Hawktalk

ICO’s criticism of National Fraud Initiative on data matching raises serious concerns over proportionality and necessity

When I posted the blog on the return of the database state via the National Fraud Initiative (NFI), I knew I was going out on a limb.  Afterall, if one criticises a key Government initiative for being incredibly invasive of privacy, one hardly expects to be awarded two or three “back-of-the-hand” COVID contracts as a “thank you”.

So it is a relief that the ICO’s response to NFI consultation on data matching (just published) has come to similar conclusions (see references).

In this brief blog, I will summarise what the ICO says and make a brief comment on what is meant. But before that, a brief lesson on reading between the lines: when a regulator says “I recommend that organisation X does action Y”, what is meant is that “organisation X has failed to do action Y when it should have”.

So what are the ICO’s “principal recommendations”?  They include implementing “The need for accountability” (Comment: guess what is missing then!!)  and an approach that involves “data protection by design and default” (i.e. consideration of how the Principles apply to the processing prior to the processing).

This should be achieved via:.

• “the preparation of a data protection impact assessment (DPIA)”. Comment: no DPIA’s have been done so far.
• a clear description of the different data protection regimes which will apply when exercising each of the NFI powers. Comment: the draft NFI Code has not taken into account the fact that some processing might be subject to Law Enforcement parts of the DPA2018.
• compliance with the data protection principles and the provision of safeguards to mitigate risk to individuals. Comment: apart from transparency requirements, the draft NFI Code does not spell out details of the application of each Principle (e.g. relevant, accuracy, retention) in Article 5.
• the establishment of the respective responsibilities of the Cabinet Office (CO) and any third party controllers involved in the NFI data matching exercises. Comment: roles and responsibilities of those involved in data matching have not been assigned.
• particular attention to special category or sensitive data, criminal offence data, and children’s data, where this is held. Comment: the processing of such sensitive personal data items (e.g. health records) has been largely overlooked in the draft Code.
• Updates to the draft Data Matching Code to ensure the draft Data Matching Code is consistent with the ICO’s Data Sharing Code”. Comment: the draft NFI Code is likely to be inconsistent with the data sharing Code.

Other paragraphs of ICO criticism

“We note that the Cabinet Office (CO) has not yet undertaken a DPIA, although it intends to do so when piloting any of the proposed new powers. The ICO strongly recommends that the CO should carry out a DPIA as soon as possible and before any processing takes place, to ensure that data protection is central to the development of these proposals”. Comment: for Pete’s sake, can you do a DPIA now!

“If the NFI purposes are expanded as proposed, any processing for law enforcement purposes … would still need to explain why the processing is necessary. This means that the approach must be a targeted and proportionate way of achieving the purpose”.  Comment: a warning that the intended processing might not be targeted, proportionate or necessary.

“The consultation is framed in terms of the overall desirability of the proposed powers, but does not discuss the question of whether the CO can reasonably perform its tasks or exercise its powers in a less intrusive way”.  Comment: explains why the missing DPIAs should be done now.

The NFI intend to use “data from a range of datasets, including those from credit reference agencies, are included in the NFI data matching exercises. As a result of the current pandemic, and its adverse financial impact on individuals as well as the wider economy, there may be many more people in debt than previously. However, the consultation document does not explain how the proposed data matching, which accesses large data sets to search for individuals, is necessary and justified”.  Comment: another warning that the processing might not be targeted, proportionate or necessary.

“…the NFI exercises, including for example AppCheck which provides results ‘on demand’, could potentially allow participants to conduct disproportionate searches for information about particular individuals across a wide range of sources without lawful cause under data protection legislation”. Comment: another warning that the processing might not be targeted, proportionate or necessary.

“Although the draft Data Matching Code is principally concerned with the CO’s own approach to NFI data matching, there are intertwined responsibilities between all controllers involved. It would therefore be helpful for all these issues to be clearly addressed in the draft Data Matching Code”.  Comment: come on guys, there are more controllers that need guidance.

“As mentioned earlier, the draft Data Matching Code needs to make it clear which rights apply to individuals in respect of their personal data, noting in particular that these rights are not limited to an individual’s right to be informed.”  Comment: the right for data subjects to be informed about the processing is not the only relevant right in the GDPR.

“Paragraph 2.6 of the draft Data Matching Code explains how the CO will choose datasets for matching. While it is acknowledged that new powers will be tested in pilots before rolling them out nationally, a requirement for ‘reasonable evidence’ does not appear to address the question of whether the processing is necessary or proportionate”. Comment: yet another warning that the processing might not be targeted, proportionate or necessary.

“The draft Data Matching Code needs to explain the process through which CO decides that it is ‘appropriate’ to use data that has been provided voluntarily, and the criteria that will be applied when making that decision”. Comment: a warning that what the Cabinet Office thinks is “appropriate” does not mean that the processing is targeted, proportionate or necessary.

“The CO data deletion schedule currently suggests inaccurate data should be deleted within three months of the inaccuracy being confirmed, but the processes and timeframes set out in the data deletion schedule or the draft Data Matching Code make no reference to the need for erasure or rectification without delay, or any safeguards to ensure inaccurate data is not transmitted (or if it is transmitted unlawfully, to ensure that the recipient is notified without delay)”.  Comment: without some attention here, the processing is likely to breach three Principles in Article 5.

“The present Data Matching Code refers to the potential for the ICO to be invited to undertake a review of the CO’s data matching processes from time to time. It also refers to the potential for the ICO to be invited to review participants’ procedures. These provisions are repeated in the draft Data Matching Code. Neither the CO nor any participants have approached the ICO to undertake such a review to date, but the ICO remains open to considering any such requests in future.” Comment:   If the NFI had contacted the ICO earlier, then the ICO might have identified some obvious failings identified in the ICO’s document.

“The ICO looks forward to receiving a formal request for consultation from the CO in relation to these proposals, as required under Article 36(4) UK GDPR”. Comment: the ICO expects that all the issues raised in the ICO’s response will be addressed when this request is made.

Concluding comment

The worrying factor here is that the Government are seeking to employ a more compliant Commissioner.

References

ICO Response to the NFI public consultation: https://ico.org.uk/about-the-ico/consultations/cabinet-office-s-consultation-on-the-expansion-of-the-national-fraud-initiative-data-matching-purposes-2021/

Blog on the NFI: https://amberhawk.typepad.com/amberhawk/2021/02/the-return-of-the-database-state-mandatory-data-matching-and-expansive-data-sharing.html

Blog on a more pliable ICO: https://amberhawk.typepad.com/amberhawk/2021/03/the-next-information-commissioner-likely-to-dance-to-the-governments-tune-and-thereby-lack-credibili.html

Upcoming Data Protection Courses

All courses lead to the relevant BCS qualification:

• Data Protection Practitioner: London, Starts May 11 (6 days)
• Data Protection Upgrade Practitioner: London, May 25-26 (2 days)<LAST ONE

Full details on www.amberhawk.com of by emailing i[email protected]

UK’s “world class” data protection regime had 20 faults

Since the Brexit Vote in 2016, the Government has described the UK’s data protection regime (e.g. the DPA1998) as “world class”.  This description has stuck in my craw because, since 2005,  I have unsuccessfully tried to “liberate” official information, held by Government, concerning several deficiencies in this “world class” regime.

Nearly two decades of Freedom of Information (FOI) requests later, last month (March 31^st), I “ZOOMed” into another “Groundhog Day” FOI Tribunal to make the latest round of arguments.  This blog updates readers as to what transpired.

The FOI request under discussion was made on the day after the commencement of the Data Protection Act 2018/GDPR in the UK (i.e. at the end of May 2018).  I asked for details of the infraction proceedings relating to the repealed DPA1998 (which was the UK’s implementation of the repealed Directive 95/46/EC);  note my emphasis on “repealed”; I naively thought there would not be a problem.

However,  this time I also decided to make an identical FOI request for the same information to the European Commission via Regulation 1049/2001.  So did the same request, for the same information, made at the same time under different FOI regimes, result in the same outcome?  Of course not  - and thereby hangs a tale.

The UK Government, supported by the Information Commissioner (Decision Notice FS50812647) opposed disclosure of the requested information on the grounds that the European Commission vehemently opposed disclosure.  The European Commission told the UK Government that releasing any of the requested information to me would be so damaging that it could undermine adequacy negotiations between the UK Government and Commission.  The UK Government took this prospect seriously so it refused to provide the information; the ICO following in agreement.

By contrast, the European Ombudsman decided that since all but one of the problem areas associated with the DPA1998 were resolved, the European Commission could provide access to the requested information without any detriment to anything (apart from one issue that was unresolved).  The Commission refused to countenance the Ombudsman’s recommendation to disclose, with the result that the Ombudsman made an official finding of maladministration against the Commission (reference 1632/2018/THH).

This divergence of view between European Ombudsman and ICO about the same FOI request has allowed me to draw two general conclusions:

• since 2005, various Information Commissioners have repeatedly made significant errors of judgement by maintaining absolute silence about the defects in the DPA1998; and
• the Freedom of Information regime that applies to the European Commission (Regulation 1049/2001) is not fit for purpose.

In this blog, I will briefly substantiate each of these conclusions.

Before going further, it would be helpful to outline the totality of what I know about the problems with the “world class” DPA1998.   There were 20 issues of concern identified by the Commission before 2010; these covered 15 Articles (or nearly half of Directive 95/46/EC).  Issues identified included: definitions (personal data and relevant filing systems), data subject consent, enforcement powers of ICO, the treatment of criminal offence personal data, subject access rights, transfers outside the EEA, exemptions from rights, and judicial remedies for data subjects.

Can we agree that this is not a trivial list of problems.

Why the ICO has made errors of judgment?

Can you cast your mind back to the surveillance society debates that surrounded the voluntary Identity (ID) Card in 2006?

There was to be a comprehensive National Identity Register that recorded privacy-intrusive details on every ID card transaction (e.g. the Register captured personal data as to when and where each individual produced their ID Card for inspection in order to obtain a particular public or private sector service).

Additionally, personal data stored on the Register could be shared to improve the efficiency of public service delivery and initially, individuals would consent voluntarily into showing their ID Card. The DPA1998 was touted by Home Office Ministers as offering sufficient privacy protection for data subjects.

So, should all the Parliamentary Committees scrutinising ID Cards and related surveillance issues surrounding the Register, have been informed that the European Commission thought the definition of “personal data” used in the DPA1998 was defective?  Should they also have known that the UK’s concept of “consent”, as defined in Directive 96/46/EC, was also considered by the Commission to be defective?

Indeed, should all these Committees have access to the detail surrounding all of the 20 or so defects in the DPA1998, in order to assess their relevance to the surveillance issues before each Committee?  I think the answer is “yes”.

Move forward a decade to the adequacy arrangements themselves post Brexit. Should all the Parliamentary Committees considering post-Brexit data transfers with the European Union have known that the European Commission had concluded that the DPA1998 transfer arrangements were defective?

Should these Committees also have known that the Commission was concerned that the 20 or so defects might resurface in the UK_GDPR or DPA2018 and that this could impact on the UK’s adequacy determination? (The European Commission made this point before the European Ombudsman and ICO).

There again my answer is “yes”.

Hence, my conclusion that each of the various Information Commissioners made a serious error of judgement when each failed to make public the alleged defects in the DPA1998.

By keeping silent, each Commissioner facilitated a lack of Parliamentary scrutiny. Without Parliament knowing the detail (or relevance) of the European Commission’s concerns, I cannot see how any Parliamentary scrutiny of legislation that relied on the processing of personal data can be regarded as being complete.

Indeed, there is little point having an independent Regulator (or even a single corporate mission statement about protecting data subject rights), if the relevant corporate body keeps stum for a decade and a half, about 20 potentially serious defects in the Data Protection regime which has impacted on 60,000,000 UK citizens.

Regulation 1049/2001 is not fit for purpose

Continuing this theme, there is little point of having an FOI regime that cannot be enforced if the Regulator’s decision goes against the public authority.  Equally there is little point having an independent regulator if that regulator’s decisions can be ignored by the public body that holds the requested information.

This was the position I found myself with the Ombudsman’s decision in my favour; it is unrealistic to expect citizens in my position to commence legal proceedings against the European Commission before the CJEU.

In my case, the Ombudsman proposed that “in the interests of transparency and accountability, the Commission should reconsider granting access to those documents that related to the issues already resolved in the (formally still ongoing) infringement procedure. The Commission refused to do so”.

The Ombudsman added that the Commission’s “approach clearly places unnecessary obstacles in the path of citizens wishing to exercise their fundamental right of public access to documents. Similarly, it undermines the trust of citizens in the work of the EU institutions.”

At the Tribunal hearing, I added that I thought “the Commission had scored an own goal”.  For “if the Commission had released limited information or engaged with the British Public concerning some of the deficiencies in the UK’s Data Protection Regime between 2004 and 2018,  it would have been seen as a protector of UK data subjects”.

“Perhaps then, fewer UK data subjects would have voted to leave the EU”.

Independent FOI regulators?

In relation to my FOI request, the evidence shows that the Information Commissioner initially followed the “reasonable” suggestion of the European Ombudsman and moved in the direction of only withholding information pertaining to the one outstanding issue identified by the Ombudsman.  The ICO then wanted to know what the relevant Government Department (DCMS) thought of this idea.

The DCMS contacted the European Commission which came back with an abrupt two line instruction on the lines of:  “The European Commission has maintained its requirement that the UK continues to treat the material or information as confidential”.

Whilst this bold assertion did not work on the European Ombudsman (who rejected the Commission’s use of any exemption from its FOI regime), it did work on the DCMS who applied an exemption in the FOI regime (S.27 of FOIA).  The ICO sadly reversed her view mentioned in the previous paragraph and obediently fell into line.

In summary, what was prejudicial to international relations in the UK (the exemption used by DCMS), was not prejudicial to international relations on the other side of the English Channel (even though the exemption appears in A.4(1) of the Regulation). So what was going on?

First, the adequacy agreement would assist an estimated £120 billions of trade per year.  Is it credible to believe that this adequacy arrangement would be put in jeopardy by the release of information, nearly two decade olds,  relating to repealed legislation, and concerning data protection issues that have been resolved?  I don’t think so.

Secondly, could the ICO be sacrificing her FOI independence in favour of a quiet life with her funding Department for FOI purposes?  Well, I am sure many might consider this as a plausible explanation but there is no evidence that this is the position.  However,  it is clear that the Government is moving towards installing a more “understanding” Commissioner (see references) for data protection reasons.

In conclusion, I think the refusal is all about maintaining secrecy.  The two protagonists are setting the scene just in case there is disagreement concerning the adequacy agreement itself.  If there is a disagreement, then another set of infraction provisions will kick in and nobody external to the European Commission or UK Government will be any the wiser.

Like the defects in the DPA1998, the whole area of dispute will be smothered in a protective blanket of perfect darkness.

However, my duplicate FOI request has drawn attention to two important questions: “is the UK ICO truly independent as an FOI regulator?” and “has the European Ombudsman got sufficient powers to enforce its FOI regime”.  My experience shows that it is difficult to answer “YES” to both.

References

Ombudsman reference 1632/2018/THH: https://www.ombudsman.europa.eu/en/decision/en/115947

ICO Decision Notice reference FS50812647  (Google the Decision Notice)

An amiable ICO? see https://amberhawk.typepad.com/amberhawk/2021/03/the-next-information-commissioner-likely-to-dance-to-the-governments-tune-and-thereby-lack-credibili.html

I don’t want to repeat the ins and outs of a saga that started in 2004. However, the following blog reference gives the grim detail (at the end of the blog) with references to all the relevant material, extracted with pain, from a reluctant European Commission: https://amberhawk.typepad.com/amberhawk/2017/03/uks-gdpr-law-will-not-be-judged-adequate-if-it-contains-provisions-that-made-the-dpa-inadequate.html

Upcoming Data Protection Courses

All courses lead to the relevant BCS qualification:

• Data Protection Foundation: London, Starts April 27-29 (3 days)
• Data Protection Practitioner: London, Starts May 11 (6 days)
• Data Protection Upgrade Practitioner: London, May 25-26 (2 days)<LAST ONE

Full details on www.amberhawk.com of by emailing in[email protected]

A divided Isle of Man is the answer to UK’s data transfer woes

Oliver Dowden’s blue skies “data protection” think tank at the Department of Culture, Media and Sport (DCMS) has come up with an interesting idea to resolve all UK’s problems with respect to overseas transfers and adequacy determination, once and for ever.

According to a confidential DCMS “Departmental Information Paper” (amusingly called “DIPers” by DCMS insiders) found abandoned in Costa Coffee at Watford Gap Service station on the M11 last week,  the think tank’s idea  “neuters all those lefty-lawyers, privacy fanatics and foreign data protection authorities who repeatedly carp on (and on infinitum) about the low level of data protection in the UK”.

The idea is for the UK to negotiate with the Isle of Man Government to see whether the Island could be divided into two separate administrative zones and then encourage UK companies who have “many difficult transfers of personal data to accommodate” (e.g. “transfers of private accounts to the Cayman Islands”) to establish remote processing facilities “in each new administrative zone”. The Paper calls these zones, which are to be established as separate states, the “East of Man” and the “West of Man” (much in the same way there is East Ham and West Ham in London).

The two administrative zones are created by installing a virtual border drawn from Douglas to Ronaldsway near the current International airport.  Foreign Secretary, Dominic Raab, whose knowledge of the importance of Dover to the UK economy is now unrivalled, said that it was important to keep “both North and South Ronaldsay Islands in the same administrative zone” in order to “avoid upsetting the natives”.

This idea, the Paper concludes, “would mean an influx of UK companies into the Isle of Man, especially from the City of London which would double Isle of Man company tax revenues to such an extent that it would allow its Government to decrease in the standard rate of personal tax to 2% for the first £150K of income”.

How it works?

The idea takes advantage of an “accidental” drafting error in Article 44 of the GDPR and UK_GDPR dealing with General Principles for transfers outside the UK, made by a controller or a processor in the UK.  This Article says “Any transfer of personal data which are undergoing processing … shall take place only if, subject to the other provisions of this Regulation, …and … including for onward transfers of personal data from the third country … to another third country”.

Quite simply a controller wanting to do a dodgy transfer from the UK to a British Overseas Territory tax haven,  first transfers personal data from the UK to one zone of the newly divided Isle of Man.  This transfer is subject to all of the UK_GDPR provisions and is to the Isle of Man which already has an adequacy determination.  Therefore the requirements of the first half of A.44 are met as the transfer is subject to “other provisions of this Regulation”.

The personal data are then transferred from this zone to the other zone of the Island, and this constitutes the “transfers of personal data from the third country … to another third country” (thereby meeting the requirements specified in the second half of A.44) and the transfer is also subject to the GDPR.

As there is nothing else in A.44 to satisfy, the personal data can then freely be transferred from the second half of the Isle of Man to the tax haven, knowing that all data protection requirements have been met.

There will be two versions of the GDPR operative on the divided Island; there will be the Man_GDPR which operates in the East, and a West of Man GDPR (or WoMan_GDPR) in the West.  However, as both versions of the GDPR initially will be identical to the current Isle of Man legislation, and because the European Commission has already recognised the Isle of Man as adequate,  it follows both zones of the Island will also become adequate.

Echoing the content of Mr Dowden’s recent Financial Times article (see last week’s blog), the DCMS Paper says “This is an example of the UK maintaining high standards of data protection without creating unnecessary barriers to data transfer” and that the new ICO (due to commence employment this Autumn) will “understand the importance of striking the correct balance and delivering on this critical agenda”.

The Paper stresses that the border operates just like the virtual border running down the Irish Sea which separates Northern Ireland from the rest of the UK mainland, post Brexit.  Like the UK Government, the Isle of Man Government can pretend the border does not exist and, at appropriate times, ignore international treaties and agreements that refer to it.

Over time, the Paper notes,  the name change in two zones of the Island could be shortened to “Isle of Men”, and this in itself could boost tourism to the territory as a “Go To” holiday destination for “male bodybuilders and strongest-man competitors” (as well as the famous TT motorcycle races, much beloved by serious heavy-metal blokes and bikers).

Upcoming Data Protection Courses

All courses lead to the relevant BCS qualification:

• Data Protection Foundation: London, Starts April 27-29 (3 days)
• Data Protection Practitioner: London, Starts May 11 (6 days)
• Data Protection Upgrade Practitioner: London, May 25-26 (2 days)<LAST ONE

Full details on www.amberhawk.com of by emailing [email protected]