Hawktalk

Human rights, data protection and what’s in the political manifestos

This is my review of the relevant part of the Conservative, Labour and Liberal Democrat Manifestos as they relate to data protection and human rights.  I present a series of quotes from each Manifesto so that readers can quickly see what has been promised by the three main Parties before drawing a few summary conclusions.  The Manifestos are all available online.

Conservative Manifesto

Strengthening the position of the Executive branch of Government: “After Brexit we also need to look at the broader aspects of our constitution: the relationship between the Government, Parliament and the courts; the functioning of the Royal Prerogative; the role of the House of Lords; and access to justice for ordinary people. The ability of our security services to defend us against terrorism and organised crime is critical.”

Modifying Human Rights and reducing access to Judicial Review: “We will update the Human Rights Act and administrative law to ensure that there is a proper balance between the rights of individuals, our vital national security and effective government”….and “We will ensure that judicial review is available to protect the rights of the individuals against an overbearing state, while ensuring that it is not abused to conduct politics by another means or to create needless delays.”

Review of Parliamentary Democracy: “In our first year we will set up a Constitution, Democracy & Rights Commission that will examine these issues in depth, and come up with proposals to restore trust in our institutions and in how our democracy operates”.

Leveson ditched: “We will not proceed with the second stage of the Leveson Inquiry” and “To support free speech, we will repeal section 40 of the Crime and Courts Act 2014, which seeks to coerce the press.  (Section 40 states that those publishers who refuse to sign up to the Royal Charter-backed press regulation system – which many Conservative supporting papers have refused to join - will have to pay both sides’ costs in libel and privacy disputes, win or lose)”.

Cybersecurity: “We will adapt to new threats, investing more in cybersecurity and setting up the UK’s first Space Command”.

Labour Manifesto

Permit wider UK research access to NHS personal data: “We will ensure data protection for NHS and patient information, a highly valuable publicly funded resource that can be used for better diagnosis of conditions and for ground-breaking research. We will ensure NHS data is not exploited by international technology and pharmaceutical corporations.”

Cybersecurity: “A Labour government, ever more dependent on digital technology, will overhaul our cybersecurity by creating a co-ordinating minister and regular reviews of cyber-readiness. We will review the role and remit of the National Cyber Security Centre to determine whether it should be given powers as an auditing body, with the ability to issue warnings to private and public sector organisations and designate risk”.

Cybersecurity and crime: “We will also review the structures and roles of the National Crime Agency, to strengthen the response to all types of economic crime, including cybercrime and fraud, and ensure a modern, technologically advanced police service that has the capacity and skills to combat online crime, supported by a new national strategy on cybercrime and fraud.”

Human Rights protected: Labour will “take steps to safeguard LGBT+ rights inside or outside the EU, such as retaining and promoting the Human Rights Act…. We are guided by our firm commitment to the Human Rights Act and Convention on Human Rights that have been consistently attacked by the Conservatives.  We will ratify both the Istanbul Convention on preventing domestic abuse and the ILO Convention on Violence and Harassment at work”.

Alternative to Leveson: “We will address misconduct and the unresolved failures of corporate governance raised by the second stage of the abandoned Leveson Inquiry. We will take steps to ensure that Ofcom is better able to safeguard a healthy plurality of media ownership and to put in place clearer rules on who is fit and proper to own or run TV and radio stations. We will take action to address the monopolistic hold the tech giants have on advertising revenues and will support vital local newspapers and media outlets.

Liberal Democrat Manifesto

Political adverts on social media: “Work towards radical real-time transparency for political advertising, donations and spending, including an easily-searchable public database of all online political adverts.”

Defend Human Rights:  “Resist any attempt to withdraw from the European Convention on Human Rights and oppose any laws that unnecessarily erode civil Liberties”;  “Standing up for human rights by championing the Human Rights Act and the European Convention on Human Rights”.

Transparency of processing: “Empower consumers and ensure that everyone can enjoy the benefits of new technology, by setting a UK-wide target for digital literacy and requiring all products to provide a short, clear version of their terms and conditions, setting out the key facts as they relate to individuals’ data and privacy.”

Empower consumers and data subjects: “Ensure that everyone can enjoy the benefits of new technology, by setting a UK-wide target for digital literacy and requiring all products to provide a short, clear version of their terms and conditions, setting out the key facts as they relate to individuals’ data and privacy”.

Data and Processing Ethics: “Introducing a Lovelace Code of Ethics to ensure the use of personal data and artificial intelligence is unbiased, transparent and accurate, and respects privacy and give the Centre for Data Ethics and Innovation the power to ‘call in’ products that appear to breach this Code”.

Some limits on national security and law enforcement processing: “Establish a firewall to prevent public agencies from sharing personal information with the Home Office for the purposes of immigration enforcement and repeal the immigration exemption in the Data Protection Act”; “end the bulk collection of communications data and internet connection records”, and “immediately halt the use of facial recognition surveillance by the police”.

Leveson: “Introduce a Leveson-compliant regulator to be given oversight of both privacy and quality, diversity and choice in both print and online media and proceed with Part Two of the Leveson Inquiry”.

My summary

In data protection and human rights terms, it is clear that the main Parties are offering a significant choice.

• the Conservative Manifesto is intended to strengthen the position of the Executive in Parliament and to protect it from legal action taken by data subjects. The Manifesto provides a “big thank you” to the Party’s tabloid friends, and is likely to make it more difficult to commence judicial review by crowdfunding (e.g. like the judicial reviews concerning facial recognition or the immigration exemption).  It promises to establish a British Human Rights regime (which like the UK_GDPR, could diverge from European human rights norms).
• the Liberal Democrats’ Manifesto is the most data subject friendly and offering the complete opposite to the Conservatives. Empowered consumers, ethical processing, more protection for data subjects, less data sharing, no facial recognition by police and Leveson implemented.
• the Labour Party Manifesto, like its policy towards Brexit, sits on the fence. There is more data sharing for research in the NHS (but not for Donald Trump’s Yankie Pharma); Leveson is dropped in favour of Ofcom regulation, whilst cybersecurity is centre stage (perhaps as a result of recent hacking events on the Labour website). However, the Human Rights regime is safe.

Happy voting.

New Year Data Protection Courses (in London)

All courses lead to the relevant BCS qualification:

• Data Protection Practitioner: January 14-16, 28-30 (6 days)
• Data Protection Foundation: February 11-13 (3 days)
• Data Protection Upgrade Practitioner: February 19-20 (2 days)
• Data Protection Practitioner: February 25-27, March 10-12 (6 days)

Full details on www.amberhawk.com of by emailing [email protected]

 

Using GDPR rights to stop misleading political advertising

I have to admit I was depressed at the “doctoring” of the interview between the presenters of Good Morning Britain and Sir Keir Starmer MP by the Conservative Party in the first week of November. In a general election, voters need information not disinformation.

For those not familiar with what I am talking about, an edited recording of an interview with the Labour politician was used in a political advert.  However, a long pause was edited into the recording just after a question on Brexit policy was asked by a presenter; this gave the impression that Starmer was totally stumped to provide a credible answer.

The unedited recording of the interview showed the MP providing an immediate answer.

No doubt this many saw the edited clip as an example of modern-day political cut and thrust which made valid political points; many forwarded this clip one this basis to their contacts. On the other hand, many saw it as an example of the diminishing standards of political discourse; and also distributed it on this basis.  So, whatever your views on the clip, it was widely distributed – which of course was the point of producing it.

I have to confess I am in the latter group.  This kind of advertising was endemic in the Brexit debate will continue unabated during this and future campaigns.  This is confirmed by yesterday’s Sunday’s Observer; headlines such as “Voters ‘used as lab rats’ in political Facebook adverts” and analysts warn “all Parties are all involved in a targeted experiment that campaigners warn lacks transparency and could harm democracy”.

So, as a follow up to the last blog, I have drafted a letter for data subjects to send to the various political parties (and supporting groups as appropriate) so they can opt-out of all political adverts; each voter can protest at the misinformation endemic in current political debate by exercising their GDPR rights.

In general, controllers who send targeted adverts by social media will be taking a risk if they have not implemented procedures to satisfy the rights of data subjects (especially if it is in the thousands of data subject).  This is true for all social media adverts but the advantage of applying this to political parties first, is that these parties will unambiguously have your personal data (e.g. electoral roll details).

The political parties might argue that they have a month to deal with rights and this takes us over the December 12 deadline.  This is half true: the rights have to be satisfied “without undue delay and in any event within one month of receipt of the request” (so a month is the maximum) so they could be vulnerable (e.g. failure to remove your details from the copy of the Electoral Roll they have obtained should not take a month).

But the target here is not really the current Election – it is to ensure that in ALL future elections, political parties have to implement procedures to deal with rights.

The draft letter below is addressed to the Conservative Party (as they produced the clip about Sir Keir Starmer MP), but clearly it can be edited and sent to any party.  If a group “Friends of Party X” use targeted ads, the letter can be used (but you will need to edit it).

DRAFT LETTER

Dear Conservative Party,

I draw your attention to the “doctored” recording, produced by the Party, of the interview between the presenters of Good Morning Britain and Sir Keir Starmer MP that was circulated via social media on 6^th and 7^th November.

This is my personal protest at the standard of your political advertising material being sent to voters which is deliberately harming democracy and political debate.

I am exercising the following rights under the General Data Protection Regulation (GDPR), Data Protection Act 2018 (DPA2018) and Privacy and Electronic Communications Regulations 2003 (PECR).

I am withdrawing any consent you believe you have that justifies the processing of my personal data.  This withdrawal of consent extends to any processing of personal data, or where the activity is subject to PECR, that results in political advertising messages sent by me (e.g. by email or as a result of any social media targeting), or sent to me on your behalf (e.g. by your contractors or supporters).  The withdrawal of consent includes any processing that results in a profile being applied to me which is intended to reveal my political opinions.

I also exercise the right to erasure to my personal data; this applies to all personal data held by you except those personal data that you are required by law to process or which are needed for a suppression list (see below).

I draw your attention to the fact that, although your Party has the statutory right to obtain personal data from the Electoral Register, this does not extend to all the subsequent processing of personal data so obtained.

If you are of the view that the lawful basis for some processing is “legitimate interests” (Article 6(1)(f) of the GDPR) or “democratic engagement” (Article 6(1)(e)), I also exercise the right to object to such processing.  The grounds relating to my situation is that are that there is considerable risk that I will be sent misleading political marketing material similar to the doctored Keir Starmer clip.

I am therefore exercising my right to object to this processing of personal data under these two lawful bases.  This right to object augments the right to object to marketing which I am also exercising.

It could be that you need further information from me to establish a suppression list so you do not send me your marketing material; if so please let me know what details you need.  To help you with a social media suppression list, I use the following pseudonyms: Twitter is hawktalk_blog; facebook is ……….. etc etc. (PUT YOUR DETAILS IN HERE).

Please take this email as a notice in writing in accordance with Schedule 1, paragraph 22 of the DPA2018; this means that political parties cannot rely on this paragraph to process personal data that reveals my political opinions.  This extends to any social media partner where you instruct them to identify my political views from my social media activity in order to send me your election material.

Finally, I apply for subject access request to my personal data which is applicable when you have heeded the above.  I suspect very little personal data will be left in your possession.

Yours etc

Name and postal address

Conclusion

Each voter has the ability not to receive misleading political adverts; the more the GDPR rights are exercises, the louder the political message that is sent. It all depends whether enough voters say "I don't want political disinformation sent to me".

Email contacts for exercise of rights

Conservative Party: objections by e-mail to [email protected].  

Labour Party: objections by email to [email protected]

Lib Dems;  objections by e-mail to [email protected]

Brexit Party; objections by e-mail to: [email protected]

Scottish National; objections by e-mail to [email protected]

For Northern Ireland Parties (e.g. DUP, UUP, SF), Greens, Welsh Nationalists, Choice UK etc have a look at the respective website for a suitable email.

ADVERT

Our popular UPDATE session AGENDA for Monday, 18 November 2019, in London is:

Update on Brexit, adequacy and the replacement for the Privacy and Electronic Regulations. Elisabeth Stafford, DCMS, Head of Policy on EU Data Flows

Case Law Review or Morrisons case.  Rosemary Jay (Solicitor, Hunton Andrews Kurth LLP)

"Google's approach to transparency, control and grounds for processing" ; William Malcolm; Legal Director of Google, Privacy

Update on PI’s campaign against ad-tech companies and mental health websites. Eliot Bendinelli, Privacy International

News from the FOIA/DPA interface? Sue Cullen (Director, Amberhawk)

Guidance from the ICO/EDPB checklist and related comments. Dr. C. N. M. Pounder (Director, Amberhawk).

News Roundup: Recent enforcement and audit reports. Dr. C. N. M. Pounder (Director, Amberhawk)

Venue for the Update is in Central London (near Chancery Lane Tube); £260+VAT for the day, booking arrangements from  http://www.amberhawk.com/bookevents.asp  or by emailing [email protected]