on Bulk Personal Datasets, which deals with data sharing does not mention data protection requirements (e.g. Principles, compliance with the statutory data sharing Code or Practice).

Paragraph 11.9 of that Code states that the Data Protection Principles apply (except where an exemption is needed under Section 28) which as the reader now knows only applies to its functions with respect to national security (and not the other two functions). There is no mention of Section 29 exemption in the Code.

This explains why I suspect the Home Office and GCHQ are completely unaware that the DPA applies.

Evidence of GCHQ non-compliance is in the public domain

It is well known that data controllers have to notify their processing purposes with the Information Commissioner. GCHQ do not have to notify the national security purpose; however, GCHQ has also not notified the serious crime purposes, nor has it notified the economic well-being purpose with the Commissioner (see current notification URLs in references).

As there is an obligation to notify these purposes (as only para(a) is exempt), perhaps the Commissioner could invite GCHQ to update its notification? This change would require GCHQ to accept, publicly, that it is subject to the ICO’s remit for its functions that do not engage national security function.

Also, as most readers know, it is an offence for a data controller not to keep its notification up to date, which clearly in the case of GCHQ it isn’t. No further comment is required.

Assuming my analysis is correct, if GCHQ does not change its notification or if the Home Office does not change its Code of Practice on disclosures from bulk personal datasets, it will be providing public evidence of its continuing disregard for the Data Protection Act 1998.

Such evidence could be then used to enhance the arguments against a post-Brexit adequacy determination for the UK.

Finally, I have to repeat this for the record. This problem would have been avoided if data protection considerations formed part of the warrant seeking procedures associated with, for example, the bulk personal dataset acquisition powers in the Investigatory Powers Act 2016.  

This step was recommended by the Parliamentary Committee that looked at the Investigatory Powers Bill (see references for details). The Government ignored this recommendation.

The UK failing to obtain an adequacy determination could well be a likely consequence.

Other Publicity

Forthcoming  Amberhawk’s courses in January/February

• Next GDPR Workshops: 23 February (London)
• DP Practitioner Course: Starts 17 January (BCS syllabus; London)

Advanced warning: we have devoted the next UPDATE session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO and DCMS http://www.amberhawk.com/bookevents.asp

References

S and Marper v. the UK: http://www.bailii.org/eu/cases/ECHR/2008/1581.html

Blog on why the European Court and the UK Courts differ on data retention: http://amberhawk.typepad.com/amberhawk/2009/11/uk-courts-view-any-data-retention-as-human-rights-compliant.html

News report that Mrs May wants to withdraw from the ECHR: http://www.telegraph.co.uk/news/2016/12/28/theresa-may-fight-2020-election-plans-take-britain-european/

See “the Importance of Schrems” part of the blog: http://amberhawk.typepad.com/amberhawk/2016/02/politicians-agree-a-privacy-shield-as-the-working-party-of-data-protection-commissioners-display-a-s.html

Current notification of the Security Services which exclude crime prevention purpose: https://ico.org.uk/ESDWebPages/Entry/Z8881167 GCHQ’s incomplete notification on https://ico.org.uk/ESDWebPages/Entry/Z4664990

Current Home Office draft code of practice https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/557860/IP_Bill_-_Draft_BPD_code_of_practice.pdf

Government advised by Parliament to make the national security agencies apply Data Protection Principles: http://amberhawk.typepad.com/amberhawk/2016/02/put-privacy-first-parliamentary-report-calls-for-national-security-agencies-to-apply-data-protection.html

My evidence to relevant Parliamentary Committees on this subject: http://www.publications.parliament.uk/pa/cm201516/cmpublic/investigatorypowers/Memo/IPB51.htm and  http://amberhawk.typepad.com/files/blog_evidence-to-isc.pdf

Striking firefighters and miners are “terrorists” and are therefore legitimate national security targets; see middle of http://amberhawk.typepad.com/amberhawk/2013/08/spot-the-terrorist-data-protection-and-the-seizure-of-personal-data-on-laptops-at-airports.html