Hawktalk

UK’s GDPR law will not be judged “adequate” if it contains provisions that made the DPA inadequate

Many readers know that, since 2005, I have tried to use Freedom of Information legislation to find out what is behind the “on-going” infraction proceedings, commenced by the European Commission against the UK. This is because the UK’s Data Protection Act (DPA) is, according to the Commission, a defective implementation of Directive 95/46/EC.

So what are these defects? Should data protection practitioners know what they are?

Readers also know the answer to both questions is a resounding “NO” as publishing the requested data protection detail would cause irreparable damage to international relations between the UK and the European Union (re-confirmed in ICO Decision Notice FS50577377, dated March 2016)!

So, after the Brexit referendum vote, I tried the European Union’s Access to Documents regime (Regulation (EC) No 1049/2001), and received another refusal to add to my collection. The refusal letter, dated mid-November last year, confirms that there are still major problems with the DPA; of the 20+ problems with the DPA identified by the European Commission in 2005, four of them are serious and remain unresolved in 2017 (in the run up to GDPR implementation).

Surprisingly, even information about the 16+ resolved issues remain a state secret. For instance, paragraph 33 of the 2016 Decision Notice confirms that the release of these details would cause “prejudice to international relations”. The ICO concluded that “…having viewed the withheld information, the Commissioner is satisfied that there would be a real and significant risk of prejudice …to the relationship between the UK and the European Commission”.

Indeed, someone who said he was “close to GCHQ/MI6” took me to one side at this month’s ICO conference. He told me that if I were to be given the top-secret list of data protection indiscretions on the part of the UK, (none of which relate to national security, crime and taxation etc I should add) then the damage to EU-UK relations would be so high that the European Commission’s mission in London would have to close, and the UK Ambassador to Brussels would become persona non grata.   I was advised to "back-off" whatever that means.

A score of problems

In this blog, I update readers with the latest chapter in this saga. I report the contents of a six page refusal letter, dated 14/11/2016, which contains comments relevant to a UK adequacy decision under GDPR (see references: Document 0-6 where each is a single page)

The important comments are:

• the first complete paragraph at the top of Document 3 shows that the alleged defects in the UK’s DPA will be assessed in the context of the UK’s GDPR implementation and “could possibly lead to a complementary reasoned opinion”. In other words, if the identified DPA defects remain when the UK implements the GDPR, that implementation is likely to be judged defective.
• the bottom of Document 4 and top of Document 5 where the Commission confirm that “investigations are active and ongoing”; this means the DPA is still deemed to be defective. In other words, if the current DPA is defective in terms of Directive 95/46/EC it will also defective in terms of the GDPR (i.e. the status quo cannot remain as a basis for an adequacy determination by the Commission).

Where is the DPA defective?

The main areas of concern about the DPA in the context of the GDPR that I have identified in this decade long FOI process are as follows:

1. The definition of “personal data” takes no account of Recital 26 of Directive 95/46/EC.  The definition of “personal data” in the DPA requires personal data to relate to an identifiable data subject where that identification is undertaken by only the data controller. By contrast, Recital 26 suggests identification can be undertaken by the controller and, within reason, persons other than the controller. The UK Act definition of personal data is therefore unduly restrictive and has been so since 1998. The same problem is in the GDPR definition of “personal data”.
2. The definition of “Relevant Filing System” of the DPA is not the definition of “Filing System” in the Directive 95/46/EC. Whilst the Directive allowed Member States to go their own way with manual filing systems this flexibility is not in the GDPR (which maintains the Directive definition). I have included it in my list as this could be a major headache for controllers preparing for the GDPR; personal information in manual filing systems that are excluded from the definition of “data” in the DPA (and therefore are excluded from any DP obligation as the information is not personal data) become fully subject to the GDPR in May 2018.
3. The Information Commissioner in the DPA has limited role in assessing whether third countries offer an adequate level of protection (e.g. she does not authorise or approve transfers in a way other European data protection authorities do). The DPA is unique in that data controllers can assess adequacy (something removed in the GDPR unless very exceptional circumstances arise).
4. The Information Commissioner cannot perform random audit checks on any data controller/data processor under the DPA.  There is a limited ability to audit Government Departments, NHS and Telcos but this came after the Commission commenced its “on-going” infraction proceedings in 2005.
5. The Monetary Penalty regime is too restrictive (e.g. it requires serious breach that causes real or likely substantial damage/distress). I suspect the Commission would prefer penalty fines for many lesser infringements, and that if the UK maintains the current enforcement regime in the GDPR, it risks being judged as being inadequate.
6. There is no ability (except for judicial review) for the data subject to challenge the Information Commissioner’s failure to enforce the DPA against a data controller. Whereas a data controller can appeal to the Tribunal against the ICO’s enforcement action in general, there is no equivalent appeal mechanism available to data subjects. The main enforcement regime is therefore unbalanced and comprise last resort powers that are designed only to be used (e.g. Enforcement Notices; Information Notices) when a data controllers does not “co-operate” with the ICO’s wishes. That is why there are very few Information Notices, for example.
7. The Courts in the UK have unfettered powers to exempt personal data from subject access in circumstances when the exemption is not grounded in the exemptions found in Directive 95/46/EC (this arises from the use of “may” in Section 7(9) of the DPA).  In addition, the Courts could even refuse to order inaccurate personal data to be corrected or erased (the use of “may” in Section 14).  I should add that I find both problems to be hypothetical and I am not aware of any case where these Sections have proved to be a problem but I do know the Commission is concerned about this.

Note that the last five in the above list relate to enforcement issues and improperly implemented data subject rights. They serve to reinforce the widely-held perception in Europe that the UK enforcement regime is weak.

Some of the issues raised by the Commission have been resolved by the UK Courts over time.  For instance, the right to compensation in the DPA was limited to damage that could be assessed on monetary grounds. In the case of Johnson v Medical Defence Union, the Court of Appeal stated that compensation for distress would only be available where a claimant could also show pecuniary loss.

This was overturned in the Court of Appeal in Google Inc. v Vidal-Hall & Ors which ruled that section 13(2) of the Data Protection Act should be ignored as it was a deficient implementation of Article 23 of Directive 95/46/EC. Note that it took 14 years, and a long march through the legal institutions, to fix this “bug”.

Other issues have been resolved by CJEU Judgements which do not apply in a post-Brexit UK.  For instance, I am sure that the domestic purpose exemption (Section 36 of the DPA) was criticised by the Commission as being too broad; this was subject to a landmark ruling in Lindqvist which narrowed its scope to processing of personal data for “purely personal” matters.

I do not know what the missing 10+ issues are; they have to be kept secret so not to “prejudice international relations”.  However, one of my FOI requests did require the UK Government to publish a list of which Articles of the Directive (all 17 of them) where there was an issue (see references).

Commentary

The fact that a score of issues was identified as potential defects suggests that the DPA was, from the European perspective, implemented well below the minimum standard required (and deliberately so).   Quite simply the UK has applied a “minimal implementation” policy to the implementation of Directive 95/46/EC.

If this policy continues with GDPR implementation (e.g. all the indications are that Government intend to take maximum advantage of the flexibility that the GDPR gives to Member States in 50+ Articles), then a minimal implementation policy is likely to jeopardise any adequacy determination by the European Commission.

The conclusion that I have reached is that the risk of a “GDPR-lite” implementation is significant; it follows that the risk of the UK not getting an adequacy determination is therefore high. That is why my blog on “a hard-Brexit a gonna fall” could be very relevant to readers with Third Country transfer issues (see references).

This conclusion is not helped by stated Government policy that, in a post-Brexit UK, it can ignore CJEU judgements (and by implication European Data Protection Board determinations concerning harmonising the GDPR across European Union). Such a policy, if implemented, is also likely to jeopardise any adequacy determination from the Commission.

In summary, 60,000,000 UK data subjects, 500,000 data controllers and a host of Parliamentary Committees have been kept ignorant, for over a decade, about the alleged defects in the UK’s DPA by successive governments. From the ID Card database in 2004 to the widespread data sharing policies of the Digital Economy Bill of 2017, Ministers down the ages have reassured Parliament that privacy is preserved: “Don’t worry, the personal data are protected by the DPA”.

All these statements are wholly misleading, and in many circumstances, Ministers or their Civil Servants knew they were misleading. Any evidence lies in these infraction documents which, for reasons I cannot fathom, are being kept secret.

This state of affairs now risks carrying over to the GDPR. If so, then this could torpedo any hopes of an adequacy determination by the Commission.

Other Publicity

Forthcoming  Amberhawk’s courses in April/May

• Next GDPR Workshop: 19 April (London)
• DP Practitioner Course: Starts 28 March (BCS syllabus; London)
• DP Practitioner Course: Starts 8 May (BCS syllabus; Edinburgh)
• FOI Practitioner Course: Starts 18 May (BCS syllabus; London)

UPDATE: we have devoted the next UPDATE day-long session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO, Hunton & Williams, DMA and Grant Thornton as well as the usual suspects from Amberhawk http://www.amberhawk.com/bookevents.asp

References

If a hard Brexit a-gonna fall what then happens to overseas transfers of personal data? http://amberhawk.typepad.com/amberhawk/2017/01/if-a-hard-brexit-a-gonna-fall-what-then-happens-to-overseas-transfers-of-personal-data.html

List of Articles of Directive 95/46/EC where there was an issue: Download Uk-deficiency-details_may-2011

Please download the letter here: Download Document 1  Download Document 2  Download Document 3  Download Document 4  Download Document 5  Download Document 6

A DOZEN YEARS OF SECRECY: INFRACTION BLOGS (AND YEAR OF BLOG)

(2014) European Commission raises infraction threat to UK on failing to implement Directive 95/46/EC properly via the Data Protection Act http://amberhawk.typepad.com/amberhawk/2014/10/european-commission-raises-infraction-threat-to-uk-on-failing-to-implement-directive-9546ec-properly.html

(2011) What is wrong with the Data Protection Act? FOI Infraction saga hits the buffers. http://amberhawk.typepad.com/amberhawk/2011/10/what-is-wrong-with-the-data-protection-act-foi-infraction-saga-hits-the-buffers.html

(2011) Privacy: new Government revelations amplify concerns surrounding deficiencies in UK’s Data Protection Act http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html

(2009) Data Protection Act fails to implement 50% of the Directive? http://amberhawk.typepad.com/amberhawk/2009/11/data-protection-act-fails-to-implement-50-of-the-directive.html

(2007) Europe claims UK botched one third of Data Protection Directive: https://www.out-law.com/page-8472

(2004) European Commission suggests UK’s Data Protection Act is deficient; https://www.out-law.com/page-4717

(2004) UK’s Data Protection Act might not meet European Union standards: https://www.out-law.com/page-4549 

 

Under the GDPR, be careful when you use the “C” word

The ICO has just published draft Advice (the “Advice”) on the use of consent under the General Data Protection Regulation (GDPR). All I can suggest is that readers engage with the consultation over the content of this draft Advice (especially if a data controller relies on data subject consent).

What follows is a set of statements from the 40 page Advice concerning consent under the GDPR, followed by my commentary which I hope helps your understanding of the issue. This should explain why this Advice requires careful consideration by all data controllers.

“Statements” and commentary

“Doing consent well should put individuals in control”; CP Comment:  the data subject being in control means that on the withdrawal of consent, the expectation will be that the processing of the data subject’s personal data will cease. Note that the data controller is NOT in control. If the data subject cannot withdraw consent, then the data controller is likely to require another “Schedule 2” basis to legitimise the processing (i.e. data subject consent is unreliable basis)

“Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of consent by default”.  CP Comment: “opt-out” is likely to prove unreliable in the GDPR data subject consent era, so discuss this Advice with your marketing people and consider weaning yourself off any “opt-out” currently used (e.g. aim to switch to “opt-in” by the end of the year).

“Explicit consent requires a very clear and specific statement of consent. Be specific and granular”. The Advice also states the GDPR “requires granular consent for distinct processing operations”. CP Comment: there might be more than one “opt-in” needed for specific processing operations (consent for a disclosure to a third party is separate from the consent for the data controller’s use of personal data; see next comment below). See Recital 42 especially for the detail on this requirement.

“Name any third parties who will rely on the consent”. CP Comment: this includes third parties who use the personal data for their marketing; in practice, I think this a general description can also suffice (e.g. “other companies in the XYZ Group”) but this is not what the Advice says. The identification of specific third parties involved in marketing was required by the Tribunal in the Optical Express Decision with respect to automated “robocalls” (see references).

“Make it easy for people to withdraw consent and tell them how. Keep consent under review, and refresh it if anything changes”. CP Comment: information about the data subject's ability to withdraw consent is a requirement of the Right to be Informed (see GDPR Articles 13 and 14). With respect to refreshing consent, the ICO in the Age International & British Red Cross Undertakings required consent to be refreshed every two years (but the draft Advice says nothing about a time limit for consent refreshing).

“Public authorities and employers will find using consent difficult”. CP Comment; this is because data subjects cannot avoid dealing with a specific public authority if they want a public service whilst employers are in a position of power over employees who might feel they are under an obligation to consent. Justifying criminal records checks is in “difficulty” if it relies on data subject consent. However, the use of consent might be legitimate for public authorities and employers on the fringes (so long as the GDPR requirements are met).

“You must keep clear records to demonstrate consent”. CP Comment: this is an explicit requirement of Article 7 of the GDPR.

“The GDPR specifically bans pre-ticked opt-in boxes”. CP Comment: this obligation is found in Recital 32 and shows that the Advice is influenced by the GDPR Recitals. The importance of this use of the Recitals in interpreting the GDPR must be understood by all readers (see references). Do not consider an Article without reading the related Recitals.

“However, you will need to be confident that your consent requests already met the GDPR standard and that consents are properly documented. You will also need to put in place compliant mechanisms for individuals to withdraw their consent easily”. CP Comment: this comment covers the transition from the current standard of "consent" under the DPA to the GDPR standard of consent; it illustrates why you need to move to an "opt-in" arrangement prior to GDPR implementation next year.

“Private-sector organisations will often be able to consider the ‘legitimate interests’ basis in Article 6(1)(f) if they find it hard to meet the standard for consent and no other specific basis applies. This recognises that you may have good reason to process someone’s personal data without their consent – but you must ensure there is no unwarranted impact on them, and that you are still fair, transparent and accountable”. CP Comment: remember that if the data subject exercises the right to object to the processing in Article 21 with respect of "legitimate interests", then the onus is on the data controller is to prove that his “legitimate interest” should prevail over that of the data subject.

“Instead, if you believe the processing is necessary for the service, the better lawful basis for processing is more likely to be that the “processing is necessary for the performance of a contract”. CP Comment: This comment in the Advice is very relevant to private sector bodies who use a construction such as “By signing this contract you consent to …..”. For instance, most of us have signed such a contract with respect to disclosures to credit reference agencies and loans (e.g. whether we do or do not repay a particular monthly instalment). Notice that such disclosures have to be “necessary for the performance of a contract”, and this condition does not require the contract to be between the data controller specifically offering the contract to the data subject.

“Public bodies cannot generally rely on ‘legitimate interests’ under the GDPR, but should be able to consider the ‘public task’ basis in Article 6(1)(e) instead. However, you will need to be able to justify why the processing is necessary to carry out your functions – in essence, that it is proportionate and there is no less intrusive alternative”. CP Comment: Article 6 of the GDPR explicitly excludes the legitimate interest condition for public functions of a public authority controller; it is expected such a controller will use the condition when the processing is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. The use of the word “necessary” links to Article 8(2) of the Human Rights Act that requires any interference is “necessary” (i.e. proportionate and for some pressing social need) and this explains the comments in the Advice. Note that "legitimate interest" can be available for any processing that is “non-public task” etc (e.g. such as employment purposes).

Concluding comment

The Advice raises two big changes that are coming down the GDPR line (i.e. when the processing of personal data is legitimised by data subject consent or by the legitimate interests of the controller). With the former, the data subject can withdraw consent; with the latter, the data controller will be obliged to demonstrate why his “legitimate interest” should prevail..

So when you use the “C” word, make sure you mean that you are aware that you do not have control over the processing of personal data.

Note added after publication: Readers will be interested in the Comments to this blog (click on Comments below).

Other Publicity

Forthcoming  Amberhawk’s courses in March/May

• Next GDPR Workshop: 19 April (London)
• DP Practitioner Course: Starts 28 March (BCS syllabus; London)
• DP Practitioner Course: Starts 8 May (BCS syllabus; Edinburgh)
• FOI Practitioner Course: Starts 18 May (BCS syllabus; London)

UPDATE: we have devoted the next UPDATE day-long session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO, Hunton & Williams, DMA and Grant Thornton as well as the usual suspects from Amberhawk http://www.amberhawk.com/bookevents.asp

References

“The Recitals are essential to your understanding the General Data Protection Regulation”: http://amberhawk.typepad.com/amberhawk/2016/01/the-recitals-are-essential-to-your-understanding-the-general-data-protection-regulation.html

ICO draft guidance on GDPR consent and consultation document (closes on march 31); https://ico.org.uk/about-the-ico/consultations/gdpr-consent-guidance/

Optical Express Tribunal: http://informationrights.decisions.tribunals.gov.uk//DBFiles/Decision/i1628/EA-2015-0014_31-08-2015.pdf