Hawktalk

Conservative manifesto hints at gradual ECHR withdrawal and the establishment of a national population register?

As is usual, this is my summary of the extract of all the main Party Manifestos that relate to data protection and human rights (Article 8 and 10) issues.

The main controversy relates to the Conservative manifesto which hints at leaving the ECHR after the next General Election in 2022 and raises the prospect of the establishment of a national population register.

I explain any controversy in comments associated with the relevant parts of the manifestos below. However, in summary:

1. All Parties, except the Conservatives and UKIP, are wholly committed to the European Convention of Human Rights; Conservatives are lukewarm on Human Rights and its commitment to the Human Rights Act is just for the next Parliament.
2. All Parties are in favour of Leveson II, except for the Conservative Party; this means that custodial sentences via Section 55 of the Data Protection Act will not be commenced if Mrs May is returned as Prime Minister and are unlikely to appear as part of the UK’s implementation of the GDPR. UKIP are silent on Leveson.
3. The Conservative Party wants to establish a Data Use and Ethics Commission that risks a clash with the role of the Information Commissioner; the Commission has been set up to advise on the wider (but ethical) use of personal data.
4. The Conservative Party also want “Health and Social care guardians” to be placed on a statutory footing; this overlaps with the statutory role of data protection officers (a requirement for public bodies under the GDPR) who also have such care guardians.

Anyway here goes; happy reading. Whatever your views: vote not veto.

CONSERVATIVE

“We will not bring the European Union’s Charter of Fundamental Rights into UK law. We will not repeal or replace the Human Rights Act while the process of Brexit is underway but we will consider our human rights legal framework when the process of leaving the EU concludes. We will remain signatories to the European Convention on Human Rights for the duration of the next parliament.” Comment: I think the commitment to ignore the Charter is unsustainable for data protection as non-adherence to CJEU rulings on the data protection elements of the Charter will jeopardise any post-Brexit adequacy determination (assuming there is one). It is also unsustainable for any data controller want to offer services into the EU irrespective of Brexit outcome, as the GDPR is directly applicable to such controllers; such controllers cannot ignore the CJEU.

“Protections for people’s data online, backed by a new data protection law. Safety for children online, and new rights to require social media companies to delete information about young people as they turn eighteen.” Comment: there is no mention that these objectives are a requirement of the GDPR.

“To create a sound ethical framework for how data is used, we will institute an expert Data Use and Ethics Commission to advise regulators and parliament on the nature of data use and how best to prevent its abuse. The Commission will help us to develop the principles and rules that will give people confidence that their data is being handled properly.” Comment: there is a hint here that if the Commission finds something “ethical” it will become “lawful” through legislation (such as the wider data sharing elements of the Digital Economy Act which authorises data sharing which is “not necessary” for the functions of public bodies; the standard established by Schedule 2, paragraph 5 of the DPA). There is also no mention that the GDPR is intended to put data subjects in control of the processing of their personal data via the stronger consent requirements.

“Alongside this commission, we will bring forward a new data protection law, fit for our new data age, to ensure the very best standards for the safe, flexible and dynamic use of data and enshrining our global leadership in the ethical and proportionate regulation of data.” Comment: there is no mention that the UK has to implement the GDPR; this commitment is not a Conservative initiative, it is a European one.

“We will put the National Data Guardian for Health and Social Care on a statutory footing to ensure data security standards are properly enforced.” Comment: Implicitly, this infers that data security standards are not properly enforced by the Data Protection Act (and I agree with this implication).  As security standards can be reinforced by the enhanced enforcement powers in the GDPR, this commitment in the manifesto is otiose.

That is why we shall roll out Verify, so that people can identify themselves on all government online services by 2020, using their own secure data that is not held by government. We will also make this platform more widely available, so that people can safely Verify their identify to access non-government services such as banking”. Comment: the Government’s Verify identity scheme was under pressure; it appears that the pressure is off.

“We will set out a strategy to rationalise the use of personal data within government, reducing data duplication across all systems, so that we automatically comply with the ’Once-Only’ principle in central government services by 2022 and wider public services by 2025.”. Comment: : this “once-only” objective infers the establishment of a national population register using the wide data sharing powers in the Digital Economy Act 2017; big databases such as the one associated with the discarded National Identity Card could well be back on the agenda.

“We will not proceed with the second stage of the Leveson Inquiry into the culture, practices and ethics of the press.” Comment: this should not be understood as a “quid pro quo” for the Party’s support in the Brexit supporting tabloid press; the abandonment of Leveson II is unique to the Conservatives.

LABOUR

“The Conservatives threaten our Human Rights Act and may withdraw us from the European Convention of Human Rights. Labour will retain the Human Rights Act”.

“Labour is committed to growing the digital economy and ensuring that trade agreements do not impede cross-border data flows, whilst maintaining strong data protection rules to protect personal privacy.”

“We will implement the recommendations of part one of the Leveson Inquiry and commence part two which will look into the corporate governance failures that allowed the hacking scandal to occur.”

LIB DEM

“We will vote against any attempts to scrap the Human Rights Act or withdraw from the European Convention on Human Rights and we will strengthen the UK’s commitment to international human rights law.”

“Introduce a digital bill of rights that protects people’s powers over their own information, supports individuals over large corporations, and preserves the neutrality of the internet.”

“In light of the press’s failure to engage in effective self-regulation, seek to ensure delivery of independent self-regulation, and commence part two of Leveson.”

“Roll back state surveillance powers by ending the indiscriminate bulk collection of communications data, bulk hacking, and the collection of internet connection records.” Comment: this commitment is unique to the Lib Dems.

“End the ministerial veto on release of information under the Freedom of Information Act, and take steps to reduce the proportion of FOI requests where information is withheld by government departments.” Comment: this commitment is unique to the Lib Dems.

SNP

“The European Convention on Human Rights (ECHR) is enshrined in the Scotland Act 1998, ensuring that human rights are protected by the Scottish Government and all Scottish legislation. The SNP re-affirms its commitment to the Council of Europe, the ECHR and their institutions. We will fight to protect human rights across the UK. SNP MPs will oppose any attempts by the UK government to scrap the Human Rights Act and withdraw the UK from the ECHR." Comment I did not find anything on data protection.

UKIP

“Repeal Labour’s Human Rights legislation and remove the UK from the jurisdiction of the European Court of Human Rights and introduce a new UK Bill of Rights.”  Comment I did not find anything on data protection.

GREEN

“Defend the Human Rights Act and UK membership of the European Convention on Human Rights, and reinstate funding for the Equality and Human Rights Commission.” Comment I did not find anything on data protection.

WELSH NATIONALIST, DUP, SINN FEIN etc

Could not find anything on the topics; I will add it if someone provides a URL.

Other Publicity

Forthcoming  Amberhawk’s courses in early summer

• DP Practitioner Course: starts 6 June (Leeds)and 11 July (London)
• DP Foundation Course: starts 4 July (London)
• Next GDPR Workshop: 20 July (London)

References:

Happy reading: just Google “xxxxx Party Manifesto 2017” where xxxx is the name of the Party.

Is the NHS ransomware incident a reportable data loss?

Are you gob-smacked by the fact that the NHS were relying on Windows XP, an operating system first released in 2001, which Microsoft stopped supporting in April 2014?

Did you know that the Government paid Microsoft £5.5million to support XP for a further year but decided not to renew that contact after May 2015?

Did the Government, in particular Secretary of State for Health Jeremy Hunt, make a funding decision that exposed NHS systems?

Why did NHS bodies not manage to migrate from Windows XP in good time?

Using the Watergate questions: “What did key decision takers in the NHS know and when did they know it?", I think the Information Commissioner can provide some independent insight.

Was there a breach of the DPA?

When the ransomware attack succeeded in blocking the use of health personal data is there a breach of the Data Protection Act?

As the malware encrypted files of personal data (and perhaps deleted back up files, as is often the case with ransomware), then there would have been processing operations performed on personal data.

The first paragraph of the interpretation of Seventh Principle states that the controller:

Having regard to the state of technological development and the cost of implementing any measures, the measures must ensure a level of security appropriate to.

(a)the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage as are mentioned in the seventh principle, and

(b)the nature of the data to be protected.

It is clear, therefore, that there are several breaches of the Seventh Principle (e.g. failure to take “appropriate” technical measures). For instance, that reliance on unsupported Windows XP is hardly “state of the art” as the malware exploited an antiquated operating system to encrypt, without authority, files containing personal data. The harm was experienced by data subjects through cancelled procedures or out-patient clinic appointments and the failure to patch or migrate from XP was foreseeable.

Such data subjects can ask for an assessment and the ICO can (and in my view, should) determine whether enforcement action is appropriate.

Is there a reportable loss of personal data?

The technical problem concerning reportability is, that at first glance, there is no processing of personal data that results in a “normal” data loss, say where a database is deleted or accidently attached to an email.

However, the word “security” in the context of IT equipment and data is often defined in terms of “confidentiality, availability and integrity”. In the ransomware infections, the personal data were not-available at the correct time, for example, to treat a patient. Implicitly therefore, the personal data were effectively “lost” at the time they were needed by the data subject and by the data controller.

It is this equation of non-availability of personal data at the material time that gives rise to a “loss” of personal data. It follows that such data losses are reportable by all NHS Trusts who experienced the ransomware outage.

Another way of looking at this situation are circumstances that arise when personal data are “lost” and “found” (which the ICO has often enforced previously). In infected systems, the personal data are “lost”; however, once the malware is removed or the ransom paid, the personal data are recovered (i.e. found). If the ransomware takes its course, then the personal data are definitely lost.

That is why I think there is a data loss, and this data loss reporting will form the basis for an independent report into the issue.

What about fines?

In my view, there has been a breach of the Seventh Principle, the issue then becomes whether the breach has caused a “serious contravention” of this Principle and was “the contravention of a kind likely to cause substantial damage or substantial distress”. I think that given some patient interviews (e.g. cancelled heart operations) on the TV, the answer is “yes”.

Should the data controller “knew or ought to have known” that the contravention was likely to cause substantial damage or substantial distress. Clearly again, the answer is “yes” especially as security risk assessments undertaken by some NHS bodies who have been reported in the press that they identified the lack of patching for Windows XP as an urgent security issue that needed addressing.

So, NHS bodies could be at risk of receiving a Monetary Penalty Notice. However, the Secretary of State, who is also a serious candidate for the accolade of “villain of the piece”, is not a data controller. It is the NHS bodies he funds who are controllers.

What about compensation?

I am sure that many patients could have a claim for compensation, but what is the level of compensation for an out-patients’ appointment delayed for a fortnight or so? Not much I suspect in many cases (e.g. half day wasted, travel costs etc). Given the effort involved in getting a small claims case together, I am pretty sure that there will not be many cases arising from this incident.

Clearly, however, some delays could result in considerable damage and distress depending what was the nature of the delay but I suspect that patients at medical risk and whose procedure was delayed would be treated in order of medical risk (i.e. serious cases first). Given that most NHS Trusts were back up by 6pm Saturday, there again, I expect the degree of damage is likely to be limited.

I conclude that no-win, no fee, ambulance chasers will have a hard time finding suitable cases. There might be the odd case; not many.

Concluding comments

Finally, all the organisations involved in the ransomware recovery operation are public bodies that report to two Secretary of States seeking re-election. Given the non-stop mantra of “strong and stable” which characterises this General Election, Ministers are not going to enter a plea of “mea culpa” and admit that their decisions have thrown the NHS into chaos.

However, the overriding conclusion is that NHS bodies are in the firing line and should be reporting the data loss. This contrasts with the Secretary of State, who in data protection terms, is not in the frame for anything.

Much like Macavity the Mystery Cat, he is not there!

Other Publicity

Forthcoming  Amberhawk’s courses in early summer

• DP Practitioner Course: starts 6 June (Leeds)and 11 July (London)
• DP Foundation Course: starts 4 July (London)
• Next GDPR Workshop: 20 July (London)

References:

XP withdrawn in May 2015: https://www.theguardian.com/technology/2015/may/26/uk-government-pcs-open-to-hackers-as-paid-windows-xp-support-ends

Excellent blog on the issues from two Professors of IT security:

• Professor Ross Anderson (Cambridge Uni); https://www.lightbluetouchpaper.org/2017/05/13/bad-malware-worse-reporting/ and
• Professor George Danezis (UCL): https://conspicuouschatter.wordpress.com/2017/05/13/the-politics-of-the-wannacrypt-ransomware-outbreak/

Commissioner should enforce First Principle when personal data are processed in breach of Article 8 ECHR

Yesterday, the Court of Appeal achieved something that the Information Commissioner (ICO) has been trying to do for nearly a decade; to require a review of procedures that allow for the disclosure (or non-disclosure) of criminal convictions that have no relevance to employment.

For example, in the last Annual Report (2016) the previous Commissioner noted his inability to help the data subject:

“We considered a complaint from an individual who had a request for deletion of an arrest record refused. As the record would remain until the individual was 100 years old we considered that the refusal was disproportionate...” (page 24).

All I would say is that if the retention of personal data was deemed to be “disproportionate” then the processing should also be deemed to be in breach of Article 8 right; after all the Fifth Principle is linked to the Article 8 through the test of necessity explicitly found in the Principle (“personal data ..shall not be kept for longer than is necessary for that purpose....”).

However, hitherto, the ICO has a track record of not pursuing this type of enforcement action except in two cases; hopefully, this Court of Appeal will cause a review of this position as it joins four cases, three of which involved a breach of the Article 8 right (i.e. criminal offence personal data should not have been disclosed).

All four cases could have been raised as data protection assessments under the banner of unlawful processing in breach of Article 8, or that the processing of personal data was “unnecessary” for the functions of public authority (i.e. the public authority had no Schedule 2 ground for the processing).

To my mind, the judgement shows the need for the ICO to become the first port of call when personal data are processed and when the data subject claims that such processing constitutes an unlawful interference into private life by a public body. This requirement will become more important in future; for example, when the distinctly “iffy” data sharing powers in the Digital Economy Act 2017 are used by public bodies (see references).

Missing protection

The judgment sets out certain considerations used in Northern Ireland where there is an independent review scheme (with a filtering mechanism) in respect of criminal record disclosures. These considerations deserve wider currency (because they could be considered by employers as well as the police) and include:

“The nature of the position being applied for;

The seriousness of the offence(s);

How long ago the offence(s) occurred;

How many offences are being disclosed and, if more than one, whether or not they arose out of a single court hearing;

When the information would be considered for filtering (i.e. minor crimes are filtered out of disclosure, whereas more serious ones are disclosed); and

The age of the applicant at the time of the offence(s), including, in those cases where the applicant was under the age of 18 years, the need to have the best interests of children as a primary consideration".

The consequences of the absence of such a review in the cases before the Court of Appeal were clearly set out in its judgement; the Court commented:

“… in a number of cases, there is simply no mechanism for undoing the damage done by the inclusion of a conviction or caution. This is irrespective of the triviality of the circumstances, the lapse of time since the events, or the lack of its relevance to the future pursuit of the employment or other activity sought to be undertaken” (para 34).

The offences under consideration

Case 1: P committed two shoplifting offences in 1999 when suffering from undiagnosed schizophrenia. She was also homeless and failed to appear at court (a crime under the Bail Act 1976) and was therefore convicted of two offences. In 2014, some 15 years later, P wanted to be a care assistant and was told that her pattern of offending behaviour (i.e. the two convictions) meant that this was unlikely.

The Court of Appeal determined that “it is not a necessary inference that two convictions do represent a pattern of offending behaviour” and concluded “the convictions (the first theft resulting in a caution) were for theft and failing to answer bail. Although connected because of P's mental health issues, they do not reveal anything like a pattern”. Hence the Court held that the multiple conviction rule was disproportionate in its current automatic form to the interference with P’s life, especially as it did not generate any public safety issue.

Case 2: G aged 13 had had consensual anal intercourse with two boys aged 9 and 10, and was reprimanded in 2006 by the police. In 2011, he worked for an employment agency in a library of a local college and was asked for a detailed enhanced Criminal Record Check because his work involved contact with children. He withdrew from the post as he was informed that personal data describing his serious sexual offences were to be disclosed.

In this case, the Court concluded that “The critical element of this serious offending is G's age at the time; under 14, he was a child”. It added that in his case, “sexual curiosity and experimentation” should not have been equated to sexual exploitation. However, the judgment added that “had G been slightly older, even maintaining the age gap between him and the boys involved”, the Court might have come to a different conclusion.

Case 3: W was 16 years old, when in 1982 he was convicted of Actual Bodily Harm for which he received a conditional discharge. In the 31 years that had passed, W committed no further offence and made a success of his life. He wished to obtain a qualification teaching English as a second language and, to that end, in 2013, he began a training course with a view to obtaining a Certificate in English Language Teaching to Adults. However, the details of the 30+ year old offence were disclosed.

Unsurprisingly, the Court concluded that it was difficult to see how this offence “31 years on, is relevant to the risk to the public, or proportionate and necessary in a democratic society”.

Case 4: Ms Krol was seen by police hitting her 3 year old daughter as homework was not completed; as a result she was cautioned for Actual Bodily Harm. In her case, this was aggravated by later allegations of violence, of her giving a false name to the police to prevent knowledge of earlier involvement with social services, and ultimately the child was subject to the making of a care order. This retention and disclosure of personal data was held by the Court to be proportionate.

Why the need for an Article 8 enforcement?

I have long argued that the Data Protection Act is not fully equipped to protect data subjects when a public authority improperly exercises its powers. In my article (“Nine principles for assessing whether privacy is protected in a surveillance society”; see references), I raised the problems that arise for data protection enforcement if surveillance legislation states that X items of personal data are to be processed for purpose P1 for Y years, and are to be disclosed to Third Party Z for purpose P2.

In such circumstances, it is going to be very difficult for a data subject to claim that the First, Second, Third and Fifth Data Protection Principles have been breached because the enactment of surveillance legislation establishes that:

• the processing purposes (P1,P2) are lawful and compatible (i.e. the key First and Second Principle obligations are satisfied assuming the conditions for any surveillance are met);
• the disclosure of personal data, if exempt from the non-disclosure provisions, would exempt fairness and other Principles as needed (e.g. in terms of the Second Principle, the statutory gateway effectively makes the Third Party’s disclosure purpose compatible with the Data Controller’s purpose of obtaining);
• the retention of personal data satisfies the Fifth Principle because of there is a statutory obligation to retain the data; and
• the items of personal data would satisfy the Third Principle as there is a statutory obligation to process specific data (i.e. the surveillance legislation makes the data items relevant to the purpose).

In other words, the only real issue that can be tested is whether the surveillance legislation itself was “necessary” and “proportionate” in terms of Article 8 (e.g. to assess whether the “necessity” test in a chosen Schedule 2 ground for the processing is passed).

The reason why the ICO should become the enforcer arises because the protection of the Human Rights Act is not accessible to the public at large; an individual complainant has to take on the State in a David versus Goliath struggle.

So, it is in this case. Claimants P, G, W and Ms. Krol (whose collective income is likely to be less than £200,000) were taking on the Secretary of State for the Home Department (budget £12.13 billion), the Secretary of State for Justice (£7.73 billion), the Chief Constable of Surrey Police (£0.21 billion) and Commissioner of Police of the Metropolis (£3.24 billion).

In other words, it's £0.002 billion versus £23.31 billion.

This inequality of alms would be much reduced if the Information Commissioner could intervene or even threatened to intervene. After all, testing the detail of Article 8 claims before the Information Tribunal would be much cheaper for the claimant than testing them in the higher Courts where the risk of bankruptcy would be ever present.

For example, in my criticism of the Digital Economy Bill (see references), I raised the issue that disclosures to public authorities authorised by the Bill were intended not always going to be “necessary” for the functions of that public body (unbelievable! see references).

So, assuming data subject consent for the disclosure of personal data is absent and the disclosure is not necessary for the functions of the public authority then quite clearly unlawful processing in terms of Article 8 is the obvious route for data subjects seeking an assessment.

That is why the enforcement of Article 8 by the ICO is essential; it would level the playing field in many cases as described above and help ensure that public authorities do not play fast and loose with their powers.

Other Publicity

Forthcoming  Amberhawk’s courses in early summer

• DP Practitioner Course: starts 6 June (Leeds) and 11 July (London)
• DP Foundation Course: starts 4 July (London)
• Next GDPR Workshop: 20 July (London)

References:

P,G,W and Ms Krol v. Secretary of State for Home Department & others ([2017] EWCA Civ 321, Court of Appeal, 3 May 2017) http://www.bailii.org/ew/cases/EWCA/Civ/2017/321.html

A previous blog in 2009 I argued that the ICO was targeting the wrong data controller when criminal records were being disclosed: Data Protection: CRB could stop misuse of irrelevant criminal data in employment vetting http://amberhawk.typepad.com/amberhawk/2009/10/data-protection-crb-could-stop-misuse-of-irrelevant-criminal-data-in-employment-vetting.html

A plea on the lines of this blog in 2010: Information Commissioner should enforce Article 8 privacy rights: http://amberhawk.typepad.com/amberhawk/2010/04/information-commissioner-should-enforce-article-8-privacy-rights.html

Reference to the cases where the ICO has taken action re criminal records and employment (2014): Can the Commissioner enforce the correct part of the First Principle, please? http://amberhawk.typepad.com/amberhawk/2014/05/can-the-commissioner-enforce-the-correct-part-of-the-first-principle-please.html

The ICO has run the Article 8 argument in 2012 (we need a lot more of this): Information Commissioner’s enforcement proceedings links Article 8 to unlawful processing. http://amberhawk.typepad.com/amberhawk/2012/11/information-commissioners-enforcement-proceedings-links-article-8-to-unlawful-processing.html

Comment on the Digital Economy Act 2017: the data sharing issues have been side-lined because a yet unpublished Code of Practice is to provide for significant protection. There is a review of data sharing provisions in 3 years time and some truly awful Henry VIII powers have been removed. When the Code of Practice is published, I suggest you compare the content against the issues identified in my blog: http://amberhawk.typepad.com/amberhawk/2016/11/digital-economy-bill-data-sharing-provisions-undermine-parliamentary-scrutiny-and-create-privacy-ris.html

Nine principles for assessing whether privacy is protected in a surveillance society (2008): http://link.springer.com/article/10.1007/s12394-008-0002-2