Hawktalk

Is the definition of “personal data” in new DP Bill correct?

Have you ever come to a conclusion that worries you and you can’t find the error?

Well since it’s Friday tomorrow I will ask a Friday question today; the question is: ‘Is the definition of “personal data” in the new Bill fit for purpose?’.

In summary, I think there is a problem with “personal data” definition in the Data Protection Bill (“DPBill”) as there is no equivalent of Section 1(2) of the Data Protection Act (“DPA”). This Section extends the definition of certain “processing” operations (e.g. a disclosure of recorded personal data) to include the disclosure of the same personal details if the information is not recorded.

For completeness, under Section 1(2) the processing operations of “using or disclosing” extends to “using or disclosing the information contained in the data”; similarly, with “obtaining or recording” which extends to the “information to be contained in the data”.

So why is an equivalent of Section 1(2) needed in the DPBill? Well to get to the answer to this question, one has to consider the first limb of the definition of “data” in the DPA.

The definition of “data” in the DPA

The first limb of the definition says that “’data’ means information which is being processed by means of equipment operating automatically in response to instructions given for that purpose”. Note that there is no indication here that the information is recorded or not, so in theory it could be both.

However, it can be seen that to be able to “process” data (i.e. “perform an operation on the data”), it follows that the information has to be recorded so the “equipment operating automatically” can carry out such an “operation”. In short, personal data has to be “recorded”.

However, Section 1(2) extends that definition of specific processing operations (e.g. disclosure) to information that is not recorded.

For example, suppose a private investigator wants me to illicitly use my access to a bank’s database to find out Mary Smith’s home address and account details. If I send these details to the investigator by email, I am disclosing recorded data.

However, if I meet the investigator in the pub and say “Mary Smith lives at 55 Acacia Avenue”, I am not disclosing any recorded data but rather the “information contained in the data”.

From Mary Smith’s perspective, the impact of each disclosure is the same; it does not matter whether the disclosure of personal data was made from recorded personal data or not.

In addition, as far as the DPA is concerned, because of Section 1(2), there is no difference between the actual disclosure of personal data and the disclosure of the information contained in the personal data. Both disclosures are subject to application of the data protection principles and the enforcement regime of the ICO.

DPBill’s definition of “personal data”

The definition of “Personal data” in the DPBill means “any information relating to an identified or identifiable living individual”. It can be seen that, as with the DPA, the “information” about an individual need not be recorded to qualify as personal data (unrecorded gossip about an individual in a conversation can, according to this definition, be personal data).

In the DPBill, there is no qualification on the word “information” as there is, for example, in Section 84 of the Freedom of Information Act which requires the “information” in FOIA to be recorded.

Likewise, the definition of “processing” in Clause 2(4) (like the DPA) states that “processing, in relation to personal data, means an operation or set of operations which is performed on personal data, or on sets of personal data…”. Such processing operations can include “disclosure” or “use”.

Thus if “information” is to be “processed” under the DPBill it requires the personal data to be recorded in order it can be subject to “an operation… performed on personal data”. It then follows that if the information is not recorded, it is not being processed under the DPBill as it cannot be subject to “an operation”.

Now consider the Principle in Article 5(1)(f) (“personal data processed in a manner that ensures appropriate security…”). This means, through the word “processed”, that the security obligations apply to recorded information about an individual (and not to unrecorded information which may be disclosed in a conversation).

So, suppose a controller fails to train his staff and a staff member discloses information in an unrecorded form. Is that controller in breach of the security principle? Well if you follow the argument with respect to the unrecorded information, the answer is “NO”?

Of course, one might argue that some processing of personal data had occurred previously (e.g. that processing that displays the personal data on a member of staff’s screen in order to facilitate a subsequent verbal disclosure). But if you go down that route, other issues arise.

For example, any anonymous data derived from personal data could be caught by a data protection regime on the grounds that personal data once had been processed in order to generate the anonymised form which is then disclosed.

Either way, there appears to be a problem. Of course, if the DPBill had its equivalent of Section 1(2) the loop-holes described above would not arise (hopefully it will be amended).

Conclusion

At the beginning of the blog I asked a simple question.

Now can I ask a really scary Friday question: since the definition of personal data in the DPBill is that of the GDPR: “do all data protection laws in the EU contain the same flaw?”.

Happy weekend.

Courses (London, Edinburgh)

• DATA PROTECTION BCS FOUNDATION QUALIFICATION: Edinburgh (3,4 and 5 October).

• GDPR/DP Bill WORKSHOPS: Edinburgh (6 October).
• DATA PROTECTION BCS PRACTITIONER QUALIFICATION: The next intensive DP courses is in London (starts 13 November).

• NEW DATA PROTECTION BILL ALL DAY UPDATE: London (20 November)

Definitions in new DP Bill weaken protection for data subjects

Like many people, I am ploughing through the new Data Protection Bill (“DPBill”) Bill; when I have enough for a blog, I will write one.

In this blog, I show that some definitions used in the Bill could have significant negative consequences for data subjects. For instance: 

• the removal of “Representative” means that the DPBill cannot be enforced against, for example, USA data controllers not established in the UK.
• the treatment of “Accessible Record” and “unstructured manual files” in the DPBill leaves an obvious weakness.
• the “Special Purpose” is being extended to include academic purposes and this could create an alternative to the research purposes exemption.
• the Government has delivered a “Special Purpose thank-you” to the newspaper proprietors that normally support its political views.

In the Naomi Campbell privacy cases, Moreland J. described making conclusions from the Data Protection Act 1998 (“DPA”) was like “weaving his way through a thicket”; Lord Philipps at the Court of Appeal agreed and added: “the Act is certainly a cumbersome and inelegant piece of legislation”. Good job they were not looking at the DPA’s replacement; I find it horrendous. 

However, here is a tip. Look at Clause 20(1) as that applies most of the GDPR as UK law, Schedule 6 essentially apply a list of modifications, deletions or additions to the standard GDPR text. Do those changes and hey-presto, you have a copy of the active GDPR provisions as it applies to most data controllers.

Note that as the UK has said that most of the Articles of the GDPR are now part of the DPBill, it has allowed any related Recital which expands on that Article to become relevant. This means the ICO, Tribunals and Courts can use the Recitals in any interpretation of the DPBill implementation in the UK (e.g. in ICO Guidance). 

I don’t understand why the DCMS has not released a copy of the GDPR with the changes implemented by the Government in the DPBill; they must have one. 

Finally, can I have one caveat; if you think I am mistaken please put a comment in. This Bill does your head in.

Removal of “Representative” 

The Government has removed some of the extra-territorial elements in the GDPR in its DPBill (and no reason has been given). Schedule 6, paragraph  9(d) for instance removes all mention of “representative” from the DPBill; this could have very major consequences for data subjects.

In summary, Article 3 of the GDPR extends its provisions to the processing of personal data of data subjects in the Union by a controller not established in the Union. This happens when a controller is the offering goods or services into the European Union or monitoring of data subjects’ behaviour as far as their behaviour takes place within the European Union.

In such circumstances, Article 27 requires a “representative” to be appointed in a Member State if controller is not in the Union (this Article is removed by paragraph 23 of Schedule 6).

Recital 80 explains the role of the “representative”:

 “…The representative should act on behalf of the controller or the processor and may be addressed by any supervisory authority…. (and) ... cooperate with the competent supervisory authorities on any action taken in ensuring compliance with this Regulation. The designated representative should be subject to enforcement proceedings in the event of non-compliance by the controller or processor”. (my emphasis).

So, suppose a USA company is not established in the UK (as defined in Clause 168) but still falls within Article 3; such a company could be established in the USA and uses its USA website to offer services to UK citizens.

Suppose something goes wrong; as there is no representative in the UK “the data subject is stuffed” to coin a descriptive phrase. All rights and obligations cannot be enforced through the representative as described in Recital 80.

The provision makes no sense especially as our hypothetical USA company, if it is trading in the UK, is likely to be trading in other EU countries and will need to appoint a representative elsewhere in the EU. Why should the Europeans have a representative and not UK citizens?

Finally, the fact that Clauses 137(9), 138(8), 168 and 185 refers to the removed Article 27 and representative definition; this does not engender confidence that this issue has been thought through.

The demise of “Accessible Records”

Another deficiency in the DPBill that is easy to spot is the treatment of the processing of unstructured manual personal data. The best way to get to this deficiency is to consider the removal of Accessible Record classification of “data” which appears in the DPA but not in the DPBill.

This limb to the definition of “data” was the mechanism through which, the rights of access granted by the Access to Personal Files Act 1987 and by the Access to Health Records Act 1990 to living individuals, could be repealed and incorporated in to DPA’s right of access for data subjects. The definition has no structural or filing system requirements; for instance, a single page from a set of medical notes is an Accessible Record.

By contrast, the DPBill applies to “automated or structured processing of personal data” and “manual unstructured processing of personal data held by an FOI public authority” (Clause 19). It can be seen therefore that manual unstructured processing of personal data held by an organisation that is NOT a FOI public authority is not covered by the DPBill.

So, suppose a private hospital dumps some old manual patient records in a skip. So long as the processing operation of “placing information in the skip” related to a set of unstructured manual records, then the provisions in the DPBill, as far as I can see, do not apply.

This is completely unlike the current DPA, where assuming the patients are alive, unstructured manual health records are Accessible Records containing sensitive personal data; these data are fully subject to the DPA (and where a monetary penalty notice would be the expected penalty if randomised health records were found abandoned in a skip).

With respect to manual unstructured processing of personal data held by a FOI public authority the Principles do not apply (see Clause 22(2)(2)(a)(i) of the DPBill). This provision exempts “Articles 5(1)(a) to (c), (e) and (f)” (principles relating to processing, other than the accuracy principle)”.

As Article 5(1)(f) requires the controller to process personal data “in a manner that ensures appropriate security….” there are no security obligations arise with respect to all manual unstructured processing of personal data. This is an obvious loop-hole.

The Government thus need to explain:

• why the DPBill allows any unstructured personal data held by any controller to be exempt from security obligations?
• if unstructured personal data held by a public sector controller can be subject to the right of access and the correction (via the Accuracy Principle), why can’t the same provisions apply to unstructured personal data processed by the private sector controller?

Academic research could be a “Special Purpose”?

“Academic purposes” is added to the Special Purpose, and as with the current DPA, qualifies for an exemption from all Principles except security and all rights if the personal data are processed with a “view to publication”. In the DP Bill, the ICO cannot use the powers of enforcement as such powers can be stayed by a Court. 

The “Explanatory Notes” state that “The inclusion of academic purposes extends the existing special purposes definition under section 3 of the 1998 Act to include academic purposes in line with Article 85 of the GDPR”.   This protects, for instance, a controversial academic article about a celebrity politician who is alive and litigious (President Trump comes to mind). 

However, much academic processing of personal data will be for a research purpose (i.e. falls within Article 89 of the GDPR). It easy to see that some research of public importance happening in circumstances where the exemption for research was improperly applied. For example, if the research personal data were collected in the absence of proper transparency arrangements or perhaps a ground for the processing.

In such circumstances, if the enforcement occurred, would the lawyers for the researchers explore the public interest in the “freedom of speech exemption for academics” in order to exempt the First Principle? You bet.

There is a need to distinguish processing of personal data that would fall within Article 89 research exemption from that which is subject to Article 85 freedom of speech exemption. This to my mind, this is a rather obvious problem that should have been recognised and resolved in the text of the DPBill.

Special Purpose “thank-you” and journalism

The data protection offence in Clause 161 remains just like Section 55 in the DPA. It is non-custodial and the Government has not followed the pleas of several Parliamentary Committees or of the ICO for over a decade.

It has also ignored the recommendations of the Leveson Inquiry concerning the non-custodial nature of this offence. The Government has not even transcribed the power in Section 77 of the Criminal Justice and Immigration Act 2008 into the DPBill in order to have the option of implementing a custodial sentence.

This in my view also undermines the level of protection afforded to data subjects; it sends the message that journalists can continue blag away to their heart’s content to obtain the lurid stories that sell tabloid newspapers.

I also note that the Government has given recognition to the Independent Press Standards Organisation (IPSO), established by the press proprietors who were opposed to the Leveson recommendations. The Government has legislated to make IPSO’s Code of Practice as creating the correct balance between the freedom of expression and privacy (see Schedule 2, Part 5, paragraph 5 of the DPBill).

The Government has not recognised IMPRESS, the alternative press regulator, whose Code of Practice has gone through all the Leveson hoops.

Has this been explained by Government? Course not – but I am sure the move will get 100% unconditional backing of the Daily Mail, Daily Telegraph and the Murdoch Press.

Final comment

The DPBill is 212 pages of impenetrable reading and I suspect there are several drafting problems lurking within. There is a significant risk that the Courts and Tribunals could interpret the DPBill in a way that was not intended.

By then, of course, it will be too late.

Courses (London, Edinburgh)

• DATA PROTECTION BCS FOUNDATION QUALIFICATION: Edinburgh (3,4 and 5 October).

• GDPR/DP Bill WORKSHOPS: Edinburgh (6 October).
• DATA PROTECTION BCS PRACTITIONER QUALIFICATION: The next intensive DP courses is in London (starts 13 November).

• NEW DATA PROTECTION BILL ALL DAY UPDATE: London (20 November)

 

 

Draconian powers in EU Withdrawal Bill can negate new Data Protection law

Unless the European Union (Withdrawal) Bill is modified, the new Data Protection Bill that implements the UK’s version of the GDPR (expected tomorrow) can be modified or even repealed using Ministerial powers that are not subject to detailed scrutiny. 

Indeed, I will go so far to say that the European Commission would be advised not to grant the UK the status of offering an adequate level of protection until further legislative guarantees are enacted by the UK. So bad is the position. 

So how did I get to this conclusion. Can we start with the Regulation itself? 

• Article 1(2) of the GDPR states that “This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data”.
• Recital 1 of the GDPR explains that “The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her”.
• Recital 4 adds: “This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data ….” (my emphasis).

So, the purpose of the Regulation is to provide the detail implementation of the “right to data protection”.  This right is enshrined by Article 8 of the Charter which under the heading “Protection of personal data” states:

• “Everyone has the right to the protection of personal data concerning him or her.
• Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
• Compliance with these rules shall be subject to control by an independent authority”. 

Also, relevant to this blog is Article 7 of the Charter, which repeats the text of Article 8(1) of the European Convention of Human Rights (“Everyone has the right to respect for his or her private and family life, home and communications”); i.e. the "right to data protection" is additional to the A.8 ECHR right.

The European Union (Withdrawal) Bill

The important elements of the Bill are as follows:

• Clause 5(4): “The Charter of Fundamental Rights is not part of domestic law on or after exit day”. Comment: on “exit day” the rationale for implementing the GDPR also goes.
• Clause 6(1): “A court or tribunal (a) is not bound by any principles laid down, or any decisions made, on or after exit day by the European Court, and (b) cannot refer any matter to the European Court on or after exit day”.  Comment: ECJ decisions are not binding in UK legal cases after exit day; however Clause 6(4)(a) states at any time before exit day, the Supreme Court is not bound by cases such as Lindqvist (domestic purposes), Breyer (definition of personal data), Schrems (independence of data protection authorities) and Gonzalez (Right to be forgotten).
• Clause 6(2): “A court or tribunal need not have regard to anything done on or after exit day by the European Court, another EU entity or the EU but may do so if it considers it appropriate to do so”. Comment: decisions of the European Data Protection Board (if it is an EU entity) to harmonise the GDPR are not binding in the UK; if the Board is not an EU entity, then its decisions are not binding as the Charter of Fundamental Rights is not applicable.
• In several Clauses, the Bill states (e.g. Clause 7(6)): “But regulations under this section may not…(e) amend, repeal or revoke the Human Rights Act 1998 or any subordinate legislation made under it”. Comment: Human Rights Act cannot be amended but this safeguard has to be considered in the context that Mrs May is also seeking to repeal this Act (see references).
• In several clauses (e.g. Clause 17(1)) there are powers where: “a Minister of the Crown may by regulations make such provision as the Minister considers appropriate in consequence of this Act” where the powers may modify primary and secondary legislation but not “primary legislation passed or made after the end of the Session in which this Act is passed”. Comment:  The Data Protection Bill is not legislation enacted after the Withdrawal Bill; as it falls in the same Session of Parliament as the Withdrawal Bill, the DP Bill can be amended using Withdrawal Bill powers.

Finally, I want to explain two “features” of the Withdrawal Bill: 

• “Exit day” is not when the UK leaves the EU. In the Bill, it “means such day as a Minister of the Crown may by regulations appoint”; so there might be many exit days!!
• The powers are only exercisable for two years after “exit day” and in the vast majority of cases exercised by reference to negative resolution procedures. This means the powers are used, perhaps with some limited scrutiny by a Committee of MPs, where the House as a whole has to vote down the use of powers (i.e. even if the Committee is 100% opposed to the exercise of powers, that does not negate their use).

Commentary

Just imagine you are at the European Commission and you can see the following consequences of the Withdrawal Bill on the new UK Data Protection law. For example:

• UK Ministers can change the UK's GDPR implementation in its new Data Protection Act at any time from exit day in any direction using powers that are not scrutinised.
• There is no guarantee that established case law derived from ECJ Decisions or harmonising determinations from the European Data Protection Board are considered in cases involving personal data about European citizens processed by UK data controllers.
• Legal arguments such as “the Charter of Fundamental Rights is no longer applicable in the UK, therefore the basis of the UK’s Data Protection regime has questionable legal foundations” are possible in the UK. If these succeed the new DP Act cannot be enforced.
• The Withdrawal Bill explicitly protects the Human Rights Act; it does not protect the new Data Protection Act. Therefore, the latter is vulnerable to modification.

Given the above, would you give the UK an adequacy determination?

In my view, it does not matter what the Data Protection Bill contains or even how good it is; the Government’s incoherent approach to Brexit has just undermined the whole data protection show.

Courses

• DATA PROTECTION BCS FOUNDATION QUALIFICATION: Edinburgh (3,4 and 5 October).
• GDPR/DP Bill WORKSHOPS: Edinburgh (6 October).
• DATA PROTECTION BCS PRACTITIONER QUALIFICATION: London (13 November).
• NEW DATA PROTECTION BILL ALL DAY UPDATE: London (20 November)

References

The European Union (Withdrawal) Bill and related Explanatory Notes can be found at http://services.parliament.uk/bills/2017-19/europeanunionwithdrawal.html

Mrs May’s opposition to the Human Rights Act: http://amberhawk.typepad.com/amberhawk/2017/01/why-the-uk-is-unlikely-to-get-an-adequacy-determination-post-brexit.html