Hawktalk

Adequacy Agreement for transfers from the EU to the UK: made on Friday, unmade by Sunday?

Today’s Sunday Telegraph reports, on its front page, that the UK Government is sympathetic to the idea that Judgments made by the European Court of Human Rights (ECHR) in Strasbourg do not automatically apply in the UK.   If such non-application occurred, then it would jeopardise the Adequacy Agreement concerning personal data flows from the EU to the UK, as finalised by the European Commission last Friday.

Why is the UK deemed adequate?

Recital 5 to the Agreement states “that the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of Regulation (EU) 2016/679 from the European Union to the United Kingdom”.

I am sure many privacy advocates will disagree with the above statement.   However, in my view, it is difficult to say the UK is not adequate, if UK data protection law is almost the same (word for word) as the GDPR.  For instance, the EU_GDPR has the same definitions, Principles, rights and controller and processor obligations as the UK_GDPR.

The only exception is with the transfer arrangements of the UK_GDPR and even these are aligned with, or very similar to, the EU_GDPR provisions.

Some Privacy NGOs on the continent are likely consider commencing the long march through the legal institutions to challenge the Adequacy Agreement, but until such a challenge succeeds, and the CJEU determines that the UK is not adequate, then all is well for transfers to the UK from the EU.

Of course, the UK’s version of the GDPR can be modified at the drop of a hat but until that happens to a significant degree, in a way that impacts on the rights and freedoms of EU citizens, then the UK would remain adequate and transfers of personal data from the EU can continue. Remember the EU's concern is EU data subjects; it is not interested in the privacy protection afforded to UK citizens.

Note that the Adequacy Agreement accommodates the recent Court of Appeal judgement that determined the immigration exemption unlawful (see references),  Article 1 of the Adequacy Agreement excludes any transfer that covers “personal data that is transferred for purposes of United Kingdom immigration control or that otherwise falls within the scope of the exemption…”.

Clearly, this exemption is likely to cover Human Resources personal data flowing into the UK from the EU, but as the Border Agency obtains personal data from: the sponsors of data subjects, UK  government departments,  credit reference agencies, fraud prevention agencies, banks, local authorities and public health bodies, several other types of transfers might not be able to rely on the Agreement (i.e. other methods in Article 44-49 of the EU_GDPR have to be used to enable the transfer of personal data from the EU to the UK). The Border Agency's privacy notice tells you where they source their personal data (see references).

Human Rights considerations

However, the Telegraph’s front page story has opened up another area of significant risk to the Adequacy Agreement; it reported that “British Judges would be told that they would no longer bound by European Human Rights Judgments”.

At the last Election the Conservative Party Manifesto promised to “update the Human Rights [Act] …. to ensure that there is a proper balance between the rights of individuals, our vital national security and effective government”.  Consequently, the Human Rights Act 1998 is under review by an “independent expert panel” whose members have been hand-picked by the Government.

We have perhaps become over-familiar with Human Rights challenges in the UK Courts where Government has lost (e.g. facial recognition CCTV use by the police, immigration exemption in the DPA2018, bulk personal data collections of national security agencies, retention of DNA personal data from those who have been acquitted).  Often such action is the only way of assessing the lawfulness of Government processing or Ministerial decision-making.  Clearly “effective Government”, as understood under Mr. Johnson’s leadership, needs fewer such losses.

However, Recital 277 of the Adequacy Agreement states: “This conclusion [about Adequacy of the UK’s DP regime] is based on both the relevant UK domestic regime and its international commitments, in particular adherence to the European Convention of Human Rights and submission to the jurisdiction of the European Court of Human Rights. Continued adherence to such international obligations is therefore a particularly important element of the assessment on which this Decision is based”.  (my emphasis)

I should add the same sentiment about submissive adherence to the ECHR’s jurisdiction can be found in Recitals 111, 116, 120, 173 and 272  (whilst other places stress the important role of the Human Rights Act in the UK).  This to my mind warns the UK Ministers to remain submissive about the Human Rights regine and not deviate too far from A.8 requirements when legitimising public sector interference with private and family life.  In summary, this expectation from the European Commission that some Brexit Ministers submit to European law lies in “red rag to a bull” territory.

The EU position is reinforced by the Agreement which, in Article 3,  promises detailed monitoring arrangements.  These will apply to:

• “how public authorities [in the UK] have access to data transferred on the basis of this Decision” (e.g. excessive data sharing arrangements);
• “cases where the Information Commissioner, or any other competent United Kingdom authority, fails to ensure compliance with the legal framework upon which this Decision is based” (e.g. cases where a Regulator turns a blind eye to the UK Government’s Big Data sharing objectives);
• “any indications that interferences by United Kingdom public authorities with the right of individuals to the protection of their personal data go beyond what is strictly necessary, or that there is no effective legal protection against such interferences” (e.g. action to diminish the protection afforded by A.8 ECHR).

The Article ends by stating that “Where the Commission has indications that an adequate level of protection is no longer ensured, the Commission shall inform the competent United Kingdom authorities and may suspend, repeal or amend this Decision” (e.g. Adequacy no more).

Enter Schrems I

Thanks to the enduring legacy of the Schrems 1 decision,  Europe’s data protection authorities can themselves assess adequacy of the UK’s DP regime.

The CJEU ruled that a Data Protection Authority’s ability to independently assess adequacy applied universally to any international agreement on data protection (e.g. such as Safe Harbor or the current Adequacy Agreement).   An adequacy determination:….

 “….does not prevent a supervisory authority of a Member State, within the meaning of Article 28 of that directive as amended, from examining the claim of a person concerning the protection of his rights and freedoms in regard to the processing of personal data relating to him which has been transferred from a Member State to that third country when that person contends that the law and practices in force in the third country do not ensure an adequate level of protection” (para 66 of Case C‑362/14).

Note the implication of this. If a Data Protection Authority, following a data subject complaint, found that the level of protection in the UK was inadequate, then it could act to protect the interests of data subjects (e.g. by banning specific transfers) despite any political agreement asserting adequacy in general.

So, should we expect European privacy advocates to devote their energies to providing complaints to DP Authorities? Answer is ”you bet”.

Conclusion

So there you have it.  The more Ministers dilute the Human Rights regime or the less submissive they become, especially if this impacts on the rights and freedoms of EU citizens,  then the greater the risk to the loss of the EU adequacy decision.   “Taking back control of the UK’s data protection laws” to the extent promoted by TIGRR (see the last blog) does not appear to be a safe option.

The really dangerous factor is if the Northern Ireland protocol goes completely pear-shaped.  In that case, a two fingered salute to this Agreement could become an attractive proposition for those UK “leaders” who have always wanted to drop most European Community law.

Upcoming Data Protection Course

Because of Indian variant and the consequent COVID lockdown uncertainty, the following course can be attended in person or via Zoom or a mixture (it's up to you).  The Data Protection Practitioner Course is in London, and starts July 13 (6 days).

Full details on www.amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com

References  

Schrems 1 judgement: https://amberhawk.typepad.com/amberhawk/2016/02/politicians-agree-a-privacy-shield-as-the-working-party-of-data-protection-commissioners-display-a-s.html

Border Agency  Department Privacy Notice: https://www.gov.uk/government/publications/personal-information-use-in-borders-immigration-and-citizenship/borders-immigration-and-citizenship-privacy-information-notice

Immigration exemption discussion: https://amberhawk.typepad.com/amberhawk/2021/05/judgement-in-immigration-exemption-case-could-cause-chaos-and-threaten-any-adequacy-determination-fo.html

TIGRR’s suggested extensive changes to the UK’s DP regime: https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html

Adequacy Agreement (leaked draft): down load here Download UK GDPR Adequacy Decision - june2021

TIGRR, Eeyore and Pooh Bear decide to destroy the GDPR

Yesterday, the Taskforce on Innovation, Growth and Regulatory Reform (TIGRR) reported to the Prime Minister on how the UK could, in general,  reshape its approach to regulation and seize new opportunities from Brexit with its newfound regulatory freedom.  Unsurprisingly, changes to the UK_GDPR are high on TIGRR’s list.

In summary, under the heading “Replace GDPR with a new UK framework for data protection”,  perhaps with a “UK Framework for Citizen Data Rights”, TIGRR propose:  a Common Law approach towards enforcement;  diminishing the application of the Data Minimisation and Purpose Limitation DP Principles;  putting the data subject in control of the processing by “strengthening” any data subject consent requirements,  and reducing the data subject’s right not to be profiled by automated means.

The proposal for a “UK Framework for Citizen Data Rights” has a real problem; it infers that if one is not a Citizen, there are no Citizen Data Rights to protect.  Whilst such a restriction is likely to attract the current Home Secretary (who is not appealing the recent striking down of her immigration exemption in the Court of Appeal),  any such limitation to “Citizen Data Rights” would render the processing of personal data unlawful.

This is because the processing would breach Article 8 of the ECHR which is independent from any concept of citizenship; after all the Human Rights convention exists to protect all humans and not just UK citizens.

Overall, it is clear that the TIGRR’s authors have little understanding of the relevant the GDPR provisions and most of its GDPR recommendations are accompanied by an incorrect analysis. However, such errors can be corrected, and it will not the first time that the foundations of future Governmental Policy has been built on a false prospectus.

In any event, the recommendations are clearly in sympathy with those ideas promoted in the National Data Strategy.    In other words, something on the lines of the TIGRR recommendations well could be proposed; consider them as an extra helping of that “oven ready” Brexit deal.

For the record Members of the taskforce were three Brexiteer MPs to the right of the Party with a preference for the UK to become the Singapore of Europe: Iain Duncan Smith, Theresa Villiers and George Freeman.

Errors in TIGRR

To set the scene, I start with a few examples of TIGRR's impoverished data protection analysis.

TIGRR states that the “GDPR is centred around the principle of citizen-owned data”. This is wrong. Data subjects do not “own” their personal data under data protection law; they are provided certain levers that can protect their interests (e.g. data subject rights; obligations placed on controllers towards the Principles etc) but all of these interests are balanced with exemptions to protect the interests of controllers.

However other legislation can introduce the concept of ownership  (e.g. when celebrities protect the Intellectual Property vested in their image or name).

TIGRR also say that the GDPR leaves “…organisations generally needing a person’s ‘consent’ to process their data”.  This also is clearly wrong as there are six lawful bases in A.6 of the GDPR which most readers will already know?

The Report acknowledges this and states that there “are alternative ways to process data that do not require consent, but these are not well defined or understood, causing confusion amongst data processors and controllers.”  Note that data processors are “confused” as to what Article 6 lawful basis to choose for their processing activities, when choice of lawful basis is a solely a controller’s responsibility.

TIGRR states that certain Principles in A.5 “…prohibit organisations from using data for any purposes other than those for which they collected it”.   This is also incorrect. Any prohibited further purpose has to be “incompatible” with the purpose of collection; processing for purposes which are not incompatible are not prohibited.

The Report illustrates its commentary on consent under the GDPR with an example which is purely PECR (e.g. “An illustration of this is the cookie consent banner that appears every time you visit a website”).  If TIGRR had looked at the ICO website, they would have found  “The Privacy and Electronic Communications Regulations (PECR) cover the use of cookies and similar technologies for storing information, and accessing information stored, on a user's equipment such as a computer or mobile device”.

TIGRR is wrong with respect to Article 22 (e.g. “Article 22 of GDPR applies solely to automated decision-making. It does not apply when the output of algorithms is subject to meaningful human review”).  In practice, the human review is a safeguard, which is available to a data subject if automated profiling occurs and a problem results.  In other words, the right to a human review is to resolve issues that impact on a data subject who has been profiled; it  DOES NOT negate the A.22 right not to be profiled as described by TIGRR.

The A.22 right also does NOT interfere with “proof of concept” innovative profiling if the profiling has no legal effect or impact on the data subject.   So once a controller has proved the profiling concept,  the options open are: seek data subject consent for the profling, argue that the profiling is necessary for a contract with the data subject, or ask the Government to allow such innovative automated profiling to be authorised by UK law (as specified in A.22(2)(b) and Section 14 of DPA2018). 

This latter option is what  TIGRR wants to achieve; it's already there. It follows that TIGRR’s claim that the “GDPR is already out of date and needs to be revised for AI and growth sectors if we want to enable innovation in the UK” is incorrect. 

Having made many errors, TIGRR’s data protection analysis often leaves Earth for Planet Zog – so I will not comment further.

TIGRR and the GDPR

TIGRR’s view of the GDPR is that “it overwhelms people with consent requests and complexity they cannot understand, while unnecessarily restricting the use of data for worthwhile purposes”.

This is not my view.  I think that where many high tech companies have relied on consent, they have unnecessarily made these consent requirements difficult for data subjects to operate.  For example the requirement in A.7(3) that “it shall be as easy to withdraw consent as to give it” is often ignored.

In my view, the A.7(3) requirement concerning consent is something that the ICO could have, and should have, remedied some months ago (see references), and in my view her inaction to enforce this requirement has encouraged proposals, such as those expressed by TIGRR, to emerge.

However, TIGRR “propose reform to give stronger rights and powers to consumers and citizens, place proper responsibility on companies using data, and free up data for innovation and in the public interest”.  So can these “stronger rights” for data subjects be stronger than GDPR consent?  Or is the intent is to process personal data “in the public interest” in the absence of consent?

No prizes for guessing the answer!

Common Law approach

Underpinning the whole document is what TIGRR calls “The Common Law” approach to regulation.  This is because “Uncodified systems such as common law have historically been and continue to be the systems of choice for many successful jurisdictions. The clear trend for new financial free zones - bespoke jurisdictions designed to be magnets for economic activity - is to opt for a common law approach”.

In addition “A common law approach allows more forward-looking, judgement-based regulation without needing such complex and exhaustive rules for every situation set out in advance”.

With respect to the GDPR, TIGRR state “The Government should use an approach to data based more in common law, so case law can adapt to new and evolving     technologies such as artificial intelligence and blockchain.”  This contrasts with an approach which is more “Napoleonic, code-based, civil law approach traditionally seen  on the Continent” (e.g. as in the GDPR).

So what’s the difference?  In summary, a Common Law approach offers redress to data subjects after the processing goes wrong; by contrast a rules based approach requires the Controller to take action (i.e. follow the rules) to protect data subjects before any processing occurs.

So which protection is preferable? TIGRR clearly suggests it is the former.

Enforcement in action

So let’s take a worked example.  TIGRR complains that Article 5 of GDPR requires personal data to be “adequate, relevant           and limited to what is necessary” (for the purpose).  These restrictions “limit AI because they prevent AI organisations from collecting new data before they understand its potential value and  they also mean that existing data cannot be reused for novel purposes”.

So let us suppose a data subject complains that a controller is keeping irrelevant personal data for longer than is necessary for unspecified purposes merely because it has AI interests? Suppose further the Controller does not respond?

When enforcing the proposed Common Law approach, TIGRR states that the ICO “should seek to enable success, not create unnecessary obstacles”.  The ICO “should support innovation, improve safety for consumers and workers, ensure the long-term protection of the environment and drive UK competitiveness, productivity and growth”.  Finally the ICO should implement “effective and proportionate regulation …. to boost economic competitiveness”.

In other words,  TIGRR’s Common Law approach requires the ICO to consider matters irrelevant to the data protection issues.  For instance, is the controller a start-up?  Could the AI processing produce a competitive advantage for the UK?  Should data protection controls be imposed only when the controller is profitable? 

These Common Law considerations could clearly influence the outcome of any enforcement action.

Data ownership is already here

The concept of “data ownership”  has already been employed by Government and it appears that the idea has taken root in Government.

For example, Matt Hancock (see references) told a Parliamentary Committee exploring COVID that  “The final thing I will say on this… is that the data on your personal health and your health record belongs emphatically to you…. It does not belong to your GP; it does not belong to the NHS. That is your data” (as in ownership).  The “you” here is the Chair of the Committee -to avoid confusion.

And “If you want it to be used for research purposes, that is your decision”. “Your decision” is made via the exercise of a largely unpublicised, opt-out whereas the use of Ministerial Powers determines what is in the “public interest”.   Or to use TIGRR’s terminology, the “stronger rights” that data subjects have to opt-out also “free up data for innovation … in the public interest”.

Finally, the use of language about economics and pragmatism has been appeared before;  text like TIGRR’s could easily have been lifted from the job-specification of the next ICO (see my blog; references).  It confirms that the next Commissioner could well be expected to include such economic questions and, if so, the independence of the UK’s data protection regulator is jeopardised.

In conclusion, TIGRR’s ideas are not going away soon even though their analysis is  wrong; they are likely to be repackaged and like a game of Pooh Sticks, emerge on the downstream side of the bridge.

What is scary is that such major change to data protection law can be introduced using powers under the European Union (Withdrawal) Act 2018 which may not even be debated by Parliament.

One therefore gets the sense that in the next year, data protection could well be at a cross roads (with a 80 seat majority Government that has 43% minority popular vote in the driving seat).

Upcoming Data Protection Course

Because of Indian variant and the consequent COVID lockdown uncertainty, the following course can be attended in person or via Zoom or a mixture (it's up to you).  The Data Protection Practitioner Course is in London, and starts July 13 (6 days).

Full details on www.amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com

References  

TIGRR report: https://www.gov.uk/government/publications/taskforce-on-innovation-growth-and-regulatory-reform-independent-report

Matt Hancock on data ownership. Oral Evidence to Health & Social Care Committee at Q1459 on https://committees.parliament.uk/oralevidence/2318/html/   (COVID: HC 95: 10 June 2021)

I think the lack of action by the ICO has rebounded: see under the heading “Consider the wider perspective” on https://amberhawk.typepad.com/amberhawk/2020/08/why-chris-grayling-mp-could-become-the-next-information-commissioner.html

The ICO job spec: https://amberhawk.typepad.com/amberhawk/2021/03/the-next-information-commissioner-likely-to-dance-to-the-governments-tune-and-thereby-lack-credibili.html

Missing data protection safeguards with respect to NHS Digital’s national database of medical records

Like many, I did not know about the Ministerial Directions that require NHS Digital to create a national database of GP medical records until the indefatigable “Med Confidentiality” NGO raised its profile.  In this blog, I will make some comments about data protection safeguards, most of them statutory,  which appear to me to be missing.

NHS Digital, at the behest of the Secretary of State for Health, has been given Directions to take copies of medical records from all GP surgeries in England.  As health policy is a devolved matter, these Ministerial Directions only apply in England (but I suspect other UK administrations will be watching carefully to see what happens).

According to the Specification associated with these Directions (see references for both) the data “…will be pseudonymised in the GP systems by the GP system suppliers before reaching NHS Digital” but  “…NHS Digital will have the potential to re-identify this pseudonymised data upon the appropriate approvals as it will control the pseudonymisation keys”. The resultant pseudonymised dataset made available within the NHS and to Third Parties for a number of purposes mainly related to health, social care or research.

As NHS Digital can reverse the pseudonymisation process as required, there can be no claim that the personal data being processed are “anonymous”, although in the hands of some Third Parties (e.g. researchers), it may appear to them that they are processing anonymous data.

What are the purposes of the processing?

The Directions explain the intended uses of personal data as: “The purpose of these Directions (Purpose) is to enable NHS … to provide for the strategic collection, analysis and dissemination of General Practice data for health and social care purposes including but not limited to:

• health and social care policy, planning and commissioning purposes;
• public health purposes, including COVID-19 purposes as described in the COVID-19 Public Health Directions 2020 (as amended from time to time); and
• research”.

Missing from this non-exhaustive list of purposes are the purposes associated with disclosure of personal data by NHS Digital.  Several of these can be found in Section 261 of the Health and Social Care Act 2012 and include: disclosure intended to protect the welfare of an individual;  disclosure made to a body exercising public functions for the purposes of those functions (pretty broad that one!);  disclosure which relates to the investigation of a crime, or where any other legislation permits disclosure (another broad category of disclosure).

In other words, use of the NHS Digital GP database is not limited to medical related purposes; personal data can be disclosed for non-medical purposes.  As with the Electoral Roll, Census and other large public sector personal data collections, the NHS Digital GP database could be the target for other public bodies (e.g. the bulk personal data collecting powers of the national security agencies).

Is this privacy paranoia at its worst?  Well no, because in Scotland, the Health Service database of patients  – because of its accuracy of the address element– was intended to become the basis for a Scottish population register for general use and to support an ID card arrangement (see references).

What is the A.6 lawful basis for most processing?

Because Ministerial Directions are used, the lawful basis for the disclosure of pseudonymised medical personal data to NHS Digital will be A.6(1)(c):–“necessary for a legal obligation”.  This choice of lawful basis thus engages the exemption in Schedule 2, paragraph 5(2) of the DPA2018 with respect to the disclosure from a GP surgery to NHS Digital; it can exempt all rights and the first two Principles in A.5 (e.g. the fairness, lawfulness, transparency and compatibility Principles).

With respect to this disclosure also, the right to object to the processing (A.21) and the right to erasure (A.16) are also automatically disapplied as the processing is necessary for a legal obligation.  Any application of the consequential rights of restriction and notification (A.18 and A.19) are also disapplied (e.g. these rights apply if a controller were to be obliged to erase personal data following an objection).

This exemption is also available if NHS Digital were to be required by law to disclose personal data (this category of disclosure is in the list of disclosure purposes above).

Note that because the disclosure of pseudonymised medical personal data is deemed necessary for a legal obligation, any obligation of confidence to the data subject can be set aside; there is no need to consider data subject consent for the processing.

The choice of lawful basis is also likely to cover all purposes identified above (e.g. “health and social care policy, planning and commissioning purposes”) although other (non-consent) legal basis could be more appropriate (e.g. disclosure to Local Authority social work departments could also be necessary for its public task).

Patients can object to the above processing.  Med Confidentiality advise that any opt-out should be exercised before the 23^rd of this month because it should prevent any initial disclosure of an objecting patient’s medical records by the GP.  However, NHS Digital state that a patient can tell his or her GP about the opt-out choice at any time, but clearly this could not have retrospective effect. Data subjects who do nothing have not opted out.  [Note added 8 June: Ministers have announced today a delay to a patient's opt-out decision from 23 June to 1 September].

Note that this “opt-out” does not exist because of any data protection obligation; it exists thanks to Ministerial fiat which could be modified or reversed in future Directions.

Finally, Ministerial Directions, unlike the exercise of power by a Minister via secondary legislation, do not have to be subject to Parliamentary scrutiny nor do they have to made public and Directions can be expressed as a set of general objectives (e.g. for NHS Digital to obey).

Sadly, history informs that the use of Ministerial Directions to define lawful processing of personal data has been a recipe for unaccountability and secrecy.   For example, it was the use of Directions made under the Telecommunications Act 1984 which, until the Snowden revelations, legitimised the bulk personal data collection capabilities of the national security agencies for over three decades (see references).

What are the A.9/Schedule 1 requirements?

With respect to overturning the prohibition placed on subsequent processing of health personal data via A.9(1) of the UK_GDPR, the obvious conditions to use relating to processing being necessary for a health and social care purpose, necessary in the public interest for a public health purpose or necessary for a research purpose where the research is in the public interest  (paras 2 to 4 of Schedule 1 of the DPA2018).

So how are terms such as “public interest” and “necessary” assessed?  As the ICO has not published detailed advice on how NHS Digital is to assess these requirements, it’s left to them to work it out.  The Government in March appointed a new National Data Guardian; she has yet to pronounce on these Directions.  In other words, there is a dearth of official regulatory guidance or commentary other than that published by NHS Digital itself.

With respect to research, there are other legal and ethical requirements set out in section 19 and Schedule 2, para 27 of the DPA2018 and in A.89 of the UK_GDPR but these are largely irrelevant to NHS Digital’s processing as described above unless, for example, a research purpose requires face to face contact with the patient as with a clinical trial (when patient consent becomes a factor).

The involvement of the private sector

Some NGOs have express considerable concern that private medical records, even pseudonymised, will be processed by high tech USA companies. The argument is that the involvement of private technology firms to handle NHS data undermines the “core values” of the UK’s public health system, or that there is a creeping privatisation of data assets which risks losing patient trust in the NHS.

In these cases, a lot will depend on the contract between NHS Digital and its contractors.  Is the contractor, for instance, a controller rather than a processor; this was the issue when the Royal Free Hospital contracted with Google's Deep Mind (see references). 

Additionally, in this case, there was a contract which used both “Data” and “Personal Data”. So does a contractual provision states something like: “we shall return or destroy all Personal Data at the end of the contract” be interpreted as “we are not obliged to return or destroy the Data associated with the contract”?  If so, can those Data be retained by the contractor for its own commercial purposes?

In my view, these end of contract arrangements have to be published so they can be subject to public scrutiny.  It should be clear what anonymous or pseudonymous personal data processed with respect to a NHS project is a contractor allowed to keep, if any, when the project finishes?

List of safeguards

I should make my position clear:  I am at an age where many things are, shall we say, “going South”; if some or all of my medical records could help someone else then I am all for it.  What I am not for, is my medical records being exposed to a set of shysters by accident or design. Sadly, there are many such shysters around in the high tech arena; recent press coverage about PPE tells us that some are friends with Governmental decision makers.

So in the context of the above, the missing statutory safeguards I would like to see implemented are as follows. 

Specific legislation:

• to describe the opt-out of NHS Digital processing as a data subject right (i.e. the opt-out has to become independent of any future Ministerial edict);
• that links any opt-out to the right to erasure of personal data where the right of erasure extends to any other Third Party databases where there has been a disclosure of an objector’s personal data (i.e. if someone objects to NHS Digital then the personal data are deleted throughout any data sharing arrangement);
• that disapplies the exemption in Schedule 2, paragraph 5(2) of the DPA2018; (i.e. if there is a requirement for this exemption, it should be identified in legislation enacted after the creation of the centralised GP NHS Digital database);
• that disapplies any previous legal obligation which requires NHS Digital to disclose personal data for non-medical purposes (same reason as immediately above);
• that limits any data sharing by NHS Digital to medical related purposes;
• that requires transparency with respect to what happens to NHS data at the end of contracts (e.g. with USA high tech companies), and
• that permits the ICO or National Data Guardian to receive reports on any chosen processing activity.

Why do the above need to be statutory safeguards?  Mainly because of the use of Ministerial Directions specify a legal basis that negates most of the list above.

Upcoming Data Protection Course

Because of Indian variant and the consequent COVID lockdown uncertainty, the following course can be attended in person or via Zoom or a mixture (it's up to you)

Data Protection Practitioner: London, Starts July 13 (6 days)

Full details on www.amberhawk.com/StandardDP.asp or by emailing info@amberhawk.com

References  

NHS Digital Privacy Notice: https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/transparency-notice#opting-out-of-nhs-digital-collecting-your-data-type-1-opt-out-

Directions from the Secretary of State: https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/secretary-of-state-directions/general-practice-data-for-planning-and-research-directions-2021

Details of the data collection associated with the Directions: https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/secretary-of-state-directions/general-practice-data-for-planning-and-research-directions-2021#learn-more-about-this-direction

Blog on the wider use of the Scottish Health Data register to create a population register: https://amberhawk.typepad.com/amberhawk/2015/03/development-of-a-scottish-population-registerid-card-scheme-is-subject-to-ico-criticism.html and https://amberhawk.typepad.com/amberhawk/2015/01/proposals-to-expand-central-nhs-register-creates-a-national-population-register-and-significant-data.html

Blog on Royal Free Hospital and Deep Mind: https://amberhawk.typepad.com/amberhawk/2017/07/royal-free-undertaking-exposes-weakness-in-data-protection-enforcement-regime.html

Blog on the use of Ministerial Directions by the national security agencies to justify bulk data acquisition: Section 94 of the Telecommunications Act 1984: a warning from history. https://amberhawk.typepad.com/amberhawk/2015/11/section-94-of-the-telecommunications-act-1984-a-warning-from-history.html