UK’s GDPR law will not be judged “adequate” if it contains provisions that made the DPA inadequate

Many readers know that, since 2005, I have tried to use Freedom of Information legislation to find out what is behind the “on-going” infraction proceedings, commenced by the European Commission against the UK. This is because the UK’s Data Protection Act (DPA) is, according to the Commission, a defective implementation of Directive 95/46/EC.

So what are these defects? Should data protection practitioners know what they are?

Readers also know the answer to both questions is a resounding “NO” as publishing the requested data protection detail would cause irreparable damage to international relations between the UK and the European Union (re-confirmed in ICO Decision Notice FS50577377, dated March 2016)!

So, after the Brexit referendum vote, I tried the European Union’s Access to Documents regime (Regulation (EC) No 1049/2001), and received another refusal to add to my collection. The refusal letter, dated mid-November last year, confirms that there are still major problems with the DPA; of the 20+ problems with the DPA identified by the European Commission in 2005, four of them are serious and remain unresolved in 2017 (in the run up to GDPR implementation).

Surprisingly, even information about the 16+ resolved issues remain a state secret. For instance, paragraph 33 of the 2016 Decision Notice confirms that the release of these details would cause “prejudice to international relations”. The ICO concluded that “…having viewed the withheld information, the Commissioner is satisfied that there would be a real and significant risk of prejudice …to the relationship between the UK and the European Commission”.

Indeed, someone who said he was “close to GCHQ/MI6” took me to one side at this month’s ICO conference. He told me that if I were to be given the top-secret list of data protection indiscretions on the part of the UK, (none of which relate to national security, crime and taxation etc I should add) then the damage to EU-UK relations would be so high that the European Commission’s mission in London would have to close, and the UK Ambassador to Brussels would become persona non grata.   I was advised to "back-off" whatever that means.

A score of problems

In this blog, I update readers with the latest chapter in this saga. I report the contents of a six page refusal letter, dated 14/11/2016, which contains comments relevant to a UK adequacy decision under GDPR (see references: Document 0-6 where each is a single page)

The important comments are:

• the first complete paragraph at the top of Document 3 shows that the alleged defects in the UK’s DPA will be assessed in the context of the UK’s GDPR implementation and “could possibly lead to a complementary reasoned opinion”. In other words, if the identified DPA defects remain when the UK implements the GDPR, that implementation is likely to be judged defective.
• the bottom of Document 4 and top of Document 5 where the Commission confirm that “investigations are active and ongoing”; this means the DPA is still deemed to be defective. In other words, if the current DPA is defective in terms of Directive 95/46/EC it will also defective in terms of the GDPR (i.e. the status quo cannot remain as a basis for an adequacy determination by the Commission).

Where is the DPA defective?

The main areas of concern about the DPA in the context of the GDPR that I have identified in this decade long FOI process are as follows:

1. The definition of “personal data” takes no account of Recital 26 of Directive 95/46/EC.  The definition of “personal data” in the DPA requires personal data to relate to an identifiable data subject where that identification is undertaken by only the data controller. By contrast, Recital 26 suggests identification can be undertaken by the controller and, within reason, persons other than the controller. The UK Act definition of personal data is therefore unduly restrictive and has been so since 1998. The same problem is in the GDPR definition of “personal data”.
2. The definition of “Relevant Filing System” of the DPA is not the definition of “Filing System” in the Directive 95/46/EC. Whilst the Directive allowed Member States to go their own way with manual filing systems this flexibility is not in the GDPR (which maintains the Directive definition). I have included it in my list as this could be a major headache for controllers preparing for the GDPR; personal information in manual filing systems that are excluded from the definition of “data” in the DPA (and therefore are excluded from any DP obligation as the information is not personal data) become fully subject to the GDPR in May 2018.
3. The Information Commissioner in the DPA has limited role in assessing whether third countries offer an adequate level of protection (e.g. she does not authorise or approve transfers in a way other European data protection authorities do). The DPA is unique in that data controllers can assess adequacy (something removed in the GDPR unless very exceptional circumstances arise).
4. The Information Commissioner cannot perform random audit checks on any data controller/data processor under the DPA.  There is a limited ability to audit Government Departments, NHS and Telcos but this came after the Commission commenced its “on-going” infraction proceedings in 2005.
5. The Monetary Penalty regime is too restrictive (e.g. it requires serious breach that causes real or likely substantial damage/distress). I suspect the Commission would prefer penalty fines for many lesser infringements, and that if the UK maintains the current enforcement regime in the GDPR, it risks being judged as being inadequate.
6. There is no ability (except for judicial review) for the data subject to challenge the Information Commissioner’s failure to enforce the DPA against a data controller. Whereas a data controller can appeal to the Tribunal against the ICO’s enforcement action in general, there is no equivalent appeal mechanism available to data subjects. The main enforcement regime is therefore unbalanced and comprise last resort powers that are designed only to be used (e.g. Enforcement Notices; Information Notices) when a data controllers does not “co-operate” with the ICO’s wishes. That is why there are very few Information Notices, for example.
7. The Courts in the UK have unfettered powers to exempt personal data from subject access in circumstances when the exemption is not grounded in the exemptions found in Directive 95/46/EC (this arises from the use of “may” in Section 7(9) of the DPA).  In addition, the Courts could even refuse to order inaccurate personal data to be corrected or erased (the use of “may” in Section 14).  I should add that I find both problems to be hypothetical and I am not aware of any case where these Sections have proved to be a problem but I do know the Commission is concerned about this.

Note that the last five in the above list relate to enforcement issues and improperly implemented data subject rights. They serve to reinforce the widely-held perception in Europe that the UK enforcement regime is weak.

Some of the issues raised by the Commission have been resolved by the UK Courts over time.  For instance, the right to compensation in the DPA was limited to damage that could be assessed on monetary grounds. In the case of Johnson v Medical Defence Union, the Court of Appeal stated that compensation for distress would only be available where a claimant could also show pecuniary loss.

This was overturned in the Court of Appeal in Google Inc. v Vidal-Hall & Ors which ruled that section 13(2) of the Data Protection Act should be ignored as it was a deficient implementation of Article 23 of Directive 95/46/EC. Note that it took 14 years, and a long march through the legal institutions, to fix this “bug”.

Other issues have been resolved by CJEU Judgements which do not apply in a post-Brexit UK.  For instance, I am sure that the domestic purpose exemption (Section 36 of the DPA) was criticised by the Commission as being too broad; this was subject to a landmark ruling in Lindqvist which narrowed its scope to processing of personal data for “purely personal” matters.

I do not know what the missing 10+ issues are; they have to be kept secret so not to “prejudice international relations”.  However, one of my FOI requests did require the UK Government to publish a list of which Articles of the Directive (all 17 of them) where there was an issue (see references).

Commentary

The fact that a score of issues was identified as potential defects suggests that the DPA was, from the European perspective, implemented well below the minimum standard required (and deliberately so).   Quite simply the UK has applied a “minimal implementation” policy to the implementation of Directive 95/46/EC.

If this policy continues with GDPR implementation (e.g. all the indications are that Government intend to take maximum advantage of the flexibility that the GDPR gives to Member States in 50+ Articles), then a minimal implementation policy is likely to jeopardise any adequacy determination by the European Commission.

The conclusion that I have reached is that the risk of a “GDPR-lite” implementation is significant; it follows that the risk of the UK not getting an adequacy determination is therefore high. That is why my blog on “a hard-Brexit a gonna fall” could be very relevant to readers with Third Country transfer issues (see references).

This conclusion is not helped by stated Government policy that, in a post-Brexit UK, it can ignore CJEU judgements (and by implication European Data Protection Board determinations concerning harmonising the GDPR across European Union). Such a policy, if implemented, is also likely to jeopardise any adequacy determination from the Commission.

In summary, 60,000,000 UK data subjects, 500,000 data controllers and a host of Parliamentary Committees have been kept ignorant, for over a decade, about the alleged defects in the UK’s DPA by successive governments. From the ID Card database in 2004 to the widespread data sharing policies of the Digital Economy Bill of 2017, Ministers down the ages have reassured Parliament that privacy is preserved: “Don’t worry, the personal data are protected by the DPA”.

All these statements are wholly misleading, and in many circumstances, Ministers or their Civil Servants knew they were misleading. Any evidence lies in these infraction documents which, for reasons I cannot fathom, are being kept secret.

This state of affairs now risks carrying over to the GDPR. If so, then this could torpedo any hopes of an adequacy determination by the Commission.

Other Publicity

Forthcoming  Amberhawk’s courses in April/May

• Next GDPR Workshop: 19 April (London)
• DP Practitioner Course: Starts 28 March (BCS syllabus; London)
• DP Practitioner Course: Starts 8 May (BCS syllabus; Edinburgh)
• FOI Practitioner Course: Starts 18 May (BCS syllabus; London)

UPDATE: we have devoted the next UPDATE day-long session on 3^rd April 2017 to the GDPR. We have an impressive array of speakers lined up including from ICO, Hunton & Williams, DMA and Grant Thornton as well as the usual suspects from Amberhawk http://www.amberhawk.com/bookevents.asp

References

If a hard Brexit a-gonna fall what then happens to overseas transfers of personal data? http://amberhawk.typepad.com/amberhawk/2017/01/if-a-hard-brexit-a-gonna-fall-what-then-happens-to-overseas-transfers-of-personal-data.html

List of Articles of Directive 95/46/EC where there was an issue: Download Uk-deficiency-details_may-2011

Please download the letter here: Download Document 1  Download Document 2  Download Document 3  Download Document 4  Download Document 5  Download Document 6

A DOZEN YEARS OF SECRECY: INFRACTION BLOGS (AND YEAR OF BLOG)

(2014) European Commission raises infraction threat to UK on failing to implement Directive 95/46/EC properly via the Data Protection Act http://amberhawk.typepad.com/amberhawk/2014/10/european-commission-raises-infraction-threat-to-uk-on-failing-to-implement-directive-9546ec-properly.html

(2011) What is wrong with the Data Protection Act? FOI Infraction saga hits the buffers. http://amberhawk.typepad.com/amberhawk/2011/10/what-is-wrong-with-the-data-protection-act-foi-infraction-saga-hits-the-buffers.html

(2011) Privacy: new Government revelations amplify concerns surrounding deficiencies in UK’s Data Protection Act http://amberhawk.typepad.com/amberhawk/2011/05/privacy-new-government-revelations-amplify-concerns-surrounding-deficiencies-in-uks-data-protection-.html

(2009) Data Protection Act fails to implement 50% of the Directive? http://amberhawk.typepad.com/amberhawk/2009/11/data-protection-act-fails-to-implement-50-of-the-directive.html

(2007) Europe claims UK botched one third of Data Protection Directive: https://www.out-law.com/page-8472

(2004) European Commission suggests UK’s Data Protection Act is deficient; https://www.out-law.com/page-4717

(2004) UK’s Data Protection Act might not meet European Union standards: https://www.out-law.com/page-4549