Hawktalk

Valid or dodgy EU Referendum? Misuse of personal data is a constant factor

I am going to enter the fray about the data protection events surrounding the EU Referendum and the delayed Parliamentary report into Russian interference; it is only now the full story can be told.

This story contains a few incredible chapters: (a) the breaches of the law with respect to the-use of personal data during the Referendum campaign; (b) non-cooperation by leading actors with Parliamentary Committees and investigations, (c) deliberate obstruction (at best) and lying (at worst) and (d) the reporting of important detail in easy-to-miss footnotes.  Sometimes I think, you can’t make this stuff up.

In addition, I doubt very much one main conclusion of the Parliamentary Intelligence and Security Committee Report (the “ISC Report”).  This was that no national security agency took responsibility to have a closer look at Russian interference in the EU Referendum and in the subsequent General Elections.

Warnings from the USA’s Presidential Election (2016)

First I want to consider the hacking of the Democratic National Committee (DNC), most likely by the Russians, and the publication by WikiLeaks of the products of that hacking.  In GDPR terminology, either the hacking or the publication of personal data would be classified as a reportable data breach.

Additionally, if there is a UK-USA Trade deal (assuming no UK-EU deal) then Ministers have powers in the Data Protection, Privacy and Electronic Communications (EU Exit) Regulations to determine adequacy for the USA (via negative resolution procedures with no input from Parliament or the ICO) as part of the deal.

Will Ministers actually use these powers? Well if they are desperate for a trade deal with the USA they might.

So who in the USA are we dealing with? The chronology of relevant events that relate to the DNC data breach could be helpful:

• 22 July 2016: WikiLeaks commence a series of “slow leaks” of embarrassing emails and other information from the DNC that stop in mid-October just before November’s election. Six months later (January 2017), Julian Assange gave interviews where he stated the source of the WikiLeaks emails was not the Russian Government nor a state official.
• 28 July 2016: Republican Candidate Donald Trump publicly invites Russian to find 33,000 missing emails which he accused Hillary Clinton of deleting deliberately. Trump repeatedly draws attention to the DNC data breach during the campaign and encourages more data breaches (e.g. “ I love WikiLeaks”).
• 9 December 2016: a report from the three U.S. Intelligence Agencies (CIA, NSA, FBI) collectively conclude that Russia conducted the cyberattacks and other operations during the 2016 U.S. election. A declassified version of the report (6 January 2017) states that the Russia leadership developed a clear “preference for President-elect Trump”.
• 14 November 2017: it is widely reported in the press that there had been contact between the President’s son (Donald Trump Jnr) and WikiLeaks during the 2016 Presidential campaign. On 19 July 2020, extracts from the Mueller Report that had been previously redacted, shows Roger Stone (a confidential messenger used by the Trump campaign) and Julian Assange had also communicated several times during the 2016 campaign at the time of the release of the WikiLeaks information.
• 19 February 2020: Julian Assange’s legal team claim that President Donald Trump offered Julian Assange a pardon if he went on the record to say that Russia was not involved in a leak of DNC emails (see first bullet above); the claim is dismissed as a “hoax” by the White House.
• 13 July 2020: Roger Stone is pardoned by President Trump for crimes related to obstructing justice, witness tampering and making false statements under oath about his WikiLeaks communications.

I suspect that Privacy Shield was rejected in part because of executive power over the operation of national security legislation (e.g. to determine USA national security access to personal data) rests with the President who is capable of acting in a way described in the chronology.

Finally, note the USA Intelligence Community studied Russian Interference and reported that there were significant risks within 2 months of the Presidential Election result in 2016.  So would you expect therefore that the UK’s intelligence community would also look at the EU Referendum result where the UK voted to leave EU (51.9% to 48.1%) also in 2016?

I think the answer is “yes”.

The role of the national security agencies

According to the ISC Report, the national security agencies did not explore the issue of Russian interference in the Referendum result, even though all the USA Intelligence Agencies did so with respect to the Presidential election.  If the ISC Report is to believed, the UK national security agencies did not even compare notes about the nature, extent and form of the Russian interference that both countries may have experienced in 2016.

The ISC asked the obvious “what did you do to protect the referendum?” question and reported:

“In response to our request for written evidence at the outset of the Inquiry, MI5 initially provided just six lines of text”.

“The brevity was also, to us, again, indicative of the extreme caution amongst the intelligence and security Agencies at the thought that they might have any role in relation to the UK’s democratic processes, and particularly one as contentious as the EU referendum” (Paragraph 40)

I do not find this explanation credible.  This is because, according to the Security Service Act 1989, it is the express role of MI5 to protect the democratic process:

“The function of the Service shall be the protection of national security and, in particular, its protection against threats from espionage, terrorism and sabotage, from the activities of agents of foreign powers and from actions intended to overthrow or undermine parliamentary democracy by political, industrial or violent means (my emphasis of Section 1(2))

According to the Intelligence Services Act 1996, the powers of MI6 and GCHQ are available “in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty’s Government in the United Kingdom” (my emphasis again).  As the Referendum was intended to be binding on the Government, it is clear that either outcome of the vote (Leave or Remain) would determine a very significant foreign policy for the Government.

In other words, protecting the Referendum from Russian interference was the statutory role of ALL three national security agencies.  That is what the USA intelligence community understood when it published its collective declassified report in January 2017.

I can see one national security agency making a mistake over its statutory role in a way described by the ISC Report.  However, I cannot see ALL three national security agencies making the same mistake over their statutory role.

There is no evidence of….

Paragraph 44 of ISC Report states that:

“The written evidence provided to us appeared to suggest that HMG had not seen or sought evidence of successful interference in UK democratic processes or any activity that has had a material impact on an election, for example influencing results”.

At the bottom of page 16 of the Government’s response to the ISC Report, there is a standalone sentence that states:

“We have seen no evidence of successful interference in the EU Referendum”.

The use of the word “successful” (emphasised in the two quotes above) is curious;  does it mean there is evidence of “unsuccessful interference” (i.e. examples of interference that was not successful whatever “successful” interference looks like).  The ISC did not report on that issue.

On 11 July 2016, Mrs May won the Conservative Party leadership race with the slogan that unified the Party; readers might remember it (“Brexit means Brexit”).  Its use meant that she became Prime Minister two days later and took ultimate responsibility for national security issues.  Also as Home Secretary from 2010, Mrs May had developed close links with leading MI5 staff and its role.

One wonders whether a more likely scenario, to that proposed by the ISC, exists. Namely, that the national security agencies collectively decided that there would be a quieter life if they did little and served the Prime Minister’s view of Brexit in a hope that it would put the divisive Brexit debate to bed.

The alternative of doing nothing would be to do something (e.g. open an investigation into a close vote which, if the USA report is to be believed, could produce evidence of Russian influence) and create more controversy.

In other words, by keeping schtum the national security agencies collectively decided not to open a very large can of worms by choosing not to deliver on their statutory duties as described above.

Vote Leave: unlawful breach of DP and Electoral law

There were two main organisations processing personal data for a “leave the European Union” result in the Referendum;  they were “Vote Leave” and “Leave.EU”.  As will be seen both were fined for breaches of data protection and electoral law, and ignored subsequent Parliamentary inquiries.

Vote Leave was designated by the Electoral Commission as the official campaign in favour of leaving the European Union in the Referendum; its Campaign Director was Dominic Cummings (of Barnard Castle fame).  Vote Leave was found to be in breach of Electoral spending laws by the Electoral Commission and fined £61,0000; for breaches of PECR, the ICO fined Vote Leave £40,000. These fines were not challenged.

Vote Leave used a Canadian organization (AIQ) to run 1,390 adverts on Facebook on behalf of the pages linked to the referendum campaign between February 2016 and 23 June 2016 inclusive. AIQ subsequently received and Enforcement Notice for breaches of the GDPR (e.g. Article 6 and Principles in Article 5).

Vote Leave even wanted to take Judicial Review to keep an Electoral Commission report into Vote Leave’s unlawful behaviour a secret.  Permission to undertake Judicial Review was refused in the Court of Appeal (on 12 November 2019): Lord Justice Underhill commented that “there is an important public interest in public bodies with an investigatory function being as open as possible about inquiries which they have conducted”. (Reference: [2019] EWCA Civ 1938).

Leave.EU: unlawful breaches of DP and Electoral law

Leave.EU: was an organization wholly financed by Mr. Aaron Banks, who according to the ISC Report, became the biggest donor in British political history when he gave £8million to the Leave.EU campaign (Footnote 50).

Mr. Banks claimed the donations were lawful donations from his companies. However, the Observer reported (8 July 2018) that the Leave.EU campaign team met with Russian embassy officials as many as 11 times in the run-up to the EU referendum; the article inferred that various Russian business opportunities could have been offered as a quid pro quo (a Latin term often used by USA politicians).

On 1 February 2019, Leave.EU was fined £15,000 for sending almost 300,000 unsolicited emails on a single day (September 15, 2015) for which they did not have consent (these emails were from customers for Mr. Banks’ Insurance interests whose data was used to promote Leave.EU purposes) and £45,000 for sending 1,021,000  direct marketing emails without the required consent (these emails were from Leave.EU lists used to promote Mr. Banks’ Insurance interests). Mr. Banks insurance company was also fined £60,000.

Leave.EU was also fined £70,000 in May 2018, by the Electoral Commission for financial irregularities.  Electoral Commission noted that in April 2017, it:

 “… opened an investigation into Leave.EU. We asked Leave.EU, Mr Banks and Mr Wigmore for information about the matters under investigation, and invited Mr Banks and Mr Wigmore to interview. Mr Banks provided some high level responses but declined an interview. Mr Wigmore did not respond.”

Partly as a result of this non-cooperation, the Electoral Commission then passed the question of Leave.EU’s unexplained multi-million pound donation to the National Crime Agency (NCA) because it suspected a crime under electoral law.

The NCA concluded its investigation (24 September 2019) and reported that no prosecution would occur as “The NCA has not received any evidence to suggest that Mr Banks and his companies received funding from any third party to fund the loans, or that he acted as an agent on behalf of a third party”. (Note by CP: if there were to be a quid pro quo understanding, as inferred by the Observer, there is unlikely to be any documented evidence of a loan or a financial transaction).

That was the end of the criminal investigation. However paragraph 55 of the ISC Report notes that “…the NCA lacks the resources required in terms of financial investigators, technical experts and legal expertise – this must be rectified”.

In summary,  questions about the competence of the NCA investigation remain as well as more obvious issues (e.g. did the NCA consult the national security agencies?).

Should the public know the answers? The Government’s answer is “No”.

Vote Leave: non-cooperation with “Fake News” Inquiry

The Parliamentary DCMS Select Committee attempted to understand the role of Social Media by Vote Leave and Leave.EU.   It produced two Reports into “Disinformation and Fake News”;  a Final Report and Interim Report.  Both reports are well worth reading, but I want to focus on the lack of co-operation by Vote Leave and Leave.EU.

Vote Leave ignored the Committee completely. The DCMS Committee, in Footnote 13 stated  that:

“Dominic Cummings also refused to give oral evidence to the DCMS Committee. The Committee published its Third Special Report of Session 2017–18, “Failure of a witness to answer an Order of the Committee: conduct of Mr Dominic Cummings, on 5 June 2018”.

“The Report informed the House of Mr Cummings’ failure to report to the Committee. The Committee sought an Order of the House requiring Mr Cummings to agree a date for his appearance before the Committee. The House issued the Order, with which Mr Cummings did not comply. The Matter was referred to the Committee of Privileges on 28 June 2018.”

Committee of Privileges Report (published 27 March 2019) stated that:

“We recommend that the House should admonish Mr Cummings for his contempt. We recommend that, following recent practice the admonishment should take the form of a resolution of the House. This resolution, if agreed to, should be communicated to Mr Cummings by the Clerk of the House”.

A motion approving the Privileges Report took place on 2 April 2019; I presume the “who has been a naught boy then” admonishment was delivered to Mr. Cummings.

Leave.EU: non-cooperation with “Fake News” Inquiry

Leave EU was also immersed in a “Fake News” controversy. For example, in April 2019, Channel 4 News found that an anti-immigration viral video produced by Leave.EU during the campaign was faked, and that the campaign appeared to have staged photos of immigrants attacking women in the United Kingdom.

Leave.EU unlike Vote Leave at least turned up to give evidence.  However, this progress was somewhat diminished by the Final Report’s conclusions at paragraph 147:

As set out in our Interim Report, Arron Banks and Andy Wigmore showed complete disregard and disdain for the parliamentary process when they appeared before us in June 2018. It is now evident that they gave misleading evidence to us, too, about the working relationship between Eldon Insurance and Leave.EU. They are individuals, clearly, who have less than a passing regard for the truth. (my emphasis)

Concluding comments

I have three comments.

The Government has announced that it will implement an imprints regime for digital election material; this will ensure greater transparency and make it clearer to the electorate who has produced and promoted online political materials in future elections.  However, that does not deal with the events of 2016 and the above story of delay, unlawful processing, non-cooperation and obfuscation.

Given Mr. Cummings’ position in Government as the Prime Minister’s right hand man, the disdain and non-accountability exhibited by Mr. Cummings towards data protection law sits very uneasily with his ability to influence any future policy towards the processing of personal data by Government (e.g. data sharing).

For what it’s worth, my own view can be expressed by Shakespeare’s famous line from Hamlet: “Something is rotten in the state of Denmark”.

Upcoming Data Protection Courses (in Autumn)

Obviously COVID19 has put a spanner in the training works, but the following courses are scheduled for the Autumn now lockdown is unlocked (fingers crossed).

All courses lead to the relevant BCS qualification:

• Data Protection Practitioner: London, Starts Sept 22 (6 days)
• Data Protection Foundation: London, Oct 13-15 (3 days)
• Data Protection Practitioner: Edinburgh, Starts Nov 23 (5 days)

Full details on www.amberhawk.com of by emailing info@amberhawk.com

References

You should be able to Google all the main references by dates and keywords: (e.g. NCA, Leave.EU);  (Stone, pardon) or (Cummings; Barnard Castle). If you have difficulties, contact me by the emailing info@amberhawk.com

Standard Contract Terms post Schrems II: when do you need additional safeguards for data subjects?

This week has seen quite a lot of commentary concerning Standard Contract Terms (SCCs) and the possible need to augment them with additional safeguards when transferring personal data to a Third Country.

The problem has arisen because the Schrems II judgement (see references) viewed the SCCs as providing a baseline of Data Protection safeguards.  It suggested that the controller and processor should implement further safeguards if required,  and if the additional safeguards (if required) could not be implemented, then the transfer to the Third Country should not occur.

The problem is the “if required” (i.e.  “what should a controller/processor consider in order to assess when such additional safeguards are needed?”).  My answer is look to the DPA1998 transfer provisions and this blog explains why this helps.

I should add that this blog is not limited to SCCs; any transfer of personal data to a Third Country could be impacted (e.g. BCRs) with the “if required” additions, including those that satisfy a derogation requirement in Article 49. This is because the data protection issues associated with any transfer of personal data go far wider than the transfer itself (i.e. a derogation in Article 49, if used, does not negate any security or transparency obligation).

Additionally, in the UK where SCCs for controller (UK) to controller (Third Country) are implemented, remember there should be a data sharing agreement which should include many of the items discussed in this blog (as well as other requirements identified in the ICO’s Code of Practice on Data Sharing – when it is finally published).

This blog could become more important given the current "no agreement" between the EU and UK as the SCCs are likely to be used to legitimise transfers between the EU and UK.

An assessment of adequacy under the DPA1998

Those with memory of the DPA1998 will remember that a controller could assess the adequacy of protection in a Third Country by considering a number of factors.  It is these factors are relevant to identifying when additional safeguards may be required to augment the SCCs.

These factors were set out in the interpretation of the Eighth Principle of the DPA1998 (paragraph 13 of Schedule 1); I quote them below (“in italics”) with a Comment that illustrates the actions a controller or processor should take.

A controller/processor can assess whether a SCCs need augmenting with additional safeguards by having regard to the following:

(a) “the nature of the personal data”.  Comment: List the categories of personal data transferred. Are the personal data confidential or comprise special category of personal data or criminal offence personal data?

(b) “the country or territory of origin of the information contained in the data”. Comment: identify any Third Country where the personal data came from; remember that “obtaining” is a processing operation and needs an Article 6 lawful basis (and an additional Article 9/Schedule 1 condition if the personal data are of a special or criminal category).

(c) “the country or territory of final destination of that information”. Comment: identify any destination Third Country including any Third Country where the personal data are in transit. Remember that “transfer” is a processing operation and needs an Article 6 lawful basis (and if special category or criminal offence personal data are transferred, a condition in Article 9 or Schedule 1 of the DPA2018 to permit the transfer).

(d) the purposes for which and period during which the data are intended to be processed. Comment  remember the transparency requirements (e.g. in Article 13 or Article 14) apply with respect to the purpose of the processing (as well as the four Article 5 Principles that explicitly refer to the purpose of the processing).  Document how long are the personal data kept in that Third Country; explain why that is “necessary”? Check with the Article 30 Register of processing activities.

(e) the law in force in the country or territory in question, Comment identify when the law enforcement or national security agencies in the Third Country can gain access to personal data in that Third Country. Does such access use procedures or powers that operate in secret (e.g. where the controller cannot challenge via an independent judicial process).

(f) the international obligations of that country or territory. Comment: has the Third Country implemented data protection legislation that is based on the OECD or APEC Guidelines? Has the Third Country signed up to the Council of Europe Convention No 108? What is the approach to Human Rights in general in that Third Country?

(g) any relevant codes of conduct or other rules which are enforceable in that country or territory. Comment:  Examples include ISO27002, ISO27701, any national or state data protection law which is not based on OECD, APEC or CoE Convention No 108 (e.g. CCPA in California), or any specific cyber/IT security law (e.g. in India).

(h) any security measures taken in respect of the data in that country or territory. Comment: . Can the personal data be encrypted or pseudonymised? Check how the requirements of the Security Principle and Article 32 etc are met and documented (e.g. to conform with standards/laws identified in (g) above).  I would also include the Processor and data breach reporting requirements of the GDPR.

(i) anything else? Comment Is there an independent regulator or a judicial process which can protect the interests of the transferring controller or data subjects? How is any accountability requirement to be documented?

NOT transferring comments

So when are the scales tipping in the direction of NOT transferring personal data to a Third Country?

I think the answer is when there is a combination of the following:

• the personal data are especially sensitive or the purpose of the processing is controversial;
• there are no enforceable safeguards available to data subjects;
• the controller does not have an Article 6 lawful basis for the transfer (or when the controller cannot find a condition or authorisation in Articles 9, 10 or Schedule 1 of the DPA2018 if a condition or authorisation is needed);
• the controller has reservations about the reaction of data subjects when they are informed of the transfer via the transparency arrangements;
• there is no applicable data protection, privacy or IT security law or independent appeals process (e.g. via a Regulator or judicial process) in a Third Country;
• the security of the processing or personal data is suspect in a Third Country, or
• the law enforcement agencies of the Third Country can act in secret or at the whim of an Interior Minister or President (who may or may not be a genius).

Hope this helps.

Upcoming Data Protection Courses (in Autumn)

Obviously COVID19 has put a spanner in the training works, but the following courses are scheduled for the Autumn now lockdown is unlocked (fingers crossed).

All courses lead to the relevant BCS qualification:

• Data Protection Practitioner: London, Starts Sept 22 (6 days)
• Data Protection Foundation: London, Oct 13-15 (3 days)
• Data Protection Practitioner: Edinburgh, Starts Nov 23 (5 days)

Full details on www.amberhawk.com of by emailing info@amberhawk.com

References

My previous blog about the Schrems II decision contains a link to all relevant references (at the end of the blog): https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html

Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK

These are my six takeaways from the Schrems II decision published yesterday.  They are

• Privacy Shield died because EU data subjects are disadvantaged by the USA’s approach to privacy.
• The Standard Contractual Clauses (SCCs) produced the European Commission are OK to use in general, but (and a “big butt” at that)….:
  1. SCCs might not be OK for the USA in the long term (watch for ICO and EDPB advice) as they are likely to be afflicted by the same problems as Privacy Shield.
  2. Controllers have to look to familiar accountability-like requirements on transfer to a recipient in a Third Country, and reassure themselves that the DP standards specified by the SCCs apply to any processing of personal data in that Third Country.
  3. Controllers and processors are likely need to know more about the privacy law in the Third Country, how it varies from the GDPR and when public authorities in the Third County can gain access to personal data so transferred.
  4. The UK could well be in difficulty for an adequacy decision from the European Commission given the comments concerning disclosure to public authorities.
  5. As it is election time, the USA would be advised to debate a Federal DP law at least to the standard of the updated Council of Europe Convention No 108+ (if the USA wants an adequacy determination from the Commission).

The above conclusions are justified in the rest of the blog. The mantra is: “Do not panic” (yet);  be prepared to change transfer arrangements to the USA and keep an eye out for official pronouncements re transfers to the UK from the EU for next year.  I would not be surprised if updated SCCs do not materialise soon as they were on the agenda of the EDPB meeting in May this year.

Privacy Shield shattered: EU citizens disadvantaged

Paragraph 65 of Schrems II judgement explains why Privacy Shield went "down"; the judgment raises four issues which need little in the way of amplification (but I do emphasise the key words in bold).

• “As regards judicial protection, the referring court states that EU citizens do not have the same remedies as US citizens in respect of the processing of personal data by the US authorities, since the Fourth Amendment to the Constitution of the United States, which constitutes, in United States law, the most important cause of action available to challenge unlawful surveillance, does not apply to EU citizens”.

• “In that regard, the referring court states that there are substantial obstacles in respect of the causes of action open to EU citizens, in particular that of locus standi” (i.e. the ability to bring an action before the US courts) “which it considers to be excessively difficult to satisfy”.

• “Furthermore, according to the findings of the referring court, the NSA’s activities based on E.O. 12333 are not subject to judicial oversight and are not justiciable”. Note: Executive Order 12333 deals with United States Intelligence Activities (as amended by Executive Orders 13284 (dated 2003), 13355 (2004) and 13470 (2008); all of these EOs predate the current President so there is no new dystopian Trumpian barrier).

• “Lastly, the referring court considers that, in so far as, in its view, the Privacy Shield Ombudsperson is not a tribunal within the meaning of Article 47 of the Charter, US law does not afford EU citizens a level of protection essentially equivalent to that guaranteed by the fundamental right enshrined in that article”.

These reasons kill Privacy Shield for any controller or processor. Even assuming if all the personal data were not required for surveillance or the national security agencies (i.e. (a), (b) and (c) “disappear miraculously”:- just like COVID according to President Trump), I can’t see how one gets around (d) without structural changes to Privacy Shield.  Any fix is not going to be quick.

However, it might be possible to repair Privacy Shield in circumstances when (a), (b) and (c) do not apply (e.g. no surveillance; no national security). That is why the USA Department of Commerce put out a holding press release saying it will not give up the ghost:  “The Department of Commerce will continue to administer the Privacy Shield program, including processing submissions for self-certification and re-certification to the Privacy Shield Frameworks and maintaining the Privacy Shield List. Today’s decision does not relieve participating organizations of their Privacy Shield obligations”.

Adequacy determination for the UK?

The approach the Court took to SCCs was more nuanced, so I have published the judgement with commentary as needed.  The key paragraphs are paragraphs 129-149, some of which deal with the difference between the SCCs and an adequacy determination (that the UK is hoping for by 2021).

The Court said that an adequacy determination (my emphasis from paragraph 129) was:

• “an examination of the legislation of the Third Country concerned taking into account, inter alia, the relevant legislation on national security and public authorities’ access to personal data” and whether “access of that third country’s public authorities to such data does not therefore impede transfers of such personal data to the third country”.
• “Such an adequacy decision can therefore be adopted by the Commission only if it has found that the Third Country’s relevant legislation in that field does in fact provide all the necessary guarantees from which it can be concluded that that legislation ensures an adequate level of protection” (which is more or less the GDPR)

The problem the UK Government has is:  (a) the European Commission has to look at access by the public authorities etc  and (b) it has implemented very generous data sharing legislation for its public authorities (e.g. in the Digital Economy Act 2017 and for national security purposes via the bulk personal data processing powers in the Investigatory Powers Act 2016).

In addition, the UK_GDPR envisaged by the “Data Protection, Privacy and Electronic Communications (Amendments etc)(EU Exit) Regulations 2019” can diverge easily and quickly from the standards established by the GDPR in a very significant way.

So, in effect, any adequacy agreement between the UK and European Commission will have to contain a guarantee, given by the UK Government, concerning permitted divergence between the UK_GDPR from the GDPR.  For example, with respect of further disclosure to public bodies or that any change to, rights, Principles and other GDPR obligations does not deviate too far from European norms. (See blogs mentioned in the references below).

For the life of me, I cannot see such a guarantee being given if the Government’s mantra of “taking back control” is to be realised.

It is this issue that bedevils the future use of SCCs for use of transfers to the UK from the EU (e.g. controller in France to processor in the UK).  If this is what your organisation’s is about please read the description of the SCCs in the judgement as it gives further detail of what the controller or processor receiving personal data from the EU might need to do from January 1st 2021.

I am only providing some headlines that caught my eye.

Standard Contractual Clauses (SCCs)

The way I understand the judgement with respect to the role of SCCs can be summarised as follows:

1. SCCs should specify required DP safeguards (SCCs are European Commission approved remember) but controllers and processors need to identify certain accountability-like obligations (the judgment does not refer explicitly to “accountability” but essentially that is what is being suggested).
2. These accountability-like obligations will vary depending on whether the SCCs relate to controller (EU) to controller (Third Country) or controller (EU) to processor (Third Country). They include managing, establishing, reporting and auditing compliance with the SCCs against the specified DP standards and checking for the existence of effective remedies in the case of a breach of the SCCs. The UK, remember is such a Third Country in 2021.
3. The SCCs provide a baseline of DP expectations and safeguards; where necessary, the controller and processor can implement safeguards in addition to those identified in the SCCs.
4. The recipient in the Third Country has a role in identifying obligations placed on that recipient by Third Country law and inform the controller or processor of those obligations (especially if they relate to access to personal data by public authorities in that Third Country). The transferring controller can then consider whether additional safeguards are required.
5. Once informed, and if there is an absence of additional safeguards that are deemed necessary, then the controller or processor should not transfer the personal data.

Quotes from the judgment that establish the above

Paragraph 131 states that the controller or processor ‘should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject’ and that ‘those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject  rights  and  of  effective legal remedies … in the Union or in a third country’ (My emphasis)

The above is made clear in paragraph 132 as it may “prove necessary to supplement the guarantees contained in those standard data protection clauses”. In that regard, “Recital 109 of the regulation states that ‘the possibility for the controller … to use standard data-protection clauses adopted by the Commission … should [not] prevent [it] … from adding other clauses or additional safeguards’ and states, in particular, that the controller ‘should be encouraged to provide additional safeguards … that supplement standard [data] protection clauses’.

Paragraph 133 adds that “standard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contractual obligation to ensure compliance with the level of protection required under EU law” so the implementation of additional safeguards “may require, depending on the prevailing position in a particular third country, the adoption of supplementary measures by the controller in order to ensure compliance with that level of protection”.

Paragraph 135 concludes “Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned”.

This is especially the case “where the law of that third country imposes on the recipient of personal data from the European Union obligations which are contrary to those clauses and are, therefore, capable of impinging on the contractual guarantee of an adequate level of protection against access by the public authorities of that third country to that data”.

It follows (paragraph 142) that “a controller established in the European Union and the recipient of personal data (in the Third Country) are required to verify, prior to any transfer, whether the level of protection required by EU law is respected in the Third Country concerned”. The “recipient (in the Third Country) is, where appropriate, under an obligation… to inform the controller of any inability to comply with those clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract”.

It is, in my view, paragraphs 135 and 142 that “does for” SCCs to the USA.  Privacy Shield went down because the CJEU concluded that “the level of protection required by EU law is NOT respected in the Third Country (i.e. USA) concerned”; the deficiencies (identified in paragraph 65) are not removed by the SCCs.

Concluding comments

So what should controllers do now?  Well, I would wait until Data Protection Authorities, EDPB and the European Commission get their collective heads together and make suggestions in public.  I do not think transfers to the USA will be stopped overnight by this judgment which is far more complex than most observers had envisaged.

The judgement will certainly give the UK Government a headache over adequacy if the UK_GDPR strays too far from the GDPR.

If an adequacy determination for the UK does not arise for whatever reason, the SCCs with respect to transfers from the European Union to the UK, are likely to pick up the strain.

It will be embarrassing if these SCCs have to contain additional requirements to protect European data subjects because the UK’s DP regime is viewed to be inadequate.

Upcoming Data Protection Courses (in Autumn)

Obviously COVID19 has put a spanner in the training works, but the following courses are scheduled for the Autumn now lockdown is unlocked (fingers crossed).

All courses lead to the relevant BCS qualification:

• Data Protection Practitioner: London, Starts Sept 22 (6 days)
• Data Protection Foundation: London, Oct 13-15 (3 days)
• Data Protection Practitioner: Edinburgh, Starts Nov 23 (5 days)

Full details on www.amberhawk.com of by emailing info@amberhawk.com

References

USA Dept of Commerce press release on Schrems II https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and

Draft Brexit Data Protection Regulations would undermine adequacy determination for the UK : https://amberhawk.typepad.com/amberhawk/2019/01/draft-brexit-data-protection-regulations-would-undermine-adequacy-determination-for-the-uk.html

Adequacy of the UK’s data protection regime; now the UK has left the EU, the battle lines are drawn: https://amberhawk.typepad.com/amberhawk/2020/02/adequacy-of-the-uks-data-protection-regime-now-the-uk-has-left-the-eu-the-battle-lines-are-drawn.html

Schrems II Press release decision: Judgment of the Court of Justice in Case C-311/18

Schrems II judgement itslef C-311/18 http://curia.europa.eu/juris/documents.jsf?oqp=&for=&mat=or&lgrec=en&jge=&td=%3BALL&jur=C%2CT%2CF&num=C-311%252F18&page=1&dates=&pcs=Oor&lg=&pro=&nat=or&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&language=en&avg=&cid=9892073